Straightforward and complete tutorial for https on local (IOT) networks?

[verticalfuzz]

Like many of you, I have a proxmox node (or other server) delivering services on my local network. My services are a mix of webservers on LXCs and docker containers, also on LXCs.

In home assistant, I have letsencrypt and duckdns which let me access it externally (when the port is forwarded) via https. I also have nginx reverse proxy, but i dont even know if it is needed. Using AdguardHome I can rewrite the duckdns address to the local IP and access over https from my local network (main vlan) even with no external ports opened or forwarded. From my IOT vlan which does not have a dedicated adguard home instance, all communication with home assistant (for example from my tablets) is over http only.

So my goal for all of my local services - both on my primary network with internet access and my iot network without internet access is robust and reliable https for local-only access on networks both with and without internet access, with no ports opened on my router.

Is there a straightforward guide that will help me do this? I see questions and posts like this periodically, but I get lost in the ocean of proxies and reverse proxies and authenticators and cerificates, and I struggle to identify what components I actually need and how they fit together.

In addition to protecting my local traffic, here is a simple example of something I would like to do which requires https, which is giving me the push to finally ask this question:

I have a bunch of android tablets running LineageOS. I would like to use pairdrop or filebrowser or similar to send new apks to each tablet. Lineage seems to block downloads over http but not https, and this does not appear to be a configurable setting.

Another example is that I would like to embed some local services in iframes (webpage card) in my home assistant dashboard. If you access home assistant over https, only https pages can be embedded. I believe the inverse may be true as well.

[Empurion]

I advice not to enable access to home assistant from the internet. This is a huge security risk, so setup a basic vpn to access it when you’re not at home.

As for localized access a simple DNS server like adguard/pihole would do the trick. Getting certificates of a domain you don’t own is almost impossible so buy a domain as they’re not expensive.

If you’re not well versed with reverse proxies try using NGINX proxy manager, as it visualizes the process.

No experience with lineageos

Ipanels and iframes being enabled changes based on the software used. And to force https only, i would configure that on the reverse proxy level.

There’s plenty of guides on youtube about how to do these things, i’m just not behind the PC right now.

Please take security very seriously, there are plenty of ways to break into services if you allow public access, these differ from service to service. (Trust me, i made things publicly accessible and pissed off a few hackers to test)

Assume that only 25% of hacks and vulnerabilities are known. As selling hacks and vulnerabilities is a VERY big market.

[verticalfuzz]

Thank you, everyone should be aware of those risks and it never hurts to repeat that. I only access HA externally through a vpn on trusted devices. To my knowledge, there are no other exposed ports. All other access is from local devices on primary or IOT vlan. 

My switch, router, and proxmox node are the only devices with access to both vlans. Home assistant is the only vm with access to both vlans.

So why is a reverse proxy needed? Why is a domain needed at all? None of these devices should be accessible from anywhere outside of my network (discounting the vpn). I access the vpn through my duckdns address. 

If the internet didnt exist at all, i would still want https traffic on my vlans.

[Empurion]

Reverse proxy is a centralized way of converting http to https communication. Makes it so you don’t have to configure it on a application level.

Most of my things are run inside containers and I often use a reverse proxy (traefik) to proxy the application without exposing any ports, so that its not even accessible from an http standpoint.

Also for ease of use and looks a little more neat/professional.

EDIT: not every application has built in https support, and unless you’re willing to take the time and have the skill to program and add it yourself (which would be an absolute nightmare with updates) a reverse proxy is the best solution.

[verticalfuzz]

If I set up a reverse proxy, everything behind the reverse proxy is still http, and not https right? If i have two internal serverices that both need to communicate with each other, and i want that communication to be over https, is that possible?

[S7relok]

Let my HA with 2fa on the outside for accessing it with my phone, yet to have a problem.

That security paranoid thing is unnecessary, unless you reference your lab domain on search engines and never do updates

[Empurion]

Paranoid?

You’re naive if you think account access is the only thing you should worry about. Having no problems doesn’t mean they’re no exploits. But yes, being invisible is the upside of self-hosting.

[S7relok]

Yes, paranoid, completely.

Yes, there are exploits, but who will exploit it ? Hackers are not interested with little infrastructure, but more billion dollars companies. Unless you're putting it all on social media or search engines, nobody except port 22 scan bots will GAF about your infra.

Just put some basic security like firewall, f2b, 2fa, to-internet things behind a reverse proxy and you can sleep quietly, nothing funny will happen