search

getumbrel / umbrel

A beautiful home server OS for self-hosting with an app store. Buy a pre-built Umbrel Home with umbrelOS, or install on a Raspberry Pi or any x86 system.
https://umbrel.com
Other
7.31k stars 527 forks source link

Add LetsEncrypt to Nginx #686

Open DownRangeDevOps opened 3 years ago

DownRangeDevOps commented 3 years ago

To support HTTPS the Nginx container should use LetsEncrypt to provision SSL CRT and keep them updated. I'm happy to look into implementing this unless there is a flaw in the idea or someone else has a better plan. Let me know of any concerns or issues regarding using LetsEncrypt for SSL.

Thanks, great work so far!

louneskmt commented 3 years ago

Hey! See previous discussion on this topic: #190.

DownRangeDevOps commented 3 years ago

Yeah, I understand that using SSL on the local network doesn't make sense. I'm talking about letting the user configure a custom domain name routed to the node via HTTPS and using LetsEncrypt to sign the CRT. I'm guessing you could also use this to make the Tor endpoint run over HTTPS as well, although I know little about Tor.

louneskmt commented 3 years ago

There is not need to use HTTPS over Tor, as Tor already protects the connections.

What I would suggest you is to close your clearnet ports and use only Tor to access your Umbrel.

DownRangeDevOps commented 3 years ago

Yeah, already have done that. Still think it would be nice to assign a custom domain to the node. Happy to contribute elsewhere though, anything docker, infra, automation related. Those are my specialties.

louneskmt commented 3 years ago

What did you use to close your ports (if you're running on a VPS)?

And thanks!

junderw commented 3 years ago

I already have a reverse proxy on my home server lab and I point a subdomain to the mempool instance running on umbrel.

I make it a point not to allow access from outside to any services that have access to money.

For that, I VPN to my home server lab, and access from there.

junderw commented 3 years ago

aka.

perhaps a vpn server would be better... might need to package some ddns or something

cryptic-node commented 1 year ago

Umbrel supports and runs Tailscale. It is easy to point a domain at the Tailscale IP for the umbrel. The issue comes when you try to run "certbot --nginx -v" or "certbot certonly --standalone -v" with Umbrel stopped. Can anyone help with adding the right nginx.conf lines or whatever seems to be hanging this up? I keep getting IP6/AAAA record error but I have correct IP6 dns and I don't even use IP6.

ztnewman commented 1 year ago

Yeah, I understand that using SSL on the local network doesn't make sense.

This is absolutely false. The lack of HTTPS support going to prevent adoption in the long-run.

aantonop commented 1 year ago

HTTP is being deprecated in every browser and HTTPS is increasingly a requirement in many web apps.

The lack of SSL support also makes it impossible to run Nextcloud correctly, as it disables a bunch of features such as WebAuthn Two Factor and end-to-end encryption. These features in Nextcloud and probably other features in Nextcloud and perhaps other umbrel apps won't run if running over HTTP.

The only alternative I can think of is using a Tor local proxy, and configuring native clients (like Nextcloud) to run over the proxy. However, they will still detect that the connection is not HTTPS and will refuse to enable certain functions.

Refusing to work over HTTP is bad behavior of these apps, because they assume their users are not smart enough to be running over a VPN or Tor. But this assumption is actually the correct assumption from a security point-of-view. Users are rarely technical enough to configure a VPN or a Tor proxy.

In summary, I would argue that even though HTTPS on a .local domain doesn't make sense, it should still be offered at least as an optional app, so that other apps that demand HTTPS can be mollified.

lorenzyannick commented 11 months ago

why not implement Traefik in umbrel ?

See : https://github.com/getumbrel/umbrel/issues/546#issuecomment-1817962616