Hey everyone,

I’m one of the people who still used proton and am now in the process of switching everything and trying to selfhost more.

I sucessfully setup Vaultwarden. I also decided I should move away from having my dockers publicly exposed with nginx reverse proxy and switched everything over to netbird. Im using their proxy feature now to access everything with custom domains and followed a tutorial to setup a bring your own proxy server on a vps. So now all my services are only accessible when my netbird vpn is active. I also spun up a pihole docker and added that to my netbird dns servers to try and get ad blocking on my mobile devices. So far so good.

I wonder however that while some webui’s like vaultwarden run with https, others like radarr dont. Is this a problem or does it not matter so much since i have the vpn running?

I dont really understand how I would go about making them https though. Im on unraid for my dockers and don’t see why some use https and others don’t.

Sorry if this is a convoluted post, I’m quite in over my head with all the networking and dns stuff and just hoping I’m not doing something stupid.

Thanks for your help!

  • Supercrunchy@programming.devEnglish
    3·
    9 hours ago

    So, HTTPS prevents people on the network from hijacking the connection or spying on what you do with the website or your passwords. If you have a VPN and no evil devices inside your network you are likely fine, and many things don’t need HTTPS-level of safety.

    That said, browsers make using HTTP almost unusable nowadays, because over the internet you really want your connection to not be hyjacked, and almost nobody self-hosts (sadly).

    I would reccommend to set up a reverse proxy to do https for all services you host, even if you only use it via lan/vpn. Adding a new service then becomes just hosting it over HTTP, and have your reverse proxy converting the connection to HTTPS.

    If you have a domain, you can request a wildcard cert from let’s encrypt and use that also for internal domains (they don’t need to be reachable from the public internet, but you might need to expose the ACME challenge file).

    If you want to learn a lot about certificates you can go the self-signed route, but you’ll have to install the certificate on every device you use to access your services (guests will get huge warnings when trying to access your pages, if you give them access to them). Once set up it’s more flexible though, and if you configure your dns server you can have whatever domain you want, even nonexistent or unavailable ones.