Recently it’s come to my attention that Caddy has an AI sponsor so I have been looking at moving away from Caddy.

I’m currently looking for another reverse proxy to use in place of Caddy. For TLS I am looking into using CertBot and it appears there’s a module (https://github.com/desec-io/certbot-dns-desec) I can use that works for https://desec.io/ to handle my certs.

I have two questions, the first is about CertBot. Since Caddy is handling my certs automatically, how often would I want to renew my certs? Desec.io has this command to obtain a cert:

certbot certonly \
     --authenticator dns-desec \
     --dns-desec-credentials /etc/letsencrypt/secrets/$DOMAIN.ini \
     -d "$DOMAIN" \
     -d "*.$DOMAIN"

Would I be required to run the same command periodically to renew my cert?

My second question is a bit more open ended. I am looking to hear any suggestions or experiences about different reverse proxies that are preferably free of AI. There is a list here with some suggested alternatives: https://codeberg.org/ethical-foss/open-slopware#web-servers

  • stratself@lemdro.idEnglish
    2·
    13 hours ago

    For TLS I am looking into using CertBot and it appears there’s a module (https://github.com/desec-io/certbot-dns-desec) I can use that works for https://desec.io/ to handle my certs.

    You can consider using lego-acme as well. It’s not too different, just that it comes prepackaged with a bunch of DNS providers including desec, so you don’t need to install an additional module.

    Since Caddy is handling my certs automatically, how often would I want to renew my certs?

    By default, certs are valid for 90 days so you’d wanna renew a bit earlier than that. There’s also the option to use 45-day certs or 6-day certs, depending on the profile chosen.

    Would I be required to run the same command periodically to renew my cert?

    Yes, but it’s better if you automate them, like Caddy did, and both Certbot and lego can do this well. I run lego via a cronjob which checks for the certs’ expiry, and renew it when it passes a certain deadline.

    I am looking to hear any suggestions or experiences about different reverse proxies that are preferably free of AI

    Not sure I can recommend anything from that list because I’m not familiar with them, but I’ve heard haproxy to be very performant.

    • confusedpuppy@lemmy.dbzer0.comOPEnglish
      1·
      7 hours ago

      Thank you, I’ll have a look at lego-acme, it looks interestingly. I prefer to use cron so this is could be something I would consider using.

      • lemmyvore@feddit.nlEnglish
        1·
        3 hours ago

        FWIW I’ve tried all the major CLI tools for cert renewal (certbot, lego, acme.sh) and certbot was by far the easiest to use. The others were various shades of horrible – bad documentation, obscure error messages, you name it. Wish I had tried certbot first and not wasted my time.

        You can find the magical incantations online and coax them to work eventually but they made me wonder if that’s the kind of tool I want to trust with my cert renewal. Also I’m starting to think it’s not a coincidence that other tools like NPM bundle certbot (as opposed to something else).