Selfhosted
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
-
No spam posting.
-
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
-
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
-
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
-
No trolling.
-
No low-effort posts. This is subjective and will largely be determined by the community member reports.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
view the rest of the comments
I do not understand why you are using certwarden when Caddy can generate SSL certificates by itself.
But you're still using Caddy as the sole reverse proxy, don't you? Do you have multiple Caddy instances that require access to a single certificate?
Thing is, you may have some devices that should be accessible even if the reverse proxy is unreachable.
And if you have HSTS and wamt to reach a device under the same local DNS suffix (example: External -> service.example.org, Internal: service.int.examole.org) you can't just bypass the https warning.
Same for devices reachable over RDP, SSH, etc. etc.
If you switch to the dns-01 challenge you can just generate the certs on multiple servers hasselfree. And as a bonus you can get wildcard certs for subdomains.
How ?
I've seen nothing about that in the Caddy docs.
I must admit that one disadvantage of Caddy compared to when I was using
acme.sh, is having to make a request to Let's Encrypt (even automatically) for every subdomain, making all of them visible on crt.shThe docs on DNS challenge are here, and a bit further down you can find the ones on wildcard certificates
Oh, thanks !