Comment by KronisLV | Hacker News Reader

Comment by KronisLV | Hacker News Reader

Parent Full thread

> Not _exactly_ as easy, you also need a valid https cert, and set up a cronjob to renew it.

Web servers like Caddy automate this for you: you just indicate that you want HTTPS for a particular site and the rest is taken care of for you (in the case of public sites and HTTP-01 challenges, at least). Link: https://caddyserver.com/docs/quick-starts/https

Even Apache2 has mod_md which does pretty much the same thing (sans DNS-01 provider integrations, at least out of the box), so it's going to be good enough for most cases and similarly easy to Caddy. Link: https://httpd.apache.org/docs/2.4/mod/mod_md.html#mdomain

Nginx integrates well with certbot, which does take a bit more work and configuration, but even that is passable: https://certbot.eff.org/

Things can get a bit tricky when you want to run your own CA or ensure mTLS, but in most cases neither will be necessary.

As for whether you even need HTTPS in the first place, I'd say that it won't hurt in most cases and will guard against MitM, the ISP included.

Can't do http challenges because my ISP blocks port 80 inbound.

You configure Caddy to disable certain challenge types[0], which in this is the HTTP challenge, like so:

    example.com {
     tls {
      issuer acme {
       disable_http_challenge
      }
     }
     file_server
    }

[0] https://caddyserver.com/docs/caddyfile/directives/tls#acme

> Can't do http challenges because my ISP blocks port 80 inbound.

My ISP also put me behind CGNAT, which effectively meant that all of the inbound traffic got dropped. I worked around that by getting the cheapest VPSes that I could find and then setting up WireGuard and simply forwarding the traffic to my homelab servers. So I got all of the compute that I have available locally, all of the RAM and all of the cheap HDD storage, but a static IP address.

I actually wrote about the process a few years ago: https://blog.kronis.dev/tutorials/how-to-publicly-access-you...

(note that you probably would only want to forward 80 and 443 ports in most cases, not everything; outside of testing boxes)

Personally, I opted for Time4VPS in the end, which I use for the rest of my hosting as well: https://www.time4vps.com/linux-vps/?affid=5294#annually (affiliate link, they do have good discounts at the moment for yearly billing, though)

Then again, something like Scaleway Stardust instances could also be a really good fit, when they are available: https://www.scaleway.com/en/stardust-instances/

For those not chasing after the savings of a few Euros, Hetzner is also going to be more than enough: https://www.hetzner.com/cloud (or DigitalOcean, or Vultr, or any other VPS provider out there)

I don't need port 80 now that DNS challenges are easily automated. Port 443 is open, so that's fine.

Also, if I have a VPS, why not just serve from the VPS?

Reply on news.ycombinator.com