I’ve wanted to install pihole so I can access my machines via DNS, currently I have names for my machines in my /etc/hosts files across some of my machines, but that means that I have to copy the configuration to each machine independently which is not ideal.
I’ve seen some popular options for top-level domain in local environments are *.box or *.local.
I would like to use something more original and just wanted to know what you guys use to give me some ideas.
do not use
.local, as tempting as it may beuse
.homepersonallyRFC 6762 defines the TLDs you can use safely in a local-only context:
*.intranet
*.internal
*.private
*.corp
*.home
*.lanBe a selfhosting rebel, but stick to the RFCs!
How do you get https on those though? A lot of random stuff requires https these days.
https is not a problem. But you’ll need an internal CA and distributed its certificate to your hosts’ trust store.
I just use my domain inside my network which is a .net
everything under *.home.mydomain.tld is reserved for internal use.
I use *.home.mydomain for publicly-accessible IPs (IPv6 addresses plus anything that I’ve port forwarded so it’s accessible externally) and *.int.mydomain for internal IPv4 addresses.
I Just use a .de tld and for all my sites a *.mysite.mydomain.de.
Ssl certs from cloudflare with a dns challenge for internal use.
I mean… I use xtremeownage.com
But, ya know… I own it. Although, I use a few subdomains for my home-network, with a split-horizon DNS setup.
For those using a pihole for .internal.example.com, how do you deal with DNSSEC on example.com? Or do you just not?
I’ve never used DNS in my local network (because it’s additional burden to support, so I tried to avoid it), but couple of month ago when I needed several internal web-sites on standard http port, I’ve just came up with “localdomain.”
Yep, it’s non-standard too, but probability of it’s usage of gTLD is lowest among all other variants because of it’s usage in Unix world and how non-pretty it is :)
If DNS is a burden to support you’re doing it wrong. I set it up once and haven’t touched it since. Everything new that gets added “just works”.
It’s not like DNS is a huge burden by itself, it’s just approach of avoiding creation of critical services unless they become necessary. Because infrastructure around them is a burden: they needs additional firewall rules on middleboxes, monitoring, redundancy, IaC, backups etc.
I don’t fully follow that but like I said, sounds like you’re doing it wrong if you have to alter firewall rules every time you add a host because of DNS issues.
I am not speaking about maintainance of DNS zones (that’s easy), but about maintanance of authoritative DNS servers.
.localis mDNS - and I’m using that, saves me so much hassle with split-horizon issues etc.I also use global DNS for local servers (AAAA records on my own domain), again, this eliminates split-horizon issues. Life is too short to deal with the hassle of running your own DNS server.
.uk, but it is an actual .uk that I’ve registered.
I have a registered domain and my lan domain is “int.registereddomain.com”. This way I can use letsencrypt etc for my internal hosts (*.int.registereddomain.com via dns challenge). The actual dns for my internal domain itself is not public but static records in pihole.
Hmm I thought when I add tls internal to my reverse proxy rule for local domains, it does not get letsencrypt certs. But when I leave it out of the Caddyfile rule, it gets reachable from outside of the local network. How do I use your recommondation? Using a .home.lab domain locally with a DNS name resolve for every single local subdomain (dashboard.home.lab, grafana.home.lab, etc) right now with a caddy managing the outside and the inside reverse proxy work
Can I ask why this is done over something like hosting your own certificate authority? I’m quite new to all this DNS stuff
Same here, I’ve got surname.com registered and use static DHCP with entries on Cloudflare for router.surname.com and fileserver.surname.com and grafana.surname.com etc. all with valid certs via letsencrypt.
.damo
I had problems with .local because it’s used for MDNS and too lazy to figure out how that works so now I just use lan but I also own a .com domain so I have started to use that more
.app is suuuper cheap even for three letter domains. I picked one up for pennies with three letters that mean something to me and my partner and use a pair of redundanct piholes to serve local DNS for that domain. Externally it’s hosted on DigitalOcean for stuff I want external.
Nothing. I have all devices using tailscale DNS and I refer to things in my network by their host name directly.