Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Free DDNS with Cloudflare and a cronjob

github.com

Post reply on HN
Print view View original

121–130 of 202 posts

Re: Free DDNS with Cloudflare and a cronjob

#121

Post by Arrowmaster »

gunapologist99 wrote: post #101
skinner927 wrote: post #88

Earlier quoted context omitted.

You don’t need automated DNS fiddling for lets encrypt. Certbot can either hook into Apache or NGINX, or run its own standalone server for verification.

Aside from sibling comment, you also need automated DNS fiddling if you want CloudFlare Strict TLS support, because if LE can only connect to CF proxy, it will never issue via HTTPS.

Not true. I have a CF rule that matches . well-known/acme-challenge and sets SSL off. The main setting is on full strict but the rule disables the auto redirect to https and the strict checking so an acme client behind a CF tunnel can bootstrap a cert with the HTTP-01 method.

Re: Free DDNS with Cloudflare and a cronjob

#122

Post by 12345hn6789 »

password4321 wrote: post #108
thousand_nights wrote: post #34

Earlier quoted context omitted.

From the discussions I've read, it's not as clear cut, e.g.: https://old.reddit.com/r/PleX/comments/152wfdh/can_i_use_a_c...

Just don't show up on some motivated salesperson's prospects report. https://news.ycombinator.com/item?id=40481808#40482405

FWIW that thread looks to be a casino being black listed after trying to negotiate down cloud flares enterprise plan.

Re: Free DDNS with Cloudflare and a cronjob

#124

Post by TheNewsIsHere »

kuschku wrote: post #92
vladvasiliu wrote: post #80

Earlier quoted context omitted.

Well, one of the "challenges" is the one in a different comment: most registrars don't allow fine-grained control over who can update what DNS records. Can it be done? Sure. But do I want to spend money on this for my home lab if I can work around it? Not a chance. I'm kinda sensitive to the "MITM as a service" argument, but for my use case, it's not a problem.

> Well, one of the "challenges" is the one in a different comment: most registrars don't allow fine-grained control over who can update what DNS records. Afaik, every major registrar allows you to add an NS record for the _acme-challenge subdomain, allowing you to put the _acme-challenge subdomain on a custom, self-hosted DNS server. That in turn allows you to make the permissions as specific as you'd like. Personall…

Using CNAME delegation for the ACME challenge domain and directing that to a Route 53 zone is my preferred approach. Then (as long as you have CloudWatch configured) you get inherent auditing and very flexible privilege management.

Re: Free DDNS with Cloudflare and a cronjob

#125

Post by starttoaster »

2Gkashmiri wrote: post #38
thousand_nights wrote: post #10

Instead of using DDNS, I have been using Cloudflare tunnels to expose my home services to the internet. The setup is much simpler and it seems like it's more secure too You specify a port and point it to a subdomain and it just immediately works, no maintenance necessary. The daemon only needs to be installed once with a simple terminal command

Do you get a cloudflare free subdomain or you need to supply your own ?

You need to have a domain that you manage DNS for in Cloudflare. Look up what a "registrar" is, a common one people go through would be Namecheap. Get a domain, and then look up how to set up a DNS zone in Cloudflare from an external registrar. If you plan on working in tech, this is one of those things you'll absolutely need experience with doing. Good luck!

Though it occurs to me their may just be a language barrier and you may have a domain that you manage your DNS in Cloudflare already. If that's the case, a subdomain is just an A record under your domain's DNS settings for anything other than the root domain. So, if your domain is "example.com", the A record could be like "service" with an IP of "192.168.1.10", and your subdomain would then be served on "service.example.com" for example. Subdomains are free, if you have a domain in the first place.

If you're asking if you would already need the subdomain configured in your DNS settings in Cloudflare, then yes, most likely. Though there are tools that create those for you, like external-dns in kubernetes.

Re: Free DDNS with Cloudflare and a cronjob

#126

Post by DreamFlasher »

noname120 wrote: post #17
thousand_nights wrote: post #10

Instead of using DDNS, I have been using Cloudflare tunnels to expose my home services to the internet. The setup is much simpler and it seems like it's more secure too You specify a port and point it to a subdomain and it just immediately works, no maintenance necessary. The daemon only needs to be installed once with a simple terminal command

There are some limitations such as: – TLS termination mandatorily happens at Cloudflare (i.e. your traffic is mitm'ed). That's because this free product is meant as a gateway drug (aka a loss leader) to Cloudflare's WAF/Anti-DDOS products (which require TLS termination to happen on their side for technical reasons). – Other TCP protocols (including SSH) require every client to run the software too. So if you were thi…

At which point is the MITM happening? What I mean is: browser → Cloudflare server → cloudflared on my server → web service. Is TLS only from browser to Cloudflare server, or is it browser to cloudflared?

Re: Free DDNS with Cloudflare and a cronjob

#128

Post by fishcrackers »

noname120 wrote: post #17
thousand_nights wrote: post #10

Instead of using DDNS, I have been using Cloudflare tunnels to expose my home services to the internet. The setup is much simpler and it seems like it's more secure too You specify a port and point it to a subdomain and it just immediately works, no maintenance necessary. The daemon only needs to be installed once with a simple terminal command

There are some limitations such as: – TLS termination mandatorily happens at Cloudflare (i.e. your traffic is mitm'ed). That's because this free product is meant as a gateway drug (aka a loss leader) to Cloudflare's WAF/Anti-DDOS products (which require TLS termination to happen on their side for technical reasons). – Other TCP protocols (including SSH) require every client to run the software too. So if you were thi…

[dead]

Re: Free DDNS with Cloudflare and a cronjob

#129

Post by djbusby »

max-ibel wrote: post #117

Did anyone here here set up a good rsyslogd configuration where the receiving syslog collector limits incoming logs to only known ddns machines ? I think I may be able to stitch something together with periodically reconfigured packet filters, but I'd appreciate an existing solution. Bonus points if running on freebsd.

Put a filter on syslog-ng, IIRC that runs on the BSDs

Re: Free DDNS with Cloudflare and a cronjob

#130

Post by graton »

blooalien wrote: post #40
godzillabrennus wrote: post #27

Earlier quoted context omitted.

No one sunsets products like Google. I’m in the middle of transferring all my domains from Squarespace thanks to Googles sale of that business to that incredibly lousy vendor.

May I inquire who you're moving to, and where I might browse to in order to follow you away from Squarespace / Google Domains? :)

I have moved all of mine to Cloudflare.
Post reply on HN