Nextcloud behind Cloudflare zero trust

[cctl01@feddit.nl]

For some time, I've hidden my nextclould behind CF zero trust. When refreshing certificates via letsencrypt I would manually disable the tunnel, refresh and re-enable the tunnel. Now that letsencrypt will no longer notify me via email I need a more robust (read automated) way of refreshing certs. Do I have any options other than disabling zero trust? (the advantage would be I no longer need vpn to have the mobile app working).

[moonrise2473@feddit.it]

Behind a cloudflare tunnel you can use a self signed or expired certificate, just check the "no TLS verify" checkbox

[hendrik@palaver.p3x.de]

Maybe you can use letsencrypt's DNS-01 challenge. That works without an HTTP connection. But ultimately, I don't think you need a certificate on the server anyways, doesn't Cloudflare tunnel the traffic unencrypted?

[shimitar@downonthestreet.eu]

Setup a cron that does it once per day, when you don't need it, like certbot does.
Easy.

[mangopenguin@lemmy.blahaj.zone]

DNS-01 challenge with letsencrypt. Or use cloudflare tunnel and don't use https internally.

[cctl01@feddit.nl]

Thanks for the reply, among all answers I chose this. Just because it works for me.

[cctl01@feddit.nl]

Thanks for the reply, among all answers I chose this. Just because it works for me.

[cctl01@feddit.nl]

Thanks for the reply, among all answers I chose this. Just because it works for me.

[saltysalamander@fedia.io]

Are you a bot?

[curbstickle@lemmy.dbzer0.com]

No posts/c9mments in like a year and a half, then this... I'd guess yes.

[cctl01@feddit.nl]

Would a bot tell you? 🧐

[cctl01@feddit.nl]

3 people independently advice dns challenge. They all deserve the same appreciation don't they?

[curbstickle@lemmy.dbzer0.com]

I don't think a copy/paste answer comes across as appreciation, no.

It comes across weird, especially on a low activity account, and seems like a bot response that got stuck.

[dreadbeef@lemmy.dbzer0.com]

I'm just a passive observer and it's fine. You can assume it's a bot but that's not on them. They seem legitimate and my assumption is maybe English isn't their first language.

[curbstickle@lemmy.dbzer0.com]

With the other comments since, yeah not a bot. Early on with the long gap, then a post and the same commen t being the only comment - yeah that looks like a bot.

Its not an indictment of them, just observation.

[kairubyte@lemmy.dbzer0.com]

It can be unencrypted, but isn’t a requirement.

[chiisana@lemmy.chiisana.net]

If you can serve content locally without tunnel (ie no CGNAT or port block by ISP), you can configure your server to respond only to cloudflare IP range and your intranet IP range; slap on the Cloudflare origin cert for your domain, and trust it for local traffic; enable orange cloud; and tada. Access from anywhere without VPN; externally encrypted between user <> cloudflare and cloudflare <> your service; internally encrypted between user <> service; and only internally, or someone via cloudflare can access it. You can still put the zero trust SSO on your subdomain so Cloudflare authenticates all users before proxying the actual request.

[cctl01@feddit.nl]

This worked great.
For those looking to apply the same solution. And running Nextcloud in snap.
You need a cert.pem, key.pem and chain.pem file.
The latter can be found here: https://developers.cloudflare.com/ssl/origin-configuration/origin-ca/#cloudflare-origin-ca-root-certificate
The cert and key can be generated from your Cloudflare Dashboard under Domains > SSL/TLS > Edge Certificate.

Place all three files in /var/snap/nextcloud/12345/certs/live/ where 12345 can vary for you.

Finally
sudo nextcloud.enable-https custom cert.pem key.pem chain.pem
Profit!