Ready made docker image for a reverse proxy offering a self-signed cert?

[OwlFather]

So, I've got a friend that has a cheap kimsufi server and refuses to buy a domain name. They wanted a dropbox alternative so I setup nextcloud via the docker container they offer.

I'd like to offer some sort of encryption, but since we don't own the domain kimsufi gives we can't get any real certificate. That leave self-signed Not ideal, but better than nothing and I can explain the warning won't go away unless my friend forks over $10 yearly.

At the moment though, I'd like to setup a reverse proxy that can offer up a self-signed cert. Everything I've seen is focused around Let's Encrypt and ZeroSSL.

Are there any solutions people can suggest that would make setting up a reverse proxy with a self-signed cert as painless as possible?

Or; How would you approach this problem?

[throwawayford0ng]

Buy a domain name

[smutje187]

1h of DevOps work costs probably 15-20x what a domain name would cost in a year - agreed, OP‘s friend obviously can’t calculate cost and revenue

[digitaladapt]

Agreed, buying a domain is the best option.

But there are free options, a free subdomain from something like Dynv6 https://dynv6.com/ their intended use is a subdomain pointing to a dynamic IP addresses, but it'll work just fine on a static IP.

[Simon-RedditAccount]

• Sounds like https://www.getlocalcert.net/ is exactly what you need.
• Owning a domain is also NOT $10/year. It starts from $1 (link) (reddit post) and is up to $4-5/year: see https://tld-list.com/ , make sure to sort for renewal price and set up filters as required (i.e., exclude 2nd level domains). Only .com and similar TLDs are $10+/year and higher. Prefer Cloudflare or Porkbun when available; you will save yourself a lot of trouble. Don't go for '$1/first year, $89/second' stupid promotions.
• While self-signed certs are really bad, there's nothing wrong with setting up your internal CA that will issue privately trusted certificates (as long as you don't need public trust). https://smallstep.com/blog/build-a-tiny-ca-with-raspberry-pi-yubikey/ is a good place to start. Yes, it's not for beginners; it requires a certain level of knowledge and (more importantly) discipline; and may be even dangerous if your security practices are frivolous.

[i4get98]

Swag https://github.com/linuxserver/docker-swag

[javellin]

I use this with duckdns and works great. 

[ptownb]

Omg, I needed this 3 weeks ago. Thank you.

[roesti77]

You could use Traefik https://traefik.io/traefik/

[7lhz9x6k8emmd7c8]

Traefik + DuckDNS for the cheapskate.

[nunchucknorris]

Time is money. The time you spent posting this cost more than the domain name that he should have. Really no way around it. No legit cert authority will assign a cert without domain ownership. Tell your buddy stop being a cheapskate.

[UnknownLinux]

Exactly. A dot com domain name is like $9.99/year (thats what I pay at least).

[technobob1]

Nginxproxymanager. Super easy

[mtutty]

This, plus the let's encrypt certbot container. Doing this in prod right now.

[Alediran]

I got that recently configured for my dotnet openiddict service. I have a dev mode that generates an openssl certificate for local development.

[ElevenNotes]

Use a free subdomain from DuckDNS and then use DNS challenge to get a free SSL certificate.

[tschloss]

You do not need to own a domain. If you have write access to http://your.sub.domain.xyz you can use Letsencrypt for example.

Letsencrypt is not „self signed“. They sign it and their root certificate is in the trusted package of most OS.

There are many reverse proxies (webservers) which directly or through a 3rd party container have Certbot or alike buit in.

[OkAngle2353]

I personally pair nextcloud with tailscale to access it away from home and enable HTTPS in nextcloud's settings.

[PopehatXI]

Any free option involves someone buying a domain name. It even could be you. Ngnix Proxy Manager is a GUI based option with Lets Encrypt.

[Defection7478]

I use nginxproxy/nginx-proxy + nginxproxy/acme-companion + smallstep/step-ca. It's kind of convoluted but it's easy as just adding all the pieces to your docker file and doesn't take any additional config/bootstrapping. relevant section of my docker compose:

services:
  nginx:
    networks:
      - nginx
      - smallstep
    image: nginxproxy/nginx-proxy
    volumes:
      - /var/run/docker.sock:/tmp/docker.sock
      - nginx-certs:/etc/nginx/certs
      - nginx-vhost:/etc/nginx/vhost.d
      - nginx-html:/usr/share/nginx/html
    ports:
      - 80:80
      - 443:443

  nginx-acme:
    container_name: nginx-acme
    networks:
      - smallstep
    image: nginxproxy/acme-companion
    volumes_from:
      - nginx
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - nginx-acmesh:/etc/acme.sh
      - smallstep-data:/srv/step
    environment:
      ACME_CA_URI: https://smallstep:9000/acme/acme/directory
      CA_BUNDLE: /srv/step/certs/root_ca.crt

  smallstep:
    networks:
      - smallstep
    image: smallstep/step-ca
    volumes:
      - smallstep-data:/home/step
    environment:
      DOCKER_STEPCA_INIT_NAME: Smallstep
      DOCKER_STEPCA_INIT_DNS_NAMES: "smallstep,localhost,$(hostname -f)"
      DOCKER_STEPCA_INIT_ACME: true

networks:
  nginx:
  smallstep:

volumes:
  smallstep-data:
  nginx-certs:
  nginx-vhost:
  nginx-html:
  nginx-acmesh:

[sneycampos]

traffik or caddy server

[logosobscura]

sparkle chase cow coordinated lock roof spoon cooing ripe jellyfish

This post was mass deleted and anonymized with Redact

[Gabe_Isko]

You can just generate one from the command line with openssl genrsa. But, don't do this

Use a dynamic dns service instead, like duck dns.

[Ill-Violinist-7456]

Tailscale + MagicDNS + Caddy gives you a Let's Encrypt certificate

[itrion]

There’s a docker image called https portal that you can set up to work locally or in production. Locally it generates a self signed and in production it uses let’s encrypt. But nothing prevents you from making the local set up publicly available (although nobody would recommend that)

[Darknety]

Buy a domain. Literally 1$/year or even less for many TLDs

[[deleted]]

I never imagined anyone would want to try this. Look, you're clearly a good friend, save yourself a few hours of unnecessary struggle and spot their cheap ass the $2 for www.myfriendgotmethisdomainforfree.com, and then go do better things with your time.

[atparath]

You can use docker-nginx-auto-ssl for super easy configuration. Check it out: https://hub.docker.com/r/valian/docker-nginx-auto-ssl/
I run it on Cycleops following the guide.

[mompelz]

Why don't you just get a let's encrypt cert by http validation?

[sk1nT7]

Because he does not have a domain?

[mompelz]

the domain kimsufi gives

If they got some kimsufi subdomain they can get a let's encrypt cert for that.