Hey everyone,
I’m one of the people who still used proton and am now in the process of switching everything and trying to selfhost more.
I sucessfully setup Vaultwarden. I also decided I should move away from having my dockers publicly exposed with nginx reverse proxy and switched everything over to netbird. Im using their proxy feature now to access everything with custom domains and followed a tutorial to setup a bring your own proxy server on a vps. So now all my services are only accessible when my netbird vpn is active. I also spun up a pihole docker and added that to my netbird dns servers to try and get ad blocking on my mobile devices. So far so good.
I wonder however that while some webui’s like vaultwarden run with https, others like radarr dont. Is this a problem or does it not matter so much since i have the vpn running?
I dont really understand how I would go about making them https though. Im on unraid for my dockers and don’t see why some use https and others don’t.
Sorry if this is a convoluted post, I’m quite in over my head with all the networking and dns stuff and just hoping I’m not doing something stupid.
Thanks for your help!
wow, I didnt expect so many replies, thank you guys so much! Really Cool to see the fediverse this alive. Ill definitely dive in to all your suggestion and try to get ssl running on all services just to be safe. I think I had this figured out back when I used npm but now that i use the netbird proxy service to link to the services directly, Im not sure how a proxy like npm or caddy or traefik would fit into the equation. But I’m sure ill find something with some trial and error
Most (if not all) reverse proxies will allow you to add a certificate for your sites locally. I run everything over wireguard when I’m outside my network, and have NGINX Proxy Manager for all my routing and certificate needs. Works flawlessly so far.
A reverse proxy like Caddy can get a ssl cert via dns challenge and add ssl to all your internal self hosted services, provided you have a domain hosted somewhere supported.
With everything behind tailscale, and hence no need for opening the firewall, my DNS challenge failed when I tried to set it up last time using certbot.
A dns challenge requires no inbound connections. You misconfigured something.
So, HTTPS prevents people on the network from hijacking the connection or spying on what you do with the website or your passwords. If you have a VPN and no evil devices inside your network you are likely fine, and many things don’t need HTTPS-level of safety.
That said, browsers make using HTTP almost unusable nowadays, because over the internet you really want your connection to not be hyjacked, and almost nobody self-hosts (sadly).
I would reccommend to set up a reverse proxy to do https for all services you host, even if you only use it via lan/vpn. Adding a new service then becomes just hosting it over HTTP, and have your reverse proxy converting the connection to HTTPS.
If you have a domain, you can request a wildcard cert from let’s encrypt and use that also for internal domains (they don’t need to be reachable from the public internet, but you might need to expose the ACME challenge file).
If you want to learn a lot about certificates you can go the self-signed route, but you’ll have to install the certificate on every device you use to access your services (guests will get huge warnings when trying to access your pages, if you give them access to them). Once set up it’s more flexible though, and if you configure your dns server you can have whatever domain you want, even nonexistent or unavailable ones.
If nothing’s exposed and it’s all behind Netbird, you don’t strictly need it. I still would, because apps like Vaultwarden’s web vault won’t load without a secure context. A wildcard cert via DNS challenge is a one-time setup. Everything else is optional.
Https with X.509 is full of holes.
You should be using client side encryption using a pinned certificate.
If nothing else, use Tor Onion Services.
Bro what? The exit nodes see all traffic unencrypted in Tor
Nope. Onion Service’s traffic is end to end encrypted.
And it’s a pinned key that cannot be mistaken, because the .onion address is a derivative of the hash of the Key’s fingerprint.
Interesting. TIL!
I was definitely under the impression that exit nodes were able to see all traffic unencrypted, but maybe that was from an earlier version of Tor. Now I’ve RTFM and by god you’re right!
Yes, because an attacker already in your network will be able to decrypt non SSL traffic.
I even have my unRAID endpoints using https. You can do self signed, or you can use something like let’s encrypt to do it for you. I use wildcard certs as any signed certs with the full subdomain can expose what services I host internally (since signed certificate provisioning is, by design, a public process).
if you’re accessing over the internet, always use TLS/HTTPS.
if you’re accessing over LAN, you should still use TLS/HTTPS.
just because you’re hosting the app locally doesn’t mean the JS embedded in the page is safe. HTTPS will ensure that all your traffic is encrypted so only you and the server knows what it contains.
Wait what does embedded JS have to do with it? If it’s HTTPS the JS will still run and still be able to do whatever it did before AFAIK.
if the JS on the page is unsafe then HTTPS wouldn’t help right? The JS could scrape all the info client-side and extradite it.
AFAIK the reason why you’d use HTTPS on your LAN is if you’re afraid of middleman attacks in your LAN, like a malicious device that pretends to be the internet router.
Adding to this, the only time I dont use HTTPS/TLS is when I am accessing localhost, prior to moving a service to a subdomain to give it HTTPS/TLS…
Yes, always use HTTPS, even on local networks if there ever are more than one device on the network.
The way to handle services with/without HTTPS is to put everything behind a reverse proxy that automatically handles certificates. Since you’re using NGINX, you can try setup certbot, or switch to something like Caddy that has certificate handling built in. If you have all your Docker containers on one server, you can look at Traefik.
Question: I have a remote VPS running Caddy, which sends requests through a WireGuard tunnel to my OPNsense router, which then forwards them on to my VMs running Nextcloud and Jellyfin. Is it possible to use the same certificate locally? Whenever I access the services locally, I have to use http because apparently generating a self-signed certificate locally conflicted with the Caddy-generated certbot certificate.
