• 0 Posts
  • 9 Comments
Joined 2 years ago
cake
Cake day: July 5th, 2023

help-circle

  • Cheers to your journey so far, and to your continued success!

    You can absolutely do free SSL certs with Let’s Encrypt without exposing your infrastructure to the internet. Just use DNS based validation instead of HTTP, copy the required TXT records to your domain as instructed, wait for any cache/TTL of any old records to expire (generally 1-2 hours by default), and finally complete the validation.

    You’ll need to renew the certs every 3 months, which could be annoying if done manually. If your Registrar has a decent API, writing a script could be a fun automation project. Alternatively I can also send you scripts that I used to use for that purpose.


  • aMockTie@lemmy.worldtoSelfhosted@lemmy.worldPangolin
    link
    fedilink
    English
    arrow-up
    5
    ·
    2 days ago

    As a sanity check, I just completed the same setup that you described (Ubuntu Server 24.04 running in a Proxmox VM, Domain name pointing to a CNAME that points to the Dynamic IP, using the installer script, enabled CrowdSec, etc.), and everything worked out of the box. A couple of things I noticed that would also be worth checking now that I’m more familiar with this specific setup are:

    • In the config/config.yml file, verify that the dashboard_url is set to the FQDN of the full URL (e.g. pangolin.mydomain.com), and that the base_domain is set to the root/apex domain (e.g. mydomain.com).
    • Double check those DNS records. As the haiku goes: it’s not DNS, it couldn’t be DNS, it was DNS. dig pangolin.mydomain.com or dig @1.1.1.1 pangolin.mydomain.com should show the CNAME that points to the A record.
    • A 404 page not found error is normal when connecting to the IP address directly rather than using the domain name. I was successfully able to access the dashboard using the FQDN from a local and external network. Depending on your network, you might want to set up a local DNS record that points to the internal IP address as well (though this should be optional in most cases to my knowledge).

    I hope that helps!