3 ms·

A real domain name is the way to go. The convenience of using LE wildcard certificates is huge. However, running split-horizon DNS is not straightforward, at

A real domain name is the way to go. The convenience of using LE wildcard certificates is huge. However, running split-horizon DNS is not straightforward, at least in a home setting. I don't see a huge problem with putting a couple of internal addresses in external DNS servers. lexicon cloudflare --auth-token $(gopass cloudflare) create my-real-domain.xyz A --name my-rpi --content 192.168.1.201

jeroenhd 5y ago
You don't necessarily need a split-horizon DNS. You only need a few records for the LE wildcard certificate to renew. In fact, DNS-01 only seems to require a single TXT record to resolve. In theory you could set up a small home server or dev machine script that pulls in a wildcard certificate and let all the real A/AAAA queries go to your LAN DNS server (or resolve through mDNS!). A record that doesn't resolve in global DNS won't usually cause much trouble in local DNS either. Putting internal IP addresses in your DNS could pose problems for (small) companies using this trick (because it allows hackers to map out your network) and it could cause confusion (when systems reverse-lookup domains and suddenly a spoofed 10.0.0.1 address is shown as myfunkyservice.sigjuice.xyz in the log files). The issues are minor and unlikely to be a problem, but they're there to serve as footguns years down the line.
- sigjuice 5y ago
  I didn't say split-horizon DNS is needed for getting LE certs. Just that a real domain name is a requirement to obtain LE certs in the first place. How will an A/AAAA query from something like https://my-rpi.my-real-domain.xyz https://my-rpi.my-real-domain.xyz resolve using mDNS? All DNS queries go to my LAN DNS server by default. I don't particularly care that I can't create A/AAAA records on my LAN DNS server (which is a Time Capsule, btw) to keep the queries inside. To me, the potential leakage of internal addresses/names is an acceptable tradeoff for the convenience. Btw, how is a reverse DNS lookup ever going to do what you mention? I am not creating any PTR records anywhere.
rootusrootus 5y ago
I have simple requirements, so I just have a few normal records for the external DNS (primarily for LE to use, but also to make it easier for me to find my way back into my home network when I'm out and about). For internal addresses, I just use overrides in Pi-Hole. I 100% agree that the whole reason for this setup is my LE cert. For whatever reason, some of my internal services with self-signed certs are not usable with Chrome, and some are. I don't know what pushes Chrome over the edge so it won't let you override. So I set up an internal reverse proxy with nginx to front-end all my internal services, then I only have to worry about keeping the LE cert installed in one spot.
denton-scratch 5y ago
Split horizon: I run DNSMasq on port 53, to serve DHCP and local DNS queries. DNSMasq forwards queries it can't answer (queries for "real" domains) to Unbound on port 1053. It's not split horizon, because Unbound only serves the LAN - I don't serve DNS to the world - and because Unbound isn't an authoritative nameserver. But it's not that hard to make DNSMasq serve zones, and it's not hard to make DNSMasq serve those zones only to queries from the intarwebs, and serve the DHCP 'zone' to local queries. And anyway, I guess you could use something ugly like BIND instead of Unbound, if you need an industrial-grade authoritative DNS server facing the internet.

jeroenhd 5y ago

You don't necessarily need a split-horizon DNS. You only need a few records for the LE wildcard certificate to renew. In fact, DNS-01 only seems to require a single TXT record to resolve. In theory you could set up a small home server or dev machine script that pulls in a wildcard certificate and let all the real A/AAAA queries go to your LAN DNS server (or resolve through mDNS!). A record that doesn't resolve in global DNS won't usually cause much trouble in local DNS either. Putting internal IP addresses in your DNS could pose problems for (small) companies using this trick (because it allows hackers to map out your network) and it could cause confusion (when systems reverse-lookup domains and suddenly a spoofed 10.0.0.1 address is shown as myfunkyservice.sigjuice.xyz in the log files). The issues are minor and unlikely to be a problem, but they're there to serve as footguns years down the line.

sigjuice 5y ago
I didn't say split-horizon DNS is needed for getting LE certs. Just that a real domain name is a requirement to obtain LE certs in the first place. How will an A/AAAA query from something like https://my-rpi.my-real-domain.xyz https://my-rpi.my-real-domain.xyz resolve using mDNS? All DNS queries go to my LAN DNS server by default. I don't particularly care that I can't create A/AAAA records on my LAN DNS server (which is a Time Capsule, btw) to keep the queries inside. To me, the potential leakage of internal addresses/names is an acceptable tradeoff for the convenience. Btw, how is a reverse DNS lookup ever going to do what you mention? I am not creating any PTR records anywhere.

rootusrootus 5y ago

I have simple requirements, so I just have a few normal records for the external DNS (primarily for LE to use, but also to make it easier for me to find my way back into my home network when I'm out and about). For internal addresses, I just use overrides in Pi-Hole. I 100% agree that the whole reason for this setup is my LE cert. For whatever reason, some of my internal services with self-signed certs are not usable with Chrome, and some are. I don't know what pushes Chrome over the edge so it won't let you override. So I set up an internal reverse proxy with nginx to front-end all my internal services, then I only have to worry about keeping the LE cert installed in one spot.

denton-scratch 5y ago

Split horizon: I run DNSMasq on port 53, to serve DHCP and local DNS queries. DNSMasq forwards queries it can't answer (queries for "real" domains) to Unbound on port 1053. It's not split horizon, because Unbound only serves the LAN - I don't serve DNS to the world - and because Unbound isn't an authoritative nameserver. But it's not that hard to make DNSMasq serve zones, and it's not hard to make DNSMasq serve those zones only to queries from the intarwebs, and serve the DHCP 'zone' to local queries. And anyway, I guess you could use something ugly like BIND instead of Unbound, if you need an industrial-grade authoritative DNS server facing the internet.