3 ms·

Seriously, don't put traefik in front of your localdev if.you don't explicitly have to. It is way too much complexity and introduces an added layer of noise to

by theK 3y ago

Seriously, don't put traefik in front of your localdev if.you don't explicitly have to. It is way too much complexity and introduces an added layer of noise to bedug. Also, does local host subdomain resolution work on all OSes OOB now? Iirc this was an apple exclusive feature in the past.

folmar 3y ago
> local host subdomain resolution Works fine on current ubuntu, both with systemd stub-nameserver and even if I replace it with a real one in /etc/resolv.conf.
CGamesPlay 3y ago
Note that the article uses http://traefik.me/ http://traefik.me/, one of those sites that resolves all subdomains to localhost (like lvh.me, http://readme.localtest.me/ http://readme.localtest.me/, or http://local.gd/ http://local.gd/), so you don't need any "localhost subdomain resolution".
- benatkin 3y ago
  I thought Let's Encrypt wouldn't allow SSL certificates with public private keys. It defeats the purpose. Edit: indeed, it says this: > You warrant to ISRG and the public-at-large that You have taken, and You agree that at all times You will take, all appropriate, reasonable, and necessary steps to assure control of, secure, properly protect, and keep secret and confidential the Private Key corresponding to the Public Key in Your Certificate (and any associated activation data or device, e.g. password or token). https://letsencrypt.org/documents/LE-SA-v1.3-September-21-2022.pdf https://letsencrypt.org/documents/LE-SA-v1.3-September-21-20... via https://letsencrypt.org/repository/ https://letsencrypt.org/repository/
  - tinco 3y ago
    If you click what looks like the link to the privkey it shows a warning encouraging you to not revoke the key with LetsEncrypt. I suppose a *.traefik.me is as untrustworthy as any other you don't the owner of, so it doesn't really matter that anyone can sign a key for it, anyone can already get a key for any untrustworthy domain name they could come up with via letsencrypt. So it's probably only a problem for people who use traefik.me, they might be tricked into thinking they're visiting their own locally hosted site, and instead might be man-in-the-middled. Though that's a fairly specific attack coming from an APT or as a means to escalation from someone who already gained access through other means.
    - benatkin 3y ago
      A phishing site with https://coinbase-support-172-67-207-118.traefik.me/ https://coinbase-support-172-67-207-118.traefik.me/ would be similar to some phishing domains I've seen, and have the lock. With the lock I'm sure it could trick some people.
papruapap 3y ago
I normally use nginx and works just fine tbh, easiest way to emulate an ingress service imo (I deploy to k8s afterwards).

by theK 3y ago

folmar 3y ago

> local host subdomain resolution Works fine on current ubuntu, both with systemd stub-nameserver and even if I replace it with a real one in /etc/resolv.conf.

CGamesPlay 3y ago

Note that the article uses http://traefik.me/ http://traefik.me/, one of those sites that resolves all subdomains to localhost (like lvh.me, http://readme.localtest.me/ http://readme.localtest.me/, or http://local.gd/ http://local.gd/), so you don't need any "localhost subdomain resolution".

benatkin 3y ago
I thought Let's Encrypt wouldn't allow SSL certificates with public private keys. It defeats the purpose. Edit: indeed, it says this: > You warrant to ISRG and the public-at-large that You have taken, and You agree that at all times You will take, all appropriate, reasonable, and necessary steps to assure control of, secure, properly protect, and keep secret and confidential the Private Key corresponding to the Public Key in Your Certificate (and any associated activation data or device, e.g. password or token). https://letsencrypt.org/documents/LE-SA-v1.3-September-21-2022.pdf https://letsencrypt.org/documents/LE-SA-v1.3-September-21-20... via https://letsencrypt.org/repository/ https://letsencrypt.org/repository/
- tinco 3y ago
  If you click what looks like the link to the privkey it shows a warning encouraging you to not revoke the key with LetsEncrypt. I suppose a *.traefik.me is as untrustworthy as any other you don't the owner of, so it doesn't really matter that anyone can sign a key for it, anyone can already get a key for any untrustworthy domain name they could come up with via letsencrypt. So it's probably only a problem for people who use traefik.me, they might be tricked into thinking they're visiting their own locally hosted site, and instead might be man-in-the-middled. Though that's a fairly specific attack coming from an APT or as a means to escalation from someone who already gained access through other means.
  - benatkin 3y ago
    A phishing site with https://coinbase-support-172-67-207-118.traefik.me/ https://coinbase-support-172-67-207-118.traefik.me/ would be similar to some phishing domains I've seen, and have the lock. With the lock I'm sure it could trick some people.

papruapap 3y ago

I normally use nginx and works just fine tbh, easiest way to emulate an ingress service imo (I deploy to k8s afterwards).