Selfhosted
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil.
-
No spam.
-
Posts are to be related to self-hosting.
-
Don't duplicate the full text of your blog or readme if you're providing a link.
-
Submission headline should match the article title.
-
No trolling.
-
Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details. Tags [CBH] or [AIP] are required, see the links in Rule 8 for details.
-
AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post, and find example disclosures here.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
view the rest of the comments
Certbot?
It can automate provisioning of certificates using DNS-01 challenges, which have wildcard certificates.
https://eff-certbot.readthedocs.io/en/stable/using.html#dns-plugins
Example tutorial: https://www.digitalocean.com/community/tutorials/how-to-create-let-s-encrypt-wildcard-certificates-with-certbot
Once you do that it puts the cert in
/etc/letsencrypt/live/so you can then do whatever you want with it. You would have to handle distribution manually.If you want to automate stuff across of a bunch of machines at once, I recommend Ansible: https://docs.ansible.com/projects/ansible/latest/index.html
I’m looking for a way to both get a sub wildcard (I don’t know the exact wording but *.sub.domain.com would be an example) and push it into cloudflare. So a direct certbot install with manual distribution, while technically possible, sounds absolutely abysmal. I’d rather forget the entire idea than deal with that.
I would recommend reconsidering how you obtain LE certs. I ended up on Certbot too because it lets you own what is a critical part of your selfhosted identity. Plus Certbot works well and it's maintained by the EFF who also see it as a critical project. As a local script (basically) sky's the limit regarding automation.
This is personal preference but I strongly prefer to locally control critical automations about my setup (certs, DDNS etc.)
The certs produced by Certbot are portable and you can use them with CF, local reverse proxies, or whatever other infrastructure you may need. Just need to get a copy to the proper place (securely).
I guess in the bigger scheme of things the question is whether you're ok being tied to a particular service (like CF). I don't, and I also don't want to depend on the LE implementation of any particular reverse proxy (or their plugins).
PS: Oh and another tip: if you do end up using a CLI tool for certs, stick to Certbot. I've tried pretty much everything else and they all suck. It's actually unbelievable how much they suck. Arcane and opaque, the lot of them, which is not something you want from a critical tool.
Does cloud flare not do that?
They get certs so must have a way to get any kind of cert
Cloudflare will only handle certs to the first subdomain, after that you either have to provide them. Or they may charge for it, I’m not sure anymore, but I’m going full free tier so I still need to provide them.
Why not handle certs on your end and just use CF for proxy? I use NPM for cert automation with CF proxying. It's honestly ridiculous easy and I've had no issues.
Cloudflare doesn’t pass the cert you have through, it generates its own cert (or uses one you provide).
Depends on your config, I'm just doing DNS (proxied). So you hit my nginx and that's where the cert is provided.
Have you actually confirmed that is the case? My understanding is that cloudflare pretty much always re-signs with their own SSL cert. and I'm fairly certain that would be absolutely required when using their DNS proxies.