Quick and Easy Local SSL Certificates for Your Homelab!

Summary

The video demonstrates how to give homelab applications friendly domain names and valid Let’s Encrypt SSL certificates without making the applications publicly accessible.

How the setup works

• A domain name can point to a private IP address that is reachable only on the home network.
• Let’s Encrypt DNS-01 validation verifies domain ownership through a temporary DNS record. Unlike the usual HTTP challenge, it does not require opening ports to the internet or making the service publicly reachable.
• DNS-01 can also issue a wildcard certificate that covers multiple subdomains.
• A reverse proxy—in this tutorial, Nginx Proxy Manager (NPM)—routes requests to services and manages certificates.
• A domain is required. The tutorial uses DuckDNS as a free option; paid domains are another choice.

Setting up Nginx Proxy Manager

1. Install Docker on a Debian 11 server. Add the official Docker repository and choose the correct architecture: amd64 for most x86 PCs or arm64 for ARM devices.
2. Run NPM and example services with Docker Compose so the containers can communicate on the same network. The tutorial’s stack includes NPM, Nextcloud, Jellyfin, and Home Assistant.
3. Open NPM at server_ip:81 and replace the default login credentials.
4. In DuckDNS, create a domain and point it to the proxy’s private IP. For other DNS providers, a wildcard CNAME record may also be needed.
5. In NPM, request a certificate using the DNS challenge, select DuckDNS, and enter its API token. If validation fails because DNS changes have not propagated, increase the propagation wait—for example, to around 120 seconds.
6. Add a proxy host for each application, directing it to the relevant container name and port. For services outside the same Docker network, use their IP address instead.
7. Select the certificate and enable Force SSL and HTTP/2. Enable WebSockets when an application needs them, such as Home Assistant.

The examples route NPM’s own interface, Nextcloud, Jellyfin, and Home Assistant through subdomains. Nextcloud uses HTTPS on port 443 in the example. Home Assistant also needs the NPM instance’s IP added to its configuration before proxy access works.

Limitations and considerations

• The method avoids exposing the applications themselves, but domain resolution relies on an internet connection. For access during internet outages, the presenter suggests using a local DNS server such as Pi-hole or AdGuard, or adding client-side hosts-file entries. Hosts entries must be configured separately on each device.
• The presenter considers Block Common Exploits and asset caching optional for this local, firewall-protected setup.
• The video also briefly promotes Brilliant.org; this is separate from the technical tutorial.

Main speaker/source: Wolfgang, the channel’s presenter and narrator.