For instance how can I use my *.domain.com SSL certs and NPM to route containers to a subdomain without exposing them? The main domain is exposed.
You need a DNS service that works with Let’s encrypt
I don’t get it. Npm is a package manager. It doesn’t handle certificates.
You need a DNS service like route 53 (AWS) or similar where let’s encrypt connects via an API and creates the DNS token.
OP isn’t referring to the package manager. They’re talking about Nginx Proxy Manager
I do exactly this with traefik.
I followed this guide: https://youtu.be/liV3c9m_OX8
I recommend this one instead: https://youtu.be/n1vOfdz5Nm8
Same guy, just fresh version of Traefik 😁
I have that setup, my domain is hosted by OVh and they have an API that you can use to get a wildcard certificate with.
At home I run pihole and that has some sites in as local IPs, but if you look the same site up from OVH you would get an internet IP
Split DNS on your LAN?
Only records permitted to be access on your LAN are responded by a local DNS server. While public DNS still available for your public facing services.
Your wildcard cert will work for both situations as the browser only cares the sni matches the Url in your address bar.
I’m using this right now but I’m switching to having all my services under one domain and blocking non internal ips. Technically someone can access your site by providing the host manually, althought it’s unlikely since they would need to know it
How we’ve done it recently:
- Put domain on cloudflare or another registrar that supports an API. Generate a token with the right privs.
- Use certbot with the cloudflare plugin, and that token, and generate whatever certs you need within that domain using the DNS01 method.
No need to have port 80 open to the world, no need for a reverse proxy, no need for NAT rules to point it to the right machine, no need to even have DNS set up for the hostname. All of that BS is removed.
The token proves your authentication and LetsEncrypt will generate the certs.
