this post was submitted on 31 Jan 2024
5 points (85.7% liked)

Selfhosted

60366 readers
562 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Detailed Rules Post

  1. Be civil.

  2. No spam.

  3. Posts are to be related to self-hosting.

  4. Don't duplicate the full text of your blog or readme if you're providing a link.

  5. Submission headline should match the article title.

  6. No trolling.

  7. Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 3 years ago
MODERATORS
ruud@lemmy.world
Loki@lemmy.world
CannaVet@lemmy.world
devve@lemmy.world
ayyy@sh.itjust.works
curbstickle@anarchist.nexus
curbstickle_lw@lemmy.world
5
Issue with Traefik SSL and PiHole (lemmy.world)
submitted 2 years ago by WASTECH@lemmy.world to c/selfhosted@lemmy.world
6 comments fedilink hide all child comments
 

I set up SSL certificates for my internal services behind Traefik, but I was having some issues obtaining the certificates. I ended up having to add this line in my Docker compose file to bypass PiHole which is controlling the internal hostnames for my domain:

- --certificatesresolvers.letsencrypt.acme.dnschallenge.resolvers=1.1.1.1:53,1.0.0.1:53

After adding that, I was able to successfully pull a cert. The issue is, I have a firewall set up that blocks DNS requests from everywhere except my DNS servers (PiHole), so I had to pause that rule temporarily to get the request to go through.

Wondering what I can do here (if anything) to resolve this without having to disable my firewall rules regularly.

all 7 comments
sorted by: hot top controversial new old
[–] theit8514@lemmy.world 1 points 2 years ago (1 children)

I would start by testing if you can resolve acme-v02.api.letsencrypt.org from the PiHole and if not, see what you need to unblock that.

[–] theit8514@lemmy.world 1 points 2 years ago (1 children)
[–] WASTECH@lemmy.world 1 points 2 years ago

Did some more testing to get some details. The error I am getting from Traefik is that Cloudflare cannot create the record because it already exists (PiHole already has the entries). If I delete the records from PiHole, Traefik can then create the TXT records in Cloudflare.

[–] MangoPenguin@lemmy.blahaj.zone 1 points 2 years ago (1 children)

Create a new rule on the firewall to allow DNS requests to cloudflare from that host only.

[–] WASTECH@lemmy.world 1 points 2 years ago

That is what I ended up doing temporarily, but I think I will just make it temporarily permanent. I could likely set up another Docker container to run a DNS server connected to a DoH resolver, and use that container as the DNS server for Traefik, but that's a lot of work.

[–] Decronym@lemmy.decronym.xyz 0 points 2 years ago* (last edited 2 years ago)

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:

Fewer Letters More Letters
DNS Domain Name Service/System
PiHole Network-wide ad-blocker (DNS sinkhole)
SSL Secure Sockets Layer, for transparent encryption

3 acronyms in this thread; the most compressed thread commented on today has 7 acronyms.

[Thread #470 for this sub, first seen 31st Jan 2024, 14:55] [FAQ] [Full list] [Contact] [Source code]