5 ms·

How is not being able to test on a local network a feature?

viraptor 3y ago
You can test on a local network. Get a free certificate for a wildcard test domain (the author already owns a domain, so that's trivial), then use whatever.test.your-domain for all your testing. The post makes it sound way more complicated than it is.
Diti 3y ago
He’s able to test on a local network. It is a certificates problem, not a network one. The article’s OP is wrong here: > So to test this, I’d need both ends of the communcation [sic] to be on the public internet with proper certificates. That is false. If you setup Tailscale (or Headscale, if you want a self-hosted endpoint), all communications are made with CGNAT address space (you hit neither the public internet nor your private network), and still get HTTPS certificates (from Tailscale’s ts.net ACME-friendly subdomain). Basically: use a VPN service which handles both TLS certificates and NAT traversal, and you can do your secure local tests all you want.
- mariusor 3y ago
  To a person complaining about increased complexity introduced by mandatory usage of HTTPS you respond with an option to introduce even more complexity in the form of internal VPN?! Can you tell me how you find that reasonable?
  - Diti 3y ago
    Have you ever used Tailscale? Just installing it on each device (and logging in with an account you already own) is the only thing you have to do to create a tunnel. You enable HTTPS certificates requires clicking on two links and enabling a switch. Caddy (a webserver which, surely, the OP of this article must be using, if he’s serious about keeping things simple) comes with Tailscale support built-in, so you get your automatic HTTPS (ACME) with one line of configuration (adding `machinename.tailnet-name.ts.net` in the Caddyfile). For fun, here’s the full configuration file for a server which serves a “what is my IP” service over HTTPS, only served when you are connected to your VPN: server1.cat-crocodile.ts.net { templates respond "{{.RemoteIP}}" } (I should probably show how to remote proxy, to stay relevant with the article’s point, but I wanted to show off my Go-template-fu.) Do you think installing software, clicking on a few links + a button (switch) on a website, and writing one line of configuration is unreasonable or complex?

You can test on a local network. Get a free certificate for a wildcard test domain (the author already owns a domain, so that's trivial), then use whatever.test.your-domain for all your testing. The post makes it sound way more complicated than it is.

Diti 3y ago

He’s able to test on a local network. It is a certificates problem, not a network one. The article’s OP is wrong here: > So to test this, I’d need both ends of the communcation [sic] to be on the public internet with proper certificates. That is false. If you setup Tailscale (or Headscale, if you want a self-hosted endpoint), all communications are made with CGNAT address space (you hit neither the public internet nor your private network), and still get HTTPS certificates (from Tailscale’s ts.net ACME-friendly subdomain). Basically: use a VPN service which handles both TLS certificates and NAT traversal, and you can do your secure local tests all you want.

mariusor 3y ago
To a person complaining about increased complexity introduced by mandatory usage of HTTPS you respond with an option to introduce even more complexity in the form of internal VPN?! Can you tell me how you find that reasonable?
- Diti 3y ago
  Have you ever used Tailscale? Just installing it on each device (and logging in with an account you already own) is the only thing you have to do to create a tunnel. You enable HTTPS certificates requires clicking on two links and enabling a switch. Caddy (a webserver which, surely, the OP of this article must be using, if he’s serious about keeping things simple) comes with Tailscale support built-in, so you get your automatic HTTPS (ACME) with one line of configuration (adding `machinename.tailnet-name.ts.net` in the Caddyfile). For fun, here’s the full configuration file for a server which serves a “what is my IP” service over HTTPS, only served when you are connected to your VPN: server1.cat-crocodile.ts.net { templates respond "{{.RemoteIP}}" } (I should probably show how to remote proxy, to stay relevant with the article’s point, but I wanted to show off my Go-template-fu.) Do you think installing software, clicking on a few links + a button (switch) on a website, and writing one line of configuration is unreasonable or complex?