So I am thinking about finally setting up some form of HTTPS for my server. Right now, it basically just needed for internal access, as I connect through the tailscale network outside. The main push for this is Im sick of getting yelled at by my browser when I try to connect to my jellyfin or navidrome servers. I was thinking about some form of Self Signed cert and CA, (I had learned about those when i took a Security+ class over the summer, and built one too.) But when I was looking at Truenas, there wasnt a way to set it up so that it was the Root CA. Am I missing something, or have I decided to go about this the completely wrong way.
1 Like
I don’t know anything about TrueNAS, but I don’t think I’d want it as a root CA.
Root CA should be kept as secure as you can, either offline or in a HSM would by my vote. I see people are using Yubikey 5s as cheap HSMs.
(Typical setup your own CA steps ends up with being able to sign certs for any domain, so if someone manages to get that secret key they can sign certs for stuff like gmail.com. There is something called “Name Constraints” that would prevent that though it needs your TLS implementations to respect it, last I looked that wasn’t universal)
(https://letsencrypt.org/ is quite popular as an aside, as overkill as it feels for your local services, but it does solve the challenge of having import certs into devices. I don’t like that approach myself, I feel like it local should be kept local, and doesn’t need to - for instance - go in public transparency logs.)
Modern browsers will still bitch about self-signed certificates.
You can set up an NGINX reverse proxy and use the built-in LetsEncrypt integration to create valid HTTPS links for your services.
1 Like
They’ll bitch once though and then accept it. The reason I am currently against NGINX, is I dont know safely how to secure it. On top of that I dont need to type in Jellyfin.hoid.com (example url) to go to my server, the hoid.local:8096 is perfectly fine. I also do not feel comfortable exposing my system to the wider internet sans VPN, due to my lack of knowledge in how to properly secure it.
Just use NGINX locally on your LAN and don’t port forward through the firewall. Local clients will see valid SSL certificates and the web browser will be happy.
In its most basic form its just a folder with a bunch of certificates you generate with commandline, then you import your root cert on your browsers and import the application certs on the applications.
For example
If you want to be more fancy, there are projects like this that function like letsencrypt (so any application that can use letsencrypt can be pointed to your local server instead),
And here they do a tutorial to set it up with a raspberry, a yubikey and optionally a usb RNG.
I can recommend giving caddy a try as well.
It’s quite a bit simpler than NGINX and also has LetsEncrypt built-in.
Ok, Ill look into this, is this something I need to get another machine for? or can I install this on my truenas box?
in theory TrueNas discourages adding stuff to the OS and should be better to put it in a VM or a container instead.
In practice TrueNAS is based on Debian, just like the raspberry (raspberryOS is basically a customized Debian) so it will probably work.
Well, more like it is there but the “Apps” usually brick when you upgrade.
I think someone made a video about this
One claim of Truenas Connect is take care and handle exactly this, at least for the Truenas interfaces.
For your services, well, no idea.
I looked into this a while back.
The easiest solution I have found is to run SSL/TLS Termination via a reverse proxy like caddy, essentially accepting TLS connections on port 443, and redirecting them internally to localhost:8080. I used a piece of software named “Caddy” for this.
The issue I run into though is that even if you set this up, if you don’t have (or want) a public domain name, it isn’t possible to get TLS to work fully, as CA’s require a valid Fully Qualified Domain Name. So I am running TLS now, but since I am running on IPV4 internally with no domain name, I have to manually add my certs to every browser I use, or I still get those pesky warnings, and have to click to override.
Use DuckDNS or similar service to create a FQDN, then create DNS pointers on your router for each of your services. IE, truenas.mysubdomain.duckdns.org redirects to the internal IP of your reverse proxy.
HTTPS will work properly but you will lose the ability to click the “Web UI” button for your TrueNAS apps.
Thanks for the suggestion, but I have no desire to complicate my local network by adding a domain name and dns. I don’t even use hostnames. For local machines I only use memorized IPV4 addresses.