# Node-red-contrib-letsencrypt

**URL:** <https://discourse.nodered.org/t/node-red-contrib-letsencrypt/88424>\
**Category:** General\
**Tags:** security\
**Created:** [31 May 2024 22:48 UTC](https://discourse.nodered.org/t/node-red-contrib-letsencrypt/88424 "2024-05-31T22:48:33Z")\
**Posts on this page:** 15\
**Page:** 2

<div class="post-metadata">

**Author:** ![Paul-Reed](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/paul-reed/32/66906_2.png) [@Paul-Reed](https://discourse.nodered.org/u/Paul-Reed)\
**Post date:** [2 June 2024 14:22 UTC](https://discourse.nodered.org/t/node-red-contrib-letsencrypt/88424/21 "2024-06-02T14:22:23Z")

</div>

Is there any latency introduced by using Tailscale, and I assume that you are reliant upon the uptime of the Tailscale server to get access to your own network, although they do seem pretty robust - [https://status.tailscale.com/](https://status.tailscale.com/)

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [2 June 2024 15:11 UTC](https://discourse.nodered.org/t/node-red-contrib-letsencrypt/88424/22 "2024-06-02T15:11:00Z")

</div>

> [@BartButenaers](#):
>
> Some peoply might wonder _ **why I want to use SSL with LetsEncrypt certificates within my LAN** _

Yes, more and more web services require TLS encryption or they won't work. I use "hairpin" NAT on my router to give me access to routes that work outside and inside and where the inside route stays local. Along with a spare domain name. Then I have a multi-domain wildcard Lets Encrypt cert that is managed using their super simple Acme tool on a CRON schedule. It actually does a couple of different certs for different reasons. I use DNS verification rather than opening an inbound port 80 so no open ports.

> [@BartButenaers](#):
>
> Yes that is something I learned from you in the past. I had a look at Ngrox also a few months ago. But perhaps I did not look good enough. I thought that it was something like a tunneling service,

> Ngrok simplifies networking by creating secure ingress to any app, device, or service with a single command or line of code. It's an ingress-as-a-service platform that decouples ingress from infrastructure, removing the hassle of getting code online without provisioning proxies or VPNs.

NGROK does have some strong authentication features but I'd have to say that by the time you are getting into those weeds, you might be better off with Cloudflare ZT which, though harder to get started with, once started, is dead easy to add various authentications to. It also has up to 50 users on the free tier instead of NGROK's 5.

> **[Securing your applications with OAuth 2.0 | ngrok documentation](https://ngrok.com/docs/guides/securing-with-oauth/)**
>
> Ngrok simplifies networking by creating secure ingress to any app, device, or service with a single command or line of code. It's an ingress-as-a-service platform that decouples ingress from infrastructure, removing the hassle of getting code online...

The NGROK free tier supports OAuth so you can use things like GitHub, Google, etc for identities. You can secure different end points to different groups/ids.

So both NGROK and CF ZT will let you create different endpoints with different authentications and authorisations.

> [@BartButenaers](#):
>
> If anybody sees a problem or improvement in my setup, or knows an easier way that offers _ **all** _ that functionality, please share it!!!

Well, other than the problem you've already identified - it doesn't seem that bad - other than the fact that it is a VPN solution. These tend to come with their own set of vulnerabilities. But still, most likely good enough for home use & is a fairly well-tried solution.

But, I can't see that it is any less complex than CF ZT. Indeed, since you have to deal with your own certificates, you could say that it is more complex. ZT will also have a few advantages should you ever get a denial of service attack - unlikely as a home user - or one of the other attacks that CF automatically mitigate on their endpoints. ZT only requires an agent to run on your Pi. The terminology they use takes a bit of head scratching but once learned isn't too bad and the docs are OK.

