Post #2563477

@astraluma@tacobelllabs.net @ryanc@infosec.exchange @owen@mastodon.transneptune.net closest I've been able to get is: - real domain - tailscale (headscale actually) with local tunneling - wildcard subdomain pointing to IP on tailnet - DNS-01 wildcard cert - internal DNS that just lies, served on both the tailnet and LAN - internal sites use the wildcard cert it... works? no, it works. end result is that a random device on the LAN without tailscale can point a browser at https://whatever-the-fuck.subdomain.bleh, and it ends up talking to a real webserver over TLS. Firefox even gives it the thumbs up. however, this is not a place of honor. no great deeds are recorded here.