> Even if 90-day ephemeral TLS certificates and a general atmosphere of laziness have deteriorated our discipline in this regard, private key material should be closely guarded. It should be stored in only one place and accessible to only one principal. You don't even have to get into these types of lofty security concerns, though. TLS is also sort of complicated to configure.
Any time there is complexity and only the One True Priest can manage it, there will be tears.
There had better be a break glass solution backed by Righteous Documentation (a hypothetical substance I heard about this one time) if we are boxed in to a One True Priest situation.
piggybacking on this, due to the ease of getting a cert for a subdomain, basically one cert per app ... just have one cert per "compose stack"
and it's perfect acceptable to run them with rootless docker-in-docker or on separate VMs to get security. the one true sacred nginx in front of everything is nice, but also has access to everything.
of course, the lack of public IPv4 addresses in many homelab/selfhosted/hobbyist situations is the true forcing factor. (an gettting a wildcard cert is very easy with certbot nowdays, so I understand the lure.)
> Even if 90-day ephemeral TLS certificates and a general atmosphere of laziness have deteriorated our discipline in this regard, private key material should be closely guarded. It should be stored in only one place and accessible to only one principal. You don't even have to get into these types of lofty security concerns, though. TLS is also sort of complicated to configure.
Any time there is complexity and only the One True Priest can manage it, there will be tears.
There had better be a break glass solution backed by Righteous Documentation (a hypothetical substance I heard about this one time) if we are boxed in to a One True Priest situation.