4 ms·
You do need a DNS service with API access for automatically creating/renewing the certificates for things that are only served over tailscale though, since they
by zchrykng 10d ago
You do need a DNS service with API access for automatically creating/renewing the certificates for things that are only served over tailscale though, since they aren't publicly accessible for the letsencrypt servers to talk to.
- unshavedyak 10d agoI've got a Caddy instance setup which proxies my traffic and has dead easy integration for domain DNS registration. Super handy
- entropicdrifter 10d agoSame, it's fantastic. As long as you don't need to support as many requests per second on your hardware as something like NGINX could, Caddy is the way to go.
- zchrykng 10d agoCaddy is great, but doesn't solve the problem I was talking about on its own. Caddy will get SSL certs automatically if it is exposed to the internet and DNS for that domain points to it, but if you are routing over tailscale exclusively Caddy can't automatically validate the domain names over ACME. There is a Caddy extension for doing DNS based validation, but that puts you back to needing a DNS provider with an API.
- unshavedyak 10d ago> There is a Caddy extension for doing DNS based validation, but that puts you back to needing a DNS provider with an API. Yea, for clarity this is what i was describing. I use Porkbun's API and the Caddy instance isn't reachable from the internet, only local and over tailscale