Post #2563476
2026-05-09 00:16 UTC
@ryanc@infosec.exchange @owen@mastodon.transneptune.net we're trying to figure this out for the local makerspace
Do not recommend
Replies (1)
-
@vt52@ioc.exchange 2026-05-09 07:24
@astraluma@tacobelllabs.net @ryanc@infosec.exchange @owen@mastodon.transneptune.net closest I've been able to get is: - real domain - tailscale (headscale actually) with local tunneling - wildcard subdomain pointing to IP on tailnet - DNS-01 wildcard cert - internal DNS that just lies, served on both the tailnet and LAN - internal sites use the wildcard cert it... works? no, it works. end result is that a random device on the LAN without tailscale can point a browser at https://whatever-the-fuck.subdomain.bleh, and it ends up talking to a real webserver over TLS. Firefox even gives it the thumbs up. however, this is not a place of honor. no great deeds are recorded here.