---

<div class="post-metadata">

**Author:** ![BartButenaers](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/bartbutenaers/32/10476_2.png) [@BartButenaers](https://discourse.nodered.org/u/BartButenaers)\
**Post date:** [2 June 2024 19:46 UTC](https://discourse.nodered.org/t/node-red-contrib-letsencrypt/88424/23 "2024-06-02T19:46:28Z")

</div>

> [@Paul-Reed](#):
>
> Is there any latency introduced by using Tailscale, and I assume that you are reliant upon the uptime of the Tailscale server to get access to your own network

Hey @Paul-Reed,  
I forgot to mention above that Tailscale is not like a classic VPN, where all traffic passes through the central servers. Tailscale is a _**P2P (peer to peer) mesh network**_, where all the Tailscale agents communicate directly to each other. So normally you don't go via the central Tailscale servers.

Only when the agents cannot communicate directly to each other (e.g. due to some very strict enterprise firewall), then the agents setup a _ **relay** _ connection via the central Tailscale servers:

 ![image](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/0/a/0a9c7cb6736d0e85261bd8568045d5e4200cb43b.jpeg)

I am running this now for about 6 months and I had no problems at all. It is always fast, i.e. I don't notice any delay. Even my google home - which passes via the central Tailscale servers - works fine. I don't do any latency measurements. Just my experience...

P.S. I have also added the LetsEncrypt keypair, which is generated and renewed periodically by the Tailscale agent. And the agent uses it to setup https connections.

> [@TotallyInformation](#):
>
> I can't see that it is any less complex than CF ZT

If that is the case I have a completely incorrect vision about CF ZT. I had quickly looked at some youtube videos, and one of my colleguas at work showed his home setup. It looked all _ **very** _ complex to me. Absolutely nothing that I can see my familly maintaining...  
But perhaps I have been looking in the wrong places.

> [@TotallyInformation](#):
>
> should you ever get a denial of service attack - unlikely as a home user - or one of the other attacks that CF automatically mitigate on their endpoints

I assume a DOS attack on my Node-RED dashboard (or flow editor) is not possible, since I access it only from within my virtual private mesh network. It is _ **not** _ exposed as a public endpoint.

On the other hand there are public endpoints, e.g. for Google Assistant. I thought that Tailscale would offer some DOS attack protection, but I can't really find anything quickly. So I assume indeed that CF does a better job in that area...

---

<div class="post-metadata">

**Author:** ![Paul-Reed](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/paul-reed/32/66906_2.png) [@Paul-Reed](https://discourse.nodered.org/u/Paul-Reed)\
**Post date:** [2 June 2024 20:03 UTC](https://discourse.nodered.org/t/node-red-contrib-letsencrypt/88424/24 "2024-06-02T20:03:15Z")

</div>

Sorry to ask another question, but...  
How about when you are away from home, do you still have access to node-RED etc? presumably via the Tailscale server?

---

<div class="post-metadata">

**Author:** ![BartButenaers](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/bartbutenaers/32/10476_2.png) [@BartButenaers](https://discourse.nodered.org/u/BartButenaers)\
**Post date:** [2 June 2024 20:18 UTC](https://discourse.nodered.org/t/node-red-contrib-letsencrypt/88424/25 "2024-06-02T20:18:33Z")

</div>

You see on my drawing that on my Android phone there is a Tailscale agent app installed. Via that app my smartphone is part of my Tailscale virtual network.

When I navigate in my Chrome browser to [https://mytailnet.ts.net/mydashboard](https://mytailnet.ts.net/mydashboard), the request goes (see diagram) automatically to the Tailscale agent on my smartphone. The tailscale agent on my smartphone sends the request directly to the Tailscale agent on my Raspberry, which forwards it to Node-RED. So I stay entirely within my tailnet: i.e. I don't go via the central Tailscale servers, and there is no public endpoint required.

---

<div class="post-metadata">

**Author:** ![BartButenaers](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/bartbutenaers/32/10476_2.png) [@BartButenaers](https://discourse.nodered.org/u/BartButenaers)\
**Post date:** [2 June 2024 20:21 UTC](https://discourse.nodered.org/t/node-red-contrib-letsencrypt/88424/26 "2024-06-02T20:21:34Z")

</div>

So it doesn't matter if you are at home or on the other side of the world. The tailscale agents can communicate directly to each other, through your firewall (see [explanation](https://tailscale.com/kb/1082/firewall-ports)) without any need for port forwarding! So I have _ **no ports open** _ in my firewall anymore!

