Hey everyone,

I’m one of the people who still used proton and am now in the process of switching everything and trying to selfhost more.

I sucessfully setup Vaultwarden. I also decided I should move away from having my dockers publicly exposed with nginx reverse proxy and switched everything over to netbird. Im using their proxy feature now to access everything with custom domains and followed a tutorial to setup a bring your own proxy server on a vps. So now all my services are only accessible when my netbird vpn is active. I also spun up a pihole docker and added that to my netbird dns servers to try and get ad blocking on my mobile devices. So far so good.

I wonder however that while some webui’s like vaultwarden run with https, others like radarr dont. Is this a problem or does it not matter so much since i have the vpn running?

I dont really understand how I would go about making them https though. Im on unraid for my dockers and don’t see why some use https and others don’t.

Sorry if this is a convoluted post, I’m quite in over my head with all the networking and dns stuff and just hoping I’m not doing something stupid.

Thanks for your help!

  • GreenKnight23@lemmy.worldEnglish
    27·
    1 day ago

    if you’re accessing over the internet, always use TLS/HTTPS.

    if you’re accessing over LAN, you should still use TLS/HTTPS.

    just because you’re hosting the app locally doesn’t mean the JS embedded in the page is safe. HTTPS will ensure that all your traffic is encrypted so only you and the server knows what it contains.

    • asdfasdfasdf@lemmy.worldEnglish
      2·
      9 hours ago

      Wait what does embedded JS have to do with it? If it’s HTTPS the JS will still run and still be able to do whatever it did before AFAIK.

    • hirihit640@sh.itjust.worksEnglish
      4·
      14 hours ago

      if the JS on the page is unsafe then HTTPS wouldn’t help right? The JS could scrape all the info client-side and extradite it.

      AFAIK the reason why you’d use HTTPS on your LAN is if you’re afraid of middleman attacks in your LAN, like a malicious device that pretends to be the internet router.

      • GreenKnight23@lemmy.worldEnglish
        1·
        8 hours ago

        it would if it’s importing something else.

        let’s say your site is on https://app.home.com/ and your js is locally sourced. then that JS was injected with an import from http://vuln.evil.com/.

        I’m pretty sure your browser would block it based on the fact that the document domain is using HTTPS and HSTS would block it based on not using HTTPS.

        I think. never really tried this out tbh.

    • jsnfwlr@lemmy.mlEnglish
      2·
      19 hours ago

      Adding to this, the only time I dont use HTTPS/TLS is when I am accessing localhost, prior to moving a service to a subdomain to give it HTTPS/TLS…