• 0 Posts
  • 17 Comments
Joined 1 year ago
cake
Cake day: July 23rd, 2023

help-circle
  • So when I ask Let’s Encrypt for a cert, I ask for *.int.teuto.icu instead of specifically jellyfin.int.teuto.icu, that way I can use the same cert for any internally running service. Mostly I use SSL on everything to make browsers complain less. There isn’t much security benefit on a local network. I suppose it makes harder to spoof on an external network, but I don’t think that’s a serious threat for a home net. I used to use home.lan for all of my services, but that has the drawback of redirecting to a search by default on most browsers. I have my tailscale exit node running on my router and it just works with SSL like anything else.


  • I use a central nginx container to redirect to all my other services using a wildcard let’s encrypt cert for my internal domain from acme.sh and I access it all externally using a tailscale exit node. The only publicly accessible service that I run is my Lemmy instance. That uses a cloudflare tunnel and is isolated in it’s own vlan.

    TBH I’m still not really happy having any externally accessible service at all. I know enough about security to know that I don’t know enough to secure against much anything. I’ve been thinking about moving the Lemmy instance to a vps so it can be someone else’s problem if something bad leaks out.






  • I have the opposite. Unlimited phone data, but it throttles above some high number that I’ve never hit. Capped home internet from crapcast, 1.3 TB, I haven’t hit it but I’ve come within a couple gigabytes.

    They offer unlimited data if I use their modem/router for an extra $10/mo. Of course their modem comes with the wonderful feature of a public hotspot for any other Comcast customers in the area. I’ve been thinking about getting their modem, putting it in a metal box and just using pass through with my opnsense box.