dan comments on Securely Expose your Homelab Services with Mutual TLS

Selfhosted

63,656 readers

5,220 active

340 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Detailed Rules Post

Be civil.
No spam.
Posts are to be related to self-hosting.
Don't duplicate the full text of your blog or readme if you're providing a link.
Submission headline should match the article title.
No trolling.
Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details. Tags [CBH] or [AIP] are required, see the links in Rule 8 for details.
AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post, and find example disclosures here.

Resources:

selfh.st Newsletter and index of selfhosted software and apps
awesome-selfhosted software
awesome-sysadmin resources
Self-Hosted Podcast from Jupiter Broadcasting

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 3 years ago

moderators

[–] dan@upvote.au 12 points 1 year ago* (last edited 1 year ago) (5 children)

I haven't watched the video yet, but it's generally not worth the hassle of setting up mutual TLS if you're already using a peer-to-peer VPN like Tailscale, as the VPN software is already doing mutual authentication.

Edit: A peer-to-peer VPN (or mesh VPN) is one where two systems that are connected to the VPN can directly communicate with each other, instead of needing to go through a central server as with something like OpenVPN. With Tailscale or Wireguard, the peers need each other's public keys to communicate.

permalink

fedilink

source

hideshow 5 child comments

[–] antithetical@lemmy.deedium.nl 8 points 1 year ago (1 child)

This is only true for the connection security. With mTLS you can also authenticate to the webapplication you're trying to reach. So consider your use-case between vpn/mtls.

permalink

fedilink

source

parent

hideshow 1 child comment

[–] dan@upvote.au 4 points 1 year ago

Oh yeah that's a great point I didn't consider. Thanks.

permalink

fedilink

source

parent

[–] Netrunner@programming.dev 7 points 1 year ago* (2 children)

The whole point of mTLS is that you dont need to use a VPN to achieve that same security.

permalink

fedilink

source

parent

hideshow 2 child comments

[–] dan@upvote.au 2 points 1 year ago*

I get that, but a lot of people are already using a VPN to access their self-hosted system.

permalink

fedilink

source

parent

[–] WhyJiffie@sh.itjust.works 0 points 1 year ago

that's not that same security. an observer will still know that you are connecting over HTTPS to a particular doman/IP, maybe they can also deduce that you are using mTLS, and all your other traffic is not protected by it at all. all the while with wireguard, they can see that it's wireguard traffic, and where it goes, but anything inside is secret, plus if an app uses unencrypted traffic for some reason (smb, dns, custom and special protocols), wireguard will hide and protect that too.

permalink

fedilink

source

parent