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:
Fewer Letters More Letters CA (SSL) Certificate Authority DNS Domain Name Service/System SSO Single Sign-On VPN Virtual Private Network nginx Popular HTTP server
5 acronyms in this thread; the most compressed thread commented on today has 10 acronyms.
[Thread #162 for this comm, first seen 8th Nov 2026, 18:10] [FAQ] [Full list] [Contact] [Source code]
Always use HTTPS. Especially if you’re using your services on mobile.
Imagine you’re on your friend’s WiFi, and you disconnect from your net bird/tailscale/wireguard connection to your self hosted network… Any and all mobile apps that require that secure connection, is going to be making calls to your internal services and trying to pass auth/session token details to them.
A bad actor on your friend’s WiFi network, could, in theory, capture these requests and now you’re at the mercy of how well those services are written.
It’s a bit paranoid, but this is what we are trying to mitigate here.
I’m not sure I understand this. If I’m on my phone and connect using wire guard or teleport and I’m connected to a public wifi, I don’t understand the risks. Can you explain them? Thanks, I genuinely don’t understand. I thought encrypted tunnels were safe?
Sometimes your connection might not work correctly, and you’re not connected to your secure network. Like how VPNs will have kill switches (prevents you from accessing the Internet if the connection to the VPN isn’t successful) to prevent leaks during those spotty connections. Without HTTPS, during those spotty connection times, you’re sending your auth/session details plain-text on an unsafe network.
It’s not even that hard to imagine, this is exactly what rogue wifi access points do. It’s surprisingly common for wifi access at places like coffee shops to be compromised and used to silently conduct these types of attacks. The people that set them up are not very knowledgeable and also they don’t ever check up on them as long as they keep working.
This is also why you want to enable HSTS on top of your HTTPS, so that rogue requests to downgrade the connection to plain HTTP are ignored.
Another good idea is to place all the services that should only be accessed over VPN only in private DNS (home LAN DNS and the VPN’s DNS), never in public DNS. A simple and effective way of doing that is to place them on a deep subdomain like
*.private.example.comrather than*.example.com. That way if your VPN drops when you try to resolve those subdomains you don’t get any response anymore and there’s no connection for the rogue wifi to hijack.Yep! Definitely don’t add any of your internally used domains used on public DNS services. Be careful requesting SSL certs for the child subdomains too. They will show up on transparency logs like on shodan.io. Use internal DNS, and wild card certs for these things. And obviously, do not expose your ports publically.
Yes especially since https is to setup and maintain.
Yes you do.
First of all, there are services that will refuse to work properly on http only. Specially if you want an SSO like authelia, will not work over http
Second, modern browsers will complain when using plain http if the website has forms to fill or passwords to write … very annoying, but it’s the way it is.
Third, having the “this site is not secure” broken lock is not very nice for users. At best they might complain, at worse they will get used to “unsecured” websites and .ight end up easier prey for fake sites in the future. Yes I mean wife or kids. These are things normal users should not see as normal…
Last, if you expose anything to the web, please never ever do that without proper https with certificates from let’s encrypt.
HTTPS for everything means you have to buy into the cartel of “identity providers” that manage DNS and certificates, even if there are some mostly-good actors in there such as Let’s Encrypt, you still have the external dependency. As we have seen with cases such as Austistici, having that dependency can be a problem. It’s your call if it is in your case or not, but I wanted to raise this point because no one has pointed out that particular weakness vector so far in the thread.
In a very general sense, if your services are under a netbird or any sort of VPN where you control who gets account access or not, you “should not need” HTTPS. Might still be convenient to have.
There’s no cartel, you can buy a HTTPS cert from lots of places all over the world. Most domain registrars can set you up. It just won’t be free like Let’s Encrypt and also will have a very different renewal process (most likely once a year manually rather than every 90 days automatically).
It’s a cartel in the sense that the CA/Browser forum determines, on their own whim, which CA gets featured or revoked in your browser. And single-handedly impose technical restrictions like shorter cert lifetimes and less features. Stuff like eMudhra being able to compromise everyone shows its quite a vulnerable group of single-point failures as well, but still condoned by almost everyone.
ZeroSSL and Komodo does have free certs if I remember correctly. They’re still bound by the 90 days (soon to be 47) limit though
All you need is a DNS name. You can buy one for a few dollars.
Even if you refuse to buy a domain you could always run your own certificate chain
That sounds interesting. But then you have to convince your peers to install your certificate root, right?
I use tailscale serve for my selfhosted stuff. (Safari on my phone won’t let me open http sometimes)
Safari
Get a better browser? HTTP is as legit a transmission protocol as HTTPS and email are.
All mobile browsers are safari wrappers on iphone
Hmmm, I’d… say… “get a better phone”, but there’s not much of a better alternative there.
Get a desktop / laptop computer?
Are you joking? I use my phone to access frontends I host on my pc lol, why would I use my phone if im at my pc
Well you could technically also use self signed certificates. But it requires a bit more work as well as installing your own custom CA cert.
Self signed isn’t quite the same as a internal CA
For me, everything exposed to the internet is https (that is http + Apache reverse proxy using Let’s Encrypt), and everything that is not (and I access via my tailnet) is http.
