4 ms·
As somebody with a very similar setup, all the things I'm making accessible over the Wireguard network are HTTPS, SSH, etc. The handful of things that couldn't
by akerl_ 1y ago
As somebody with a very similar setup, all the things I'm making accessible over the Wireguard network are HTTPS, SSH, etc. The handful of things that couldn't do native TLS (or were irritating to get configured with automated TLS certs) I stuck behind nginx for TLS.
- ggpsv 1y agoAuthor here! Indeed, it is mostly HTTPS terminated by Caddy in the server at home. Otherwise, it is SSH.
- devsda 1y agoShort of setting up dns validation and using 3rd party dns service as many registrars don't support API for dns management, how is domain validation done for acquiring TLS certs when serving only via wireguard ? There's the private CA route but its a pain to setup the certs on all (mobile) devices and Android makes it very scary and hard.
- akerl_ 1y agoI use https://github.com/go-acme/lego https://github.com/go-acme/lego and DNS validation. I'm not sure what DNS provider you're using, but a ton of them have robust APIs. In my case, I'm using Route53 which is notable in that I can generate API credentials that can only update the specific record needed for a particular name's ACME validation record. Here's a list of supported providers: https://go-acme.github.io/lego/dns/ https://go-acme.github.io/lego/dns/ And in case you're curious, the API perms dance to do specific-record updates: https://github.com/armorfret/terraform-aws-r53-certbot/blob/main/main.tf#L47-L62 https://github.com/armorfret/terraform-aws-r53-certbot/blob/...