itguyeric/infra
1
0
Fork 0
Code Issues 28 Pull requests Projects 1 Releases Packages Wiki Activity Actions

Signed certs for internal services (internal CA with step-ca) #31

New issue
Open
opened 2026-08-19 02:25:37 +00:00 by itguyeric · 0 comments
itguyeric commented 2026-08-19 02:25:37 +00:00
Owner
Copy link

Get real TLS on internal-only services (Proxmox, OPNsense, cockpit on bast, anything on .int.itguyeric.com) instead of self-signed warnings. Stand up an internal ACME CA with step-ca, distribute the root to the fleet and workstations, and let internal services request and renew certs automatically.

Pairs with the split-DNS .int names already in use. Pets like Proxmox and OPNsense get certs installed by hand or via Ansible; bootc hosts can trust the root at build time.

Get real TLS on internal-only services (Proxmox, OPNsense, cockpit on bast, anything on `.int.itguyeric.com`) instead of self-signed warnings. Stand up an internal ACME CA with step-ca, distribute the root to the fleet and workstations, and let internal services request and renew certs automatically. Pairs with the split-DNS `.int` names already in use. Pets like Proxmox and OPNsense get certs installed by hand or via Ansible; bootc hosts can trust the root at build time.
itguyeric added this to the Homelab project 2026-08-19 02:25:37 +00:00
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
No results found.
Labels
Clear labels   
area/ci
Forgejo Actions, runners, Ansible, bootc images

  
area/media
Plex, arr stack, books, YouTube

  
area/network
OPNsense, DNS, Tailscale, SWAG

  
area/observability
Monitoring, alerting, logs

  
area/platform
New services and platform-level builds

  
area/security
Auth, secrets, access control

  
area/storage
NFS, LVM, disks, swap, backups

  
area/web
Hugo site, blog content

  
type/project
Multi-session effort, likely spawns tasks

  
type/task
Discrete piece of work with a clear done

No labels
area/ci
area/media
area/network
area/observability
area/platform
area/security
area/storage
area/web
type/project
type/task
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Homelab
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
itguyeric/infra#31
No description provided.