Hey everyone,
I’m one of the people who still used proton and am now in the process of switching everything and trying to selfhost more.
I sucessfully setup Vaultwarden. I also decided I should move away from having my dockers publicly exposed with nginx reverse proxy and switched everything over to netbird. Im using their proxy feature now to access everything with custom domains and followed a tutorial to setup a bring your own proxy server on a vps. So now all my services are only accessible when my netbird vpn is active. I also spun up a pihole docker and added that to my netbird dns servers to try and get ad blocking on my mobile devices. So far so good.
I wonder however that while some webui’s like vaultwarden run with https, others like radarr dont. Is this a problem or does it not matter so much since i have the vpn running?
I dont really understand how I would go about making them https though. Im on unraid for my dockers and don’t see why some use https and others don’t.
Sorry if this is a convoluted post, I’m quite in over my head with all the networking and dns stuff and just hoping I’m not doing something stupid.
Thanks for your help!
wow, I didnt expect so many replies, thank you guys so much! Really Cool to see the fediverse this alive. Ill definitely dive in to all your suggestion and try to get ssl running on all services just to be safe. I think I had this figured out back when I used npm but now that i use the netbird proxy service to link to the services directly, Im not sure how a proxy like npm or caddy or traefik would fit into the equation. But I’m sure ill find something with some trial and error
So, HTTPS prevents people on the network from hijacking the connection or spying on what you do with the website or your passwords. If you have a VPN and no evil devices inside your network you are likely fine, and many things don’t need HTTPS-level of safety.
That said, browsers make using HTTP almost unusable nowadays, because over the internet you really want your connection to not be hyjacked, and almost nobody self-hosts (sadly).
I would reccommend to set up a reverse proxy to do https for all services you host, even if you only use it via lan/vpn. Adding a new service then becomes just hosting it over HTTP, and have your reverse proxy converting the connection to HTTPS.
If you have a domain, you can request a wildcard cert from let’s encrypt and use that also for internal domains (they don’t need to be reachable from the public internet, but you might need to expose the ACME challenge file).
If you want to learn a lot about certificates you can go the self-signed route, but you’ll have to install the certificate on every device you use to access your services (guests will get huge warnings when trying to access your pages, if you give them access to them). Once set up it’s more flexible though, and if you configure your dns server you can have whatever domain you want, even nonexistent or unavailable ones.
A reverse proxy like Caddy can get a ssl cert via dns challenge and add ssl to all your internal self hosted services, provided you have a domain hosted somewhere supported.
With everything behind tailscale, and hence no need for opening the firewall, my DNS challenge failed when I tried to set it up last time using certbot.
A dns challenge requires no inbound connections. You misconfigured something.
Some features like copying to your clipboard will only work if you’re using https
if you’re accessing over the internet, always use TLS/HTTPS.
if you’re accessing over LAN, you should still use TLS/HTTPS.
just because you’re hosting the app locally doesn’t mean the JS embedded in the page is safe. HTTPS will ensure that all your traffic is encrypted so only you and the server knows what it contains.
if the JS on the page is unsafe then HTTPS wouldn’t help right? The JS could scrape all the info client-side and extradite it.
AFAIK the reason why you’d use HTTPS on your LAN is if you’re afraid of middleman attacks in your LAN, like a malicious device that pretends to be the internet router.
it would if it’s importing something else.
let’s say your site is on https://app.home.com/ and your js is locally sourced. then that JS was injected with an import from http://vuln.evil.com/.
I’m pretty sure your browser would block it based on the fact that the document domain is using HTTPS and HSTS would block it based on not using HTTPS.
I think. never really tried this out tbh.
Wait what does embedded JS have to do with it? If it’s HTTPS the JS will still run and still be able to do whatever it did before AFAIK.
Adding to this, the only time I dont use HTTPS/TLS is when I am accessing localhost, prior to moving a service to a subdomain to give it HTTPS/TLS…
Even though it’s not strictly required if you’re only using your services over your local network or a VPN, your browser won’t know that’s what you’re doing. The security warnings got so incredibly annoying for me that I switched to using https on everything.
There are also some specific web features that only work over https (including some optional upgrades needed for Nextcloud iirc)
Always use HTTPS. Especially if you’re using your services on mobile.
Imagine you’re on your friend’s WiFi, and you disconnect from your net bird/tailscale/wireguard connection to your self hosted network… Any and all mobile apps that require that secure connection, is going to attempt requests to your internal services and sending auth/session token details along the requests.
A bad actor on your friend’s WiFi network, could, in theory, capture these requests and now you’re at the mercy of how well those services are written.
This all may sound a bit paranoid, but it is what we are trying to mitigate here.
I’m not sure I understand this. If I’m on my phone and connect using wire guard or teleport and I’m connected to a public wifi, I don’t understand the risks. Can you explain them? Thanks, I genuinely don’t understand. I thought encrypted tunnels were safe?
Sometimes your connection might not work correctly, and you’re not connected to your secure network. Like how VPNs will have kill switches (prevents you from accessing the Internet if the connection to the VPN isn’t successful) to prevent leaks during those spotty connections. Without HTTPS, during those spotty connection times, you’re sending your auth/session details plain-text on an unsafe network.
If nothing’s exposed and it’s all behind Netbird, you don’t strictly need it. I still would, because apps like Vaultwarden’s web vault won’t load without a secure context. A wildcard cert via DNS challenge is a one-time setup. Everything else is optional.
If you’re not using https, then anyone who can see the traffic in your VPN can see everything you do.
Whether that’s a problem depends. In principle, as long as access to your VPN is restricted to people you trust, then http inside it is fine. In practice, if your security isn’t perfect, and someone gets access to your VPN, then https provides a meaningful second line of defense.
My recommendation would be to never use http for anything where a breach would be really painful. It’s good that vaultwarden is on https. Beyond that, https is absolutely the best practice, but if someone getting access to your service is only a mild inconvenience, then leaving it on http is fine as long as it’s only accessible inside your VPN - the risk is relatively low, and the consequences aren’t bad.
What about Tailscale, can they see http traffic over my Tailscale connection?
Tailscale is a sort of VPN. So, yeah, treat it the same.
I’m mostly responding to add a little context to the security concerns. Probably the biggest inside-the-VPN concern is that someone on your VPN gets some malware. So, if this is your family network, and say, your kid’s phone or laptop gets some malware, now any non-encrypted traffic is potentially compromised. Basically, the VPN is only as secure as the weakest link. That’s the thing you’re protecting against with https for individual services.
If I were hosting vaultwarden, and had my bank login in there, I absolutely wouldn’t consider a VPN + http sufficient protection. With LLMs, if we don’t have malware that knows how to hunt around for valuable credentials in the wild already, it’ll be here soon. I personally run my Jellyfin server over https because I’ve gone to the trouble to set up a good system to use letsencrypt with nginx as a proxy for any service. But I wouldn’t be too worried about running Jellyfin over http.
deleted by creator
For me, everything exposed to the internet is https (that is http + Apache reverse proxy using Let’s Encrypt), and everything that is not (and I access via my tailnet) is http.
Back when I joined Lemmy (and before I understood what .ml was), I tried to contribute to the project. I suggested updating a link (possibly to docs) that was using an HTTP connection. The goal at the time was to make Lemmy approachable for normal users. As a user, I have non-secure sites blocked in my browser, so I have to manually proceed… and seeing that warning makes me not want to use a site. The devs told me that the link didn’t matter because the site was static. That was the end of my being willing to contribute, and my monetary support for the project ended as soon as I understood the dev’s beliefs and personalities.
