I have a domain that requires HSTS preload. I want to self host a few things using that domain (and subdomains), like nextcloud, pihole, and vaultwarden. How much of an issue is HSTS preload going to be if I do that? Will I need to set up a wildcard cert for everything? Or will it just work™️ because it’s internal or traffic is through a VPN?

I can’t find much about this so any help would be appreciated!

  • just_another_person@lemmy.worldEnglish
    0·
    28 days ago

    Required? That’s quite a commitment. Is this a Cloudflare thing?

    All it really means is that you have to advertise some metadata about your max-age and (sub)domains associated with whatever the domain is. If you’re only planning to serve over HTTPS, and you have a bulletproof refresh workflow for your certs, it’s not going to be a huge issue. Clients need to respect HSTS first, so if your clients don’t check, it’ll still function.

    If you’re just using internal or VPN traffic, there’s literally no point in using it EXCEPT to satisfy client requirements.

    Can you expound a bit more on this requirement btw? Now I’m curious.

    • Xanza@lemm.eeEnglish
      2·
      28 days ago

      Required? That’s quite a commitment. Is this a Cloudflare thing?

      There are specific TLD which are required at the DNS level to be served over HTTPS. .dev is an example. The browser will physically not load a .dev domain over anything but HTTPS.