---

<div class="post-metadata">

**Author:** ![craigcurtin](https://avatars.discourse-cdn.com/v4/letter/c/94ad74/32.png) [@craigcurtin](https://discourse.nodered.org/u/craigcurtin)\
**Post date:** [3 June 2024 07:19 UTC](https://discourse.nodered.org/t/node-red-contrib-letsencrypt/88424/27 "2024-06-03T07:19:58Z")

</div>

Just to really annoy everyone - i will throw in Wireguard Easy as a VPN solution - comes as a docker container - very easy to setup and manage and can be deployed as a stack with Reverse Proxy services as well

> **[Install WG-Easy | OSiA](https://wiki.opensourceisawesome.com/books/wg-easy-for-wireguard/page/install-wg-easy)**
>
> WG-Easy is essentially exactly what it sounds like. It's a containerized setup that includes a web...

He lists a script he has made (which i have checked and gone through) and it does nearly everything out of the box for you - with good step by step instructions.

Craig

---

<div class="post-metadata">

**Author:** ![BartButenaers](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/bartbutenaers/32/10476_2.png) [@BartButenaers](https://discourse.nodered.org/u/BartButenaers)\
**Post date:** [3 June 2024 08:46 UTC](https://discourse.nodered.org/t/node-red-contrib-letsencrypt/88424/28 "2024-06-03T08:46:22Z")

</div>

> [@craigcurtin](#):
>
> Just to really annoy everyone

On the contrary. All insights are welcome. If I have an overengineered solution, I am happy to switch to something more easy...

Is there a central server involved or just that docker container? Is port forwarding required? How do you access e.g. a Node-RED dashboard from a smartphone (that is not inside the LAN)? How can you access your Node-RED from an external service, like e.g. in my case Google Assistant ?

A little (quick drawn) scetch would help me to understand your setup...

---

<div class="post-metadata">

**Author:** ![craigcurtin](https://avatars.discourse-cdn.com/v4/letter/c/94ad74/32.png) [@craigcurtin](https://discourse.nodered.org/u/craigcurtin)\
**Post date:** [3 June 2024 23:47 UTC](https://discourse.nodered.org/t/node-red-contrib-letsencrypt/88424/29 "2024-06-03T23:47:17Z")

</div>

Bart,

Its just docker containers that do everything for you.

Yes you port forward the port for VPN traffic only to the docker container - i.e. nothing is allowed from outside your network unless it goes over the VPN and to the docker container only

You access NR with the same IP addressing internally as externally

Not sure about google assistant - have not tried that - but could not see a reason it would not work.

I will try and get a sketch done in the next day or so (i do not use this for my home network - i actually use it for a couple of friends and clients as they are very network illiterate and wanted something that just worked. They use it for their Frigate and Home Assistant access as well as a dedicated alarm panel and an NVR system.

On my home network i use Wireguard in native mode (as i have to support it) on my home OpnSense router - i moved to this from Zerotier as i found the performance of Wireguard to be much higher

Craig

---

<div class="post-metadata">

**Author:** ![BartButenaers](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/bartbutenaers/32/10476_2.png) [@BartButenaers](https://discourse.nodered.org/u/BartButenaers)\
**Post date:** [3 August 2024 06:24 UTC](https://discourse.nodered.org/t/node-red-contrib-letsencrypt/88424/30 "2024-08-03T06:24:56Z")

</div>

For anybody interested in this topic...

I had again a look at my security setup, because it is FAR too complex to explain to my boys.  
But I find it far from easy to create a secure setup that is understandable...

- _ **Ngrok** _ tunnels will be published at another url, every time you restart your raspberry. In their free account they only offer 1 static url, but I need two (one for my dashboard and one for my Google Assistant). Moreover their (shared) certificate is being used in the public endpoint, and not in their local agent. Which means that (e.g. for web push notifications) I always need to go to the internet, which is not what I want.

- _ **Netbird** _ seems to be a decent alternative for Tailscale, but I don't think they offer public tunnels (which I need for Google Assitant). I have asked the [question](https://github.com/netbirdio/netbird/issues/2375), but no answer yet. The nice thing is that their control server (backend) is also open source, which is not the case for Tailscale.

