4 ms·

Against much well-informed advice, I use a vanity domain for my internal network at home. Through a combination Smallstep CA, CoreDNS, and Traefik, any services

Against much well-informed advice, I use a vanity domain for my internal network at home. Through a combination Smallstep CA, CoreDNS, and Traefik, any services I host in my Docker Swarm cluster automatically are immediately issued a signed SSL certificate, load-balanced, and resolvable. Traefik also allows me to configure authentication for any services that I may not wish to expose without such. That said, I do recommend the use of the internal. zone for any such setup, as others have commented. This article provides some good reasons why (at least for .local) you should aim to use a standards-compliant internal zone: https://community.veeam.com/blogs-and-podcasts-57/why-using-local-as-your-domain-name-extension-is-a-bad-idea-4828 https://community.veeam.com/blogs-and-podcasts-57/why-using-...

hobo_mark 2y ago
I added a fake .com record in my internal DNS that resolves to my development server. All development clients within that network have an mkcert-generated CA installed. Not so different from you, but without even registering the vanity domain. Why is this such a bad idea?
- thot_experiment 2y ago
  I alias home.com to my local house stuff. I don't really understand why anyone thinks it's a bad idea either.
  - matthewaveryusa 2y ago
    It's not a terrible idea. On a large scale it can lead to the corp.com issue: https://krebsonsecurity.com/2020/02/dangerous-domain-corp-com-goes-up-for-sale/ https://krebsonsecurity.com/2020/02/dangerous-domain-corp-co... Honestly for USD5/year why don't you just buy yourself a domain and never have to deal with the problem?
  - deleted 2y ago
    [deleted]
- szszrk 2y ago
  For home it's not that bad, but there could be conflicts at some point. Your clients will send data to the Internet unknowingly when dns is missconfigured. It's better to use domain you control. I'm a fan of buying cheapest to extend (like .ovh, great value) and use real Let's Encrypt (via dns challenge) to register any subdomain/wildcard. So that any device will have "green padlock" for totally local service.
- octagons 2y ago
  To be clear, I didn’t register anything. I just have a configuration that serves records for a zone like “artichoke.” on my DNS server. Internal hosts are then accessible via https://gitlab.artichoke https://gitlab.artichoke, for example.
- kreetx 2y ago
  I run a custom (unused) tld with mkcert the same way, with nginx virtual hosts set up for each app.
tbyehl 2y ago
What's the argument against using one's own actual domain? In these modern times where every device and software wants to force HTTPS, being able to get rid of all the browser warnings is nice.
- waynesonfire 2y ago
  I think this is ideal. You make a great point that even if you were to use .internal TLD that is reserved for internal use, you wouldn't be able to use letsencrypt to get a SSL certificate for it. Not sure if there are other ssl options for .internal. But, self-signed is a PITA. I guess the lesson is to deploy a self-signed root ca in your infra early.
  - octagons 2y ago
    Check out Smallstep’s step-ca server [0]. It still requires some work, but it allows you to run your own CA and ACME server. I have nothing against just hosting records off of a subdomain and using LE as mentioned, but I personally find it satisfying to host everything myself. [0] https://smallstep.com/docs/step-ca/ https://smallstep.com/docs/step-ca/

hobo_mark 2y ago

I added a fake .com record in my internal DNS that resolves to my development server. All development clients within that network have an mkcert-generated CA installed. Not so different from you, but without even registering the vanity domain. Why is this such a bad idea?

thot_experiment 2y ago
I alias home.com to my local house stuff. I don't really understand why anyone thinks it's a bad idea either.
- matthewaveryusa 2y ago
  It's not a terrible idea. On a large scale it can lead to the corp.com issue: https://krebsonsecurity.com/2020/02/dangerous-domain-corp-com-goes-up-for-sale/ https://krebsonsecurity.com/2020/02/dangerous-domain-corp-co... Honestly for USD5/year why don't you just buy yourself a domain and never have to deal with the problem?
- deleted 2y ago
  [deleted]
szszrk 2y ago
For home it's not that bad, but there could be conflicts at some point. Your clients will send data to the Internet unknowingly when dns is missconfigured. It's better to use domain you control. I'm a fan of buying cheapest to extend (like .ovh, great value) and use real Let's Encrypt (via dns challenge) to register any subdomain/wildcard. So that any device will have "green padlock" for totally local service.
octagons 2y ago
To be clear, I didn’t register anything. I just have a configuration that serves records for a zone like “artichoke.” on my DNS server. Internal hosts are then accessible via https://gitlab.artichoke https://gitlab.artichoke, for example.
kreetx 2y ago
I run a custom (unused) tld with mkcert the same way, with nginx virtual hosts set up for each app.

tbyehl 2y ago

What's the argument against using one's own actual domain? In these modern times where every device and software wants to force HTTPS, being able to get rid of all the browser warnings is nice.

waynesonfire 2y ago
I think this is ideal. You make a great point that even if you were to use .internal TLD that is reserved for internal use, you wouldn't be able to use letsencrypt to get a SSL certificate for it. Not sure if there are other ssl options for .internal. But, self-signed is a PITA. I guess the lesson is to deploy a self-signed root ca in your infra early.
- octagons 2y ago
  Check out Smallstep’s step-ca server [0]. It still requires some work, but it allows you to run your own CA and ACME server. I have nothing against just hosting records off of a subdomain and using LE as mentioned, but I personally find it satisfying to host everything myself. [0] https://smallstep.com/docs/step-ca/ https://smallstep.com/docs/step-ca/