Careful now

(I hope a little bit of tomfoolery is allowed here)

I’m also using Certbot with DeSEC. I simply run it daily with anacron. If it doesn’t need to renew the certs yet it will say so and stop. That’s basically it.

I think it’s a very good idea for your LE renewal to be independent of whatever reverse proxy or web server you’re using.

Please keep in mind that Certbot is a Python app so you can manage it with venv. Here’s how I install it in a dedicated dir (let’s say /srv/letsencrypt because using /etc is not appropriate and it bugs me 😆):

#!/bin/bash
set -e
apt install python3-venv
/usr/bin/python3 -m venv .venv
source .venv/bin/activate
python3 -m pip install --upgrade pip
python3 -m pip install --upgrade certbot certbot-dns-desec

And to update it:

#!/bin/bash
set -e
source .venv/bin/activate
python3 -m pip install --upgrade pip
python3 -m pip install --upgrade certbot certbot-dns-desec

As for renewing certs (the script is longer, I’m making sure to create dirs and so on but this is the gist of it):

source .venv/bin/activate

./.venv/bin/certbot \
--config-dir "$CFGDIR" \
--logs-dir "$LOGDIR" \
--work-dir "$TMPDIR" \
--domain "${DOMAIN}" \
--domain "*.${DOMAIN}" \
--authenticator dns-desec \
--dns-desec-credentials "${SECDIR}/${DOMAIN}.ini" \
--non-interactive --agree-tos \
--email "$EMAIL" \
certonly

openssl x509 -text -in "${CFGDIR}/live/${DOMAIN}/fullchain.pem" |\
grep -e 'Not Before' -e 'Not After'

For DeSEC you need secrets/${DOMAIN}.ini to contain:

dns_desec_token = YOURTOKENHERE

Please note that DeSEC lets you restrict what the token can do, but setting the rights on the token has to be done through their API so you need a separate token for the API 😅.

To use the certs from Caddy, point it at the files under the config/live/${DOMAIN}/ dir (which are symlinks that are maintained by Certbot), NOT the ones under archive/.

tls /path/to/certbot/config/live/example.com/fullchain.pem /path/to/certbot/config/live/example.com/privkey.pem

Or, if you want to also add mTLS to the mix:

tls /path/to/certbot/config/live/example.com/fullchain.pem /path/to/certbot/config/live/example.com/privkey.pem {
    client_auth {
        mode verify_if_given # or whatever access mode you want
        trust_pool file /path/to/custom/ca.pem
    }
}

Let me know if you have questions.

I think SWAG would be nice for you https://docs.linuxserver.io/images/docker-swag/

It’s basically a preconfigured nginx container with certbot builtin.

I used traefik in the past, but moved to Caddy a while ago. In traefik I had to restart the service to apply the renewed certificate, which I found annoying. Caddy on the other hand just works.

Anyway, are you using anything by the Linux Foundation?

For TLS I am looking into using CertBot and it appears there’s a module (https://github.com/desec-io/certbot-dns-desec) I can use that works for https://desec.io/ to handle my certs.

You can consider using lego-acme as well. It’s not too different, just that it comes prepackaged with a bunch of DNS providers including desec, so you don’t need to install an additional module.

Since Caddy is handling my certs automatically, how often would I want to renew my certs?

By default, certs are valid for 90 days so you’d wanna renew a bit earlier than that. There’s also the option to use 45-day certs or 6-day certs, depending on the profile chosen.

Would I be required to run the same command periodically to renew my cert?

Yes, but it’s better if you automate them, like Caddy did, and both Certbot and lego can do this well. I run lego via a cronjob which checks for the certs’ expiry, and renew it when it passes a certain deadline.

I am looking to hear any suggestions or experiences about different reverse proxies that are preferably free of AI

Not sure I can recommend anything from that list because I’m not familiar with them, but I’ve heard haproxy to be very performant.

I use Traefik as my reverse proxy and it deals with my certs automatically.

Keep in mind just because Caddy has an AI sponsor, it doesn’t mean they are using ai products, it could be the AI platform is using caddy and gave done the bare minimum of sponsoring the project.

I believe that it’s impossible to avoid ai generated or ai committed or ai designed or ai helped code. Or will very soon be.

Better to learn to cope with it.

Not glamour but haproxy may be worth the look.

Respectable, but why not NGINX?

I think pivoting to BSD is the easiest way to find solutions that aren’t tainted by AI.
https://www.openbsdhandbook.com/relayd/

An example of OpenBSD denying AI code contributions:
https://marc.info/?l=openbsd-tech&m=177411620801633&w=2

edit: Seems even OpenBSD is tainted nowadays, from your own link https://github.com/openbsd/src/commit/9c2b8e445a0bdfafdd6148b1760f00aa5429627b and https://github.com/openbsd/src/commit/e9af5eb5a61d189327b553b24d0d31f19c64b63f

edit 2: Here’s the only relevant mail threads I found regarding the AI contributions in openbsd
https://marc.info/?l=openbsd-misc&m=177513420401322&w=2
https://marc.info/?l=openbsd-misc&m=177573214912349&w=2

I’m fairly certain NPM (nginx proxy manager) doesn’t have any llm use inherently within the project, not sure on financial support. Other people have made context providers to use an LLM with NPM, but I don’t believe the core package itself does.

May be what meets your reqs.

I’m a gui pleb, so I do all my selfhosting through dokploy, which uses traefik under the hood and I’m quite happy with it so far.

Apache has mod_md, a built-in LetsEncrypt-compatible module that requires very little configuration and no external daemons or cron jobs: https://httpd.apache.org/docs/2.4/mod/mod_md.html Three lines per virtual host: MDomain, MDContactEmail and MDCertificateAgreement. Using it in production for three years without any issue. I don’t know what’s Apache stance on LLMs, I guess neither for nor against.