20 ms·

A lot of people don't have nice urls for their homelab services, having to memorize IP-numbers and ports is a lot harder. Personally I get a nice feeling of ac

by wutanc 4y ago

A lot of people don't have nice urls for their homelab services, having to memorize IP-numbers and ports is a lot harder. Personally I get a nice feeling of accomplishment from looking at a dashboard with all the services I've set up. It's maybe not super useful but it's nice.

vladvasiliu 4y ago
Fair point. It's true that in my case, one of the first things I did was set up DNS. My lab also has a public domain name that I manage through Cloudflare, which also gives me easy SSL [0] for my services. --- [0] "easy" as in I don't have to have an open port for Let's Encrypt. And I'm also uncomfortable with giving full DNS access to every service, because I haven't yet found a registrar with sane access control for zone management.
- arjvik 4y ago
  I've never tried this before, but take a look at https://www.eff.org/deeplinks/2018/02/technical-deep-dive-securing-automation-acme-dns-challenge-validation https://www.eff.org/deeplinks/2018/02/technical-deep-dive-se..., specifically the CNAME and ACME-DNS methods.
  - vladvasiliu 4y ago
    I was familiar with the CNAME workaround, but it's not practical, since I'd have to manage X different zones, one for each redirection. I thought about abusing DuckDNS or something similar for this, but I figured it wouldn't be fair, so I never did. At one point I set up an internal Smallstep CA [0], which kinda worked but was pretty fragile, so I abandoned it. I didn't know about ACME-DNS. It looks interesting, but for the time being tunneling everything through Cloudflared works well enough for my needs. [0] https://smallstep.com/ https://smallstep.com/
- Macha 4y ago
  So what I did was put acme-dns on a publicly accessible server I have, and use DNS zone delegation to that, as like you, my provider basically gives you an all or nothing API key as far as DNS access goes.
xoa 4y ago
>A lot of people don't have nice urls for their homelab services, having to memorize IP-numbers and ports is a lot harder. There isn't much excuse for that though. In a homelab setting in particular I think you should just run your own DNS and CA with your own domain. The Name Constraints option is handy there for containing scope (also useful for restricting the scope of any other internal CAs a business might ask you to run for example via cross signing).
- greggsy 4y ago
  I don’t want to remember names either. I type in ‘hei-‘ in the browser, it autocompletes to Heimdall, then I click the shiny button of the thing I want.
  - SahAssar 4y ago
    Is that any different than me typing 'gite' and it autocompletes to my gitea DNS, or 'jell' and it autocompletes to my jellyfin? I'm guessing if you are self-hosting these things they are used often enough that they would be in the top of your autocomplete?
  - shaky-carrousel 4y ago
    Hah, I don't want to remember either. I have 18 services, so it's nice to have a catalog of what I have installed.
    - xoa 4y ago
      I don't suppose either of you have considered, you know, bookmarks in your browser ;)? And for tons of services a dashboard wouldn't be my first choice for cataloging/planning anyway, there are other tools for more or less automated planning/deployment/herding. One still often needs to actually know some addresses too just to make use of services in non-web contexts, and a way to have things not break if IPs need to be adjusted. And you still need some way to make sure everything is talking securely. More than one way to do that too but CAs scale pretty well and have decent general support even amongst end devices. But for a homelab whatever one wants ultimately is fine, whole point is to experiment after all!
lillecarl 4y ago
If you don't have DNS you can't have publicly trusted certificates, I'm very doubtful homelabbers go through the effort of getting servers, configuring services and the lot without the most rudimentary protocol in place. Self-managed or not, it's VERY essential with functional DNS

by wutanc 4y ago

vladvasiliu 4y ago

Fair point. It's true that in my case, one of the first things I did was set up DNS. My lab also has a public domain name that I manage through Cloudflare, which also gives me easy SSL [0] for my services. --- [0] "easy" as in I don't have to have an open port for Let's Encrypt. And I'm also uncomfortable with giving full DNS access to every service, because I haven't yet found a registrar with sane access control for zone management.

arjvik 4y ago
I've never tried this before, but take a look at https://www.eff.org/deeplinks/2018/02/technical-deep-dive-securing-automation-acme-dns-challenge-validation https://www.eff.org/deeplinks/2018/02/technical-deep-dive-se..., specifically the CNAME and ACME-DNS methods.
- vladvasiliu 4y ago
  I was familiar with the CNAME workaround, but it's not practical, since I'd have to manage X different zones, one for each redirection. I thought about abusing DuckDNS or something similar for this, but I figured it wouldn't be fair, so I never did. At one point I set up an internal Smallstep CA [0], which kinda worked but was pretty fragile, so I abandoned it. I didn't know about ACME-DNS. It looks interesting, but for the time being tunneling everything through Cloudflared works well enough for my needs. [0] https://smallstep.com/ https://smallstep.com/
Macha 4y ago
So what I did was put acme-dns on a publicly accessible server I have, and use DNS zone delegation to that, as like you, my provider basically gives you an all or nothing API key as far as DNS access goes.

xoa 4y ago

>A lot of people don't have nice urls for their homelab services, having to memorize IP-numbers and ports is a lot harder. There isn't much excuse for that though. In a homelab setting in particular I think you should just run your own DNS and CA with your own domain. The Name Constraints option is handy there for containing scope (also useful for restricting the scope of any other internal CAs a business might ask you to run for example via cross signing).

greggsy 4y ago
I don’t want to remember names either. I type in ‘hei-‘ in the browser, it autocompletes to Heimdall, then I click the shiny button of the thing I want.
- SahAssar 4y ago
  Is that any different than me typing 'gite' and it autocompletes to my gitea DNS, or 'jell' and it autocompletes to my jellyfin? I'm guessing if you are self-hosting these things they are used often enough that they would be in the top of your autocomplete?
- shaky-carrousel 4y ago
  Hah, I don't want to remember either. I have 18 services, so it's nice to have a catalog of what I have installed.
  - xoa 4y ago
    I don't suppose either of you have considered, you know, bookmarks in your browser ;)? And for tons of services a dashboard wouldn't be my first choice for cataloging/planning anyway, there are other tools for more or less automated planning/deployment/herding. One still often needs to actually know some addresses too just to make use of services in non-web contexts, and a way to have things not break if IPs need to be adjusted. And you still need some way to make sure everything is talking securely. More than one way to do that too but CAs scale pretty well and have decent general support even amongst end devices. But for a homelab whatever one wants ultimately is fine, whole point is to experiment after all!

lillecarl 4y ago

If you don't have DNS you can't have publicly trusted certificates, I'm very doubtful homelabbers go through the effort of getting servers, configuring services and the lot without the most rudimentary protocol in place. Self-managed or not, it's VERY essential with functional DNS