Comment by graton
2 days ago
I do the same thing. I'm not worried about them seeing my FQDNs.
I use the form of hostname.int.example.com for everything inside my home network. None of which is accessible to the outside world. I use LetsEncrypt with DNS validation to get the certificates.
If you are going to have all the home stuff on a subdomain (int.example.com) would it work to delegate int.example.com to a DNS server running at home what has internet access, and could handle the ACME DNS challenges for machines on int.example.com?
If it does then you don't have to mess with your public DNS whenever you want to add or renew certificates for home machines.
I'm using the free DNS my registrar provides, which doesn't provide API access unless you upgrade to their paid DNS service and so if I could use a local DNS server for the ACME challenges for the home network I could pick one that is friendly to automation.
[delayed]
> I use the form of hostname.int.example.com […]
Note that int is a valid TLD:
* https://en.wikipedia.org/wiki/.int
* https://datatracker.ietf.org/doc/html/rfc1591
He’s using it as a subdomain.
> He’s using it as a subdomain.
Lots of folks were using "dev" as a sub-domain which was fine until ICANN decide to give Google a TLD:
* https://en.wikipedia.org/wiki/.dev
So if you generally had "search example.com" in you resolv.conf, and were in the habit of having "web01.dev" in places, behaviour may have changed if you were suddenly on a machine that had the "search" line missing (or something else).
3 replies →
Which can still cause problems depending on your search domain setting and resolver client
3 replies →
So? I don't see any issue.
I always use FQDNs for everything.