- For _ **Tailscale** _ my above issue is still not solved. I tried to analyze their code, but did not find the root cause. Don't have time to investigate it in more depth. So I visualized this part of their Go code (see [here](https://github.com/tailscale/tailscale/issues/11009#issuecomment-2266439417)) in a desparate attempt to get some help from their developers. Because due to this issue, I need to have have a Caddy reverse proxy, which is kind of ridiculous...

BTW if anybody is interested in the Tailscale approach, you can always give a thumb up in the first post of the above Github issue (like Paul already did...). Don't know if it helps, but you never know...

---

<div class="post-metadata">

**Author:** ![Paul-Reed](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/paul-reed/32/66906_2.png) [@Paul-Reed](https://discourse.nodered.org/u/Paul-Reed)\
**Post date:** [3 August 2024 08:19 UTC](https://discourse.nodered.org/t/node-red-contrib-letsencrypt/88424/31 "2024-08-03T08:19:50Z")

</div>

This is the issue Bart referred to;

> <https://github.com/tailscale/tailscale/issues/11009>
>
> \### What is the issue?
> 
> When I combine funnel and serve, then always the last …one will rule the first one:
> \* When I first do \`serve\` and then \`funnel\`, then both become as funnel public on the internet.
> \* When I first do \`funnel\` and then \`serve\`, then both become serve within my tailnet.
> 
> This is not what I expected, because from \[this\](https://tailscale.com/blog/reintroducing-serve-funnel) article I understand that both can be used together:
> 
> !\[image\](https://github.com/tailscale/tailscale/assets/14224149/361294ec-8599-455e-ba24-6169271c06ee)
> 
> This is quite invenient, but also quite dangerous. Because if you are not paying attention, you are making your served service public available...
> 
> \### Steps to reproduce
> 
> \## Scenario 1 - serve then funnel
> 
> 1. When I serve my port, that works as expected (i.e. only available within my tailnet):
> \`\`\`
> $ tailscale serve --bg --set-path /my\_serve http://localhost:1880
> Available within your tailnet:
> https://my\_tailnet\_host\_name/my\_serve |-- proxy http://127.0.0.1:1880
> \`\`\`
> 2. But when I funnel another port, that works not as expected (i.e. both available public):
> \`\`\`
> $ sudo tailscale funnel --bg --set-path /my\_funnel http://localhost:3000
> Available on the internet:
> https://my\_tailnet\_host\_name/my\_serve |-- proxy http://127.0.0.1:1880
> https://my\_tailnet\_host\_name/my\_funnel|-- proxy http://127.0.0.1:3000
> \`\`\`\`
> 
> \## Scenario 2 - funnel then serve
> 
> 1. When I funnel my port, that works as expected (i.e. public available):
> \`\`\`
> $ tailscale funnel --bg --set-path /my\_funnel http://localhost:3000
> Available on the internet:
> https://my\_tailnet\_host\_name/my\_funnel |-- proxy http://127.0.0.1:3000
> \`\`\`
> 2. But when I serve another port, that works not as expected (i.e. both only available within my tailnet):
> \`\`\`
> $ sudo tailscale serve --bg --set-path /my\_serve http://localhost:1880
> Available within your tailnet:
> https://my\_tailnet\_host\_name/my\_serve |-- proxy http://127.0.0.1:1880
> https://my\_tailnet\_host\_name/my\_funnel |-- proxy http://127.0.0.1:3000
> \`\`\`\`
> 
> \### Are there any recent changes that introduced the issue?
> 
> No I only recently started with Tailnet.
> 
> \### OS
> 
> Linux
> 
> \### OS version
> 
> Debian GNU/Linux 12 (bookworm)
> 
> \### Tailscale version
> 
> 1.58.2
> 
> \### Other software
> 
> \_No response\_
> 
> \### Bug report
> 
> BUG-3882ad0fcdee85e9c8415037487dcaef863752167ddaaad1e3d50c120199edd8-20240201204732Z-ce1a7d4e4797131d

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [3 August 2024 10:55 UTC](https://discourse.nodered.org/t/node-red-contrib-letsencrypt/88424/32 "2024-08-03T10:55:22Z")

</div>

> [@BartButenaers](#):
>
> _ **Ngrok** _ tunnels will be published at another url, every time you restart your raspberry. In their free account they only offer 1 static url, but I need two (one for my dashboard and one for my Google Assistant).

