For instance how can I use my *.domain.com SSL certs and NPM to route containers to a subdomain without exposing them? The main domain is exposed.
You can use the DNS verification method. Either using nsupdate with bind or what ever protocol your DNS provider and favorite ACME (certbot, acme, lego, etc) utility supports. As long as your DNS server is publically reachable that will work, even if the subdomain itself doesn’t exist publically.
Split DNS on your LAN?
Only records permitted to be access on your LAN are responded by a local DNS server. While public DNS still available for your public facing services.
Your wildcard cert will work for both situations as the browser only cares the sni matches the Url in your address bar.
I’m using this right now but I’m switching to having all my services under one domain and blocking non internal ips. Technically someone can access your site by providing the host manually, althought it’s unlikely since they would need to know it
Would you elaborate on this concern? I’m not sure I understand but I’d like to.
You need a DNS service that works with Let’s encrypt
NPM is in my post…
I don’t get it. Npm is a package manager. It doesn’t handle certificates.
You need a DNS service like route 53 (AWS) or similar where let’s encrypt connects via an API and creates the DNS token.
OP isn’t referring to the package manager. They’re talking about Nginx Proxy Manager
Oh
That makes sense. We need to stop making two things use the same acronym. Its like people saying HA for home assistant without realizing that HA is normally used for high availability.
I believe there are also the acronyms hass for homeassistant or HAOS for homeassistant OS.
