131–140 of 202 posts
Earlier quoted context omitted.
Yes, but getting it in a response from an external server means I don’t have to be specific about which interface to get the IPv6 address of and so on.
the same specific interface used to contact the external server
Earlier quoted context omitted.
Do you get a cloudflare free subdomain or you need to supply your own ?
You need to have a domain that you manage DNS for in Cloudflare. Look up what a "registrar" is, a common one people go through would be Namecheap. Get a domain, and then look up how to set up a DNS zone in Cloudflare from an external registrar. If you plan on working in tech, this is one of those things you'll absolutely need experience with doing. Good luck! Though it occurs to me their may just be a language barrie…
Earlier quoted context omitted.
There are some limitations such as: – TLS termination mandatorily happens at Cloudflare (i.e. your traffic is mitm'ed). That's because this free product is meant as a gateway drug (aka a loss leader) to Cloudflare's WAF/Anti-DDOS products (which require TLS termination to happen on their side for technical reasons). – Other TCP protocols (including SSH) require every client to run the software too. So if you were thi…
At which point is the MITM happening? What I mean is: browser → Cloudflare server → cloudflared on my server → web service. Is TLS only from browser to Cloudflare server, or is it browser to cloudflared?
It's encrypted between the browser and Cloudflare, but you can also create a cert and encrypt between Cloudflare and your origin server. (but that isn't mandatory)
Earlier quoted context omitted.
You need to have a domain that you manage DNS for in Cloudflare. Look up what a "registrar" is, a common one people go through would be Namecheap. Get a domain, and then look up how to set up a DNS zone in Cloudflare from an external registrar. If you plan on working in tech, this is one of those things you'll absolutely need experience with doing. Good luck! Though it occurs to me their may just be a language barrie…
You can buy domains directly through cloudflare
Let Cloudflare do DNS, let your registrar be a registrar.
Earlier quoted context omitted.
Well, one of the "challenges" is the one in a different comment: most registrars don't allow fine-grained control over who can update what DNS records. Can it be done? Sure. But do I want to spend money on this for my home lab if I can work around it? Not a chance. I'm kinda sensitive to the "MITM as a service" argument, but for my use case, it's not a problem.
You don’t need automated DNS fiddling for lets encrypt. Certbot can either hook into Apache or NGINX, or run its own standalone server for verification.
Earlier quoted context omitted.
They do allow ssh via a web browser. It may be a "beta" feature, but it doesn't require the client to run anything.
Requires your client to run a web browser though? That's a lot different from just an ssh client?
https://developers.cloudflare.com/cloudflare-one/connections...
Earlier quoted context omitted.
Parent did not say it was challenging. I find fiddling with LE tedious because it has to be repeated too often.
certbot and crontab needs to be setup just once, to solve cert problem
Whatever happened to KISS?
Earlier quoted context omitted.
Well, one of the "challenges" is the one in a different comment: most registrars don't allow fine-grained control over who can update what DNS records. Can it be done? Sure. But do I want to spend money on this for my home lab if I can work around it? Not a chance. I'm kinda sensitive to the "MITM as a service" argument, but for my use case, it's not a problem.
> Well, one of the "challenges" is the one in a different comment: most registrars don't allow fine-grained control over who can update what DNS records. Afaik, every major registrar allows you to add an NS record for the _acme-challenge subdomain, allowing you to put the _acme-challenge subdomain on a custom, self-hosted DNS server. That in turn allows you to make the permissions as specific as you'd like. Personall…
Earlier quoted context omitted.
You can buy domains directly through cloudflare
This is a small thing, but I think you should decouple providers in case shit hits the fan with one of them. Let Cloudflare do DNS, let your registrar be a registrar.