Might not help but Cloudflare Zero Trust has a lot more on offer for the free tier. It is more complex to initially set up but once done is fairly straight-forwards to document.

> [@BartButenaers](#):
>
> Moreover their (shared) certificate is being used in the public endpoint, and not in their local agent. Which means that (e.g. for web push notifications) I always need to go to the internet, which is not what I want.

Not sure I quite understand that issue so not sure whether CF ZT would help there.

---

<div class="post-metadata">

**Author:** ![BartButenaers](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/bartbutenaers/32/10476_2.png) [@BartButenaers](https://discourse.nodered.org/u/BartButenaers)\
**Post date:** [3 August 2024 21:37 UTC](https://discourse.nodered.org/t/node-red-contrib-letsencrypt/88424/33 "2024-08-03T21:37:26Z")

</div>

> [@Paul-Reed](#):
>
> This is the issue Bart referred to;  
> [Unexpected behaviour when combining funnel and serve · Issue #11009 · tailscale/tailscale · GitHub](https://github.com/tailscale/tailscale/issues/11009)

I had tonight another (_desperate_) attempt to read through the relevant part of the Tailscale Go-based codebase, and suddenly it became clear to me how it works. _ **It looks that I found the root cause and the solution** _. No fix should be required...

I can now publish services public on the internet, and private services within my tailnet (only accessible by devices within my virtual tailnet). Both types of services are automatically secured via LetsEncrypt certificates out of the box, which are automatically renewed periodically. This way I have LetsEncrypt certificates all over the place, even within my LAN 🍾 🥂 🥳

I have asked the folks from Tailscale to review my [solution](https://github.com/tailscale/tailscale/issues/11009#issuecomment-2267159080), because it needs to be waterproof of course. After all, I am not a security expert like @TotallyInformation ...

In the next days I am going to try to simplify my setup at home. For example ditch my Caddy reverse proxy, and so on...

If everything goes well, I will create soon a tutorial about how to use Tailscale to secure Node-RED.

---

<div class="post-metadata">

**Author:** ![BartButenaers](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/bartbutenaers/32/10476_2.png) [@BartButenaers](https://discourse.nodered.org/u/BartButenaers)\
**Post date:** [3 August 2024 21:57 UTC](https://discourse.nodered.org/t/node-red-contrib-letsencrypt/88424/34 "2024-08-03T21:57:39Z")

</div>

Quick comparison of Tailscale with NGrok, because that was mentioned above a couple of times:

- I don't have the limitation of 1 static domain name, so I don't need to buy a custom dns name.
- All data passes (in this peer-to-peer virtual netwerk) between my own devices, so no restriction of 1 Gb per month, which is interesting if you are dealing e.g. with video streams from camera's.
- Only devices in my tailnet have access to my private services, which is an extra layer of security. There is also an ACL, which allows me specify which device can access services on other devices.
- The LetsEncrypt certificates belong to the agents on my devices, and not to the public endpoints in the Tailscale servers. So you also have LetsEncrypt certificates available within your LAN.

BTW I tried to reduce my enthousiasm tonight, but I failed to do that. Because the agony to arrive at this point was a bit too long 😉

---

<div class="post-metadata">

**Author:** ![bakman2](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/bakman2/32/6207_2.png) [@bakman2](https://discourse.nodered.org/u/bakman2)\
**Post date:** [23 August 2024 16:57 UTC](https://discourse.nodered.org/t/node-red-contrib-letsencrypt/88424/35 "2024-08-23T16:57:32Z")

</div>

I came across another solution - it is quite bizarre how it works, but it works by means of holepunching via DHT (distributed hashtable) - ie. bittorrent protocol.

It is called [holesail](https://holesail.io), free, very easy to setup, no domains needed.

Run a command on the server side, it generates a QR, scan QR with the holesail app on your phone or on some server somewhere and you are connected and then you can connect to the 'local' url in your browser.

[Previous page](https://discourse.nodered.org/t/node-red-contrib-letsencrypt/88424.md?page=1)