6 ms·

I do the same thing. I'm not worried about them seeing my FQDNs. I use the form of hostname.int.example.com for everything inside my home network. None of whic

by graton 2mo ago

I do the same thing. I'm not worried about them seeing my FQDNs. I use the form of hostname.int.example.com for everything inside my home network. None of which is accessible to the outside world. I use LetsEncrypt with DNS validation to get the certificates.

tzs 2mo ago
If you are going to have all the home stuff on a subdomain (int.example.com) would it work to delegate int.example.com to a DNS server running at home what has internet access, and could handle the ACME DNS challenges for machines on int.example.com? If it does then you don't have to mess with your public DNS whenever you want to add or renew certificates for home machines. I'm using the free DNS my registrar provides, which doesn't provide API access unless you upgrade to their paid DNS service and so if I could use a local DNS server for the ACME challenges for the home network I could pick one that is friendly to automation.
- waynesonfire 2mo ago
  Yes, you're describing a fundemental feature of DNS.
- graton 2mo ago
  > I'm using the free DNS my registrar provides, which doesn't provide API access unless you upgrade to their paid DNS service I use Cloudflare for DNS and it is free to use the API.
throw0101a 2mo ago
> I use the form of hostname.int.example.com […] Note that int is a valid TLD: * https://en.wikipedia.org/wiki/.int https://en.wikipedia.org/wiki/.int * https://datatracker.ietf.org/doc/html/rfc1591 https://datatracker.ietf.org/doc/html/rfc1591
- icedchai 2mo ago
  He’s using it as a subdomain.
  - 0xbadcafebee 2mo ago
    Which can still cause problems depending on your search domain setting and resolver client
    - icedchai 2mo ago
      I do the same thing and have never had a problem. Maybe I’ve just been lucky for 25+ years. Some hosts have a search path of “int.example.com, example.com”. Others are just “example.com”
    - _bernd 2mo ago
      Could you give an example? I'm curious, too.
      - throw0101d 2mo ago
        If you generally had "search example.com" in you resolv.conf, and were in the habit of having "web01.dev" in places, behaviour may have changed if you were happen to be on a machine that had the "search" line missing (or something else).
  - throw0101d 2mo ago
    > He’s using it as a subdomain. Lots of folks were using "dev" as a sub-domain which was fine until ICANN decide to give Google a TLD: * https://en.wikipedia.org/wiki/.dev https://en.wikipedia.org/wiki/.dev So if you generally had "search example.com" in you resolv.conf, and were in the habit of having "web01.dev" in places, behaviour may have changed if you were suddenly on a machine that had the "search" line missing (or something else).
    - icedchai 2mo ago
      What you describe is a user and resolver configuration problem. There are 100's of TLDs and there's always a chance they will conflict with subdomains, either now or in the future as new TLDs are created. I've been using both "int" and "dev" as subdomains since at least 2000 and never had an issue.
- graton 2mo ago
  So? I don't see any issue. I always use FQDNs for everything.

by graton 2mo ago

tzs 2mo ago

If you are going to have all the home stuff on a subdomain (int.example.com) would it work to delegate int.example.com to a DNS server running at home what has internet access, and could handle the ACME DNS challenges for machines on int.example.com? If it does then you don't have to mess with your public DNS whenever you want to add or renew certificates for home machines. I'm using the free DNS my registrar provides, which doesn't provide API access unless you upgrade to their paid DNS service and so if I could use a local DNS server for the ACME challenges for the home network I could pick one that is friendly to automation.

waynesonfire 2mo ago
Yes, you're describing a fundemental feature of DNS.
graton 2mo ago
> I'm using the free DNS my registrar provides, which doesn't provide API access unless you upgrade to their paid DNS service I use Cloudflare for DNS and it is free to use the API.

throw0101a 2mo ago

> I use the form of hostname.int.example.com […] Note that int is a valid TLD: * https://en.wikipedia.org/wiki/.int https://en.wikipedia.org/wiki/.int * https://datatracker.ietf.org/doc/html/rfc1591 https://datatracker.ietf.org/doc/html/rfc1591

icedchai 2mo ago
He’s using it as a subdomain.
- 0xbadcafebee 2mo ago
  Which can still cause problems depending on your search domain setting and resolver client
  - icedchai 2mo ago
    I do the same thing and have never had a problem. Maybe I’ve just been lucky for 25+ years. Some hosts have a search path of “int.example.com, example.com”. Others are just “example.com”
  - _bernd 2mo ago
    Could you give an example? I'm curious, too.
    - throw0101d 2mo ago
      If you generally had "search example.com" in you resolv.conf, and were in the habit of having "web01.dev" in places, behaviour may have changed if you were happen to be on a machine that had the "search" line missing (or something else).
- throw0101d 2mo ago
  > He’s using it as a subdomain. Lots of folks were using "dev" as a sub-domain which was fine until ICANN decide to give Google a TLD: * https://en.wikipedia.org/wiki/.dev https://en.wikipedia.org/wiki/.dev So if you generally had "search example.com" in you resolv.conf, and were in the habit of having "web01.dev" in places, behaviour may have changed if you were suddenly on a machine that had the "search" line missing (or something else).
  - icedchai 2mo ago
    What you describe is a user and resolver configuration problem. There are 100's of TLDs and there's always a chance they will conflict with subdomains, either now or in the future as new TLDs are created. I've been using both "int" and "dev" as subdomains since at least 2000 and never had an issue.
graton 2mo ago
So? I don't see any issue. I always use FQDNs for everything.