Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lcl.host: fast, easy HTTPS in your local dev environment

anchor.dev

Post reply on HN
Print view View original

11–20 of 101 posts

Re: Lcl.host: fast, easy HTTPS in your local dev environment

#11

Post by mholt »

I want to point out that Anchor.dev sponsors the Caddy project and we're very grateful for that! Anchor devs have also made code contributions to Caddy and CertMagic.

Anchor has a neat product. They're making internal TLS more accessible to more developers who don't necessarily need a separate web server. They're doing local TLS just about as best as possible from what I can see.

IMO this has more utility than mkcert -- which is a great tool by Filippo and Caddy shares some of its underlying library for its own auto-trusted internal CA -- because, like Caddy, Anchor fully automates the certificates instead of just generating them and needing a cron job. It's more hands-off and higher-level, allowing you to get more done with less effort.

Re: Lcl.host: fast, easy HTTPS in your local dev environment

#12

Post by zikduruqe »

dspillett wrote: post #10
zikduruqe wrote: post #5

Earlier quoted context omitted.

You don't even need to mess with a wildcard from Lets Encrypt, just use https://github.com/FiloSottile/mkcert

I've always been a bit wary of a local trusted CA, especially with the signing cert on the same dev box as the certificates it signs which is how I've seen things done a lot. It feels like opening up a trust issue that could allow an uncooperative entity to play games with me… Maybe that is just paranoia from the practical jokes played back in CompSci at Uni! Admittedly an external attacker getting close enough to si…

[flagged]

Re: Lcl.host: fast, easy HTTPS in your local dev environment

#13

Post by JimDabell »

Warning: This checks if it’s running the latest version and refuses to run if it isn’t up to date. They just released v0.0.16 15 minutes ago and the update hasn’t hit Homebrew yet, so it has completely disabled itself and won’t run. There doesn’t seem to be any option to skip the version check.

So don’t use this unless you don’t mind it breaking randomly whenever there’s an update.

Re: Lcl.host: fast, easy HTTPS in your local dev environment

#14

Post by mholt »

its_stolt wrote: post #9
its_stolt wrote: post #7

Earlier quoted context omitted.

localhost gives you a different security context in your browser than using a full domain name. Typically to use a full domain name locally you'd either need to mess with /etc/hosts (which can bite you later) or mess with DNS. lcl.host just makes things work out of the box.

Let me add a bit of clarification here, since you specifically asked about https://localhost Using http with localhost is a mostly security context, but it has some quirks[0]. Using https://localhost will give you the full security context but then you're typically stuck either dealing with certs manually or using a proxy, like caddy. lcl.host should simplify your setup. We're big fans of caddy by the way and even sp…

Thanks! That reminds me we need to get your logo on our new homepage. I'll shoot you an email.

Re: Lcl.host: fast, easy HTTPS in your local dev environment

#15

Post by mholt »

peter_l_downs wrote: post #2

I like the interactive setup. I think this is solid but if you want something even faster and easier to use, try my project localias [0]. The parent project, lcl.host, has some annoying restrictions: > This CA has some restrictions though: it can only issue certificates for subdomains of lcl.host and localhost, but that’s all you need for local development. Localias, on the other hand, lets you use any custom domain…

Neat! I hadn't seen this before, and it uses Caddy :D

Re: Lcl.host: fast, easy HTTPS in your local dev environment

#16

Post by robertclaus »

In my experience a lot of developers ignore the concept of dev/prod parity like this because a different team (ex. Deployment) ends up dealing with the integration issues it causes. That being said, its also traditionally a balance between effort and output - so I can see a "make it easier" tool like this helping lower the barrier to actually get devs to use it.

Re: Lcl.host: fast, easy HTTPS in your local dev environment

#17

Post by mholt »

JimDabell wrote: post #13

Warning: This checks if it’s running the latest version and refuses to run if it isn’t up to date. They just released v0.0.16 15 minutes ago and the update hasn’t hit Homebrew yet, so it has completely disabled itself and won’t run. There doesn’t seem to be any option to skip the version check. So don’t use this unless you don’t mind it breaking randomly whenever there’s an update.

When I first announced Caddy, our website downloaded everything as .gz due to high traffic load -- a lesson I learned very quickly and a mistake I never made again.

This probably falls in the same boat. :)

Re: Lcl.host: fast, easy HTTPS in your local dev environment

#19

Post by jollyllama »

JimDabell wrote: post #13

Warning: This checks if it’s running the latest version and refuses to run if it isn’t up to date. They just released v0.0.16 15 minutes ago and the update hasn’t hit Homebrew yet, so it has completely disabled itself and won’t run. There doesn’t seem to be any option to skip the version check. So don’t use this unless you don’t mind it breaking randomly whenever there’s an update.

Gross. Thanks for the heads up!

Re: Lcl.host: fast, easy HTTPS in your local dev environment

#20

Post by emi2k01 »

mholt wrote: post #17
JimDabell wrote: post #13

Warning: This checks if it’s running the latest version and refuses to run if it isn’t up to date. They just released v0.0.16 15 minutes ago and the update hasn’t hit Homebrew yet, so it has completely disabled itself and won’t run. There doesn’t seem to be any option to skip the version check. So don’t use this unless you don’t mind it breaking randomly whenever there’s an update.

When I first announced Caddy, our website downloaded everything as .gz due to high traffic load -- a lesson I learned very quickly and a mistake I never made again. This probably falls in the same boat. :)

Sorry, maybe it's too early in the day but I don't get what the lesson was. Could you explain?
Post reply on HN