←back to thread

.localhost Domains

(inclouds.space)
301 points todsacerdoti | 6 comments | 10 Apr 25 14:19 UTC | HN request time: 0s | source | bottom
Show context
peterldowns ◴[10 Apr 25 15:51 UTC] No.43645135[source]▶
If you’re interested in doing local web development with “real” domain names, valid ssl certs, etc, you may enjoy my project Localias. It’s built on top of Caddy and has a nice CLI and config file format that you can commit to your team’s shared repo. It also has some nice features like making .local domain aliases available to any other device on your network, so you can more easily do mobile device testing on a real phone. It also syncs your /etc/hosts so you never need to edit it manually.

Check it out and let me know what you think! (Free, MIT-licensed, single-binary install)

Basically, it wraps up the instructions in this blogpost and makes everything easy for you and your team.

https://github.com/peterldowns/localias

replies(3): >>43645234 #>>43652121 #>>43678363 #
1. CodesInChaos ◴[10 Apr 25 15:59 UTC] No.43645234[source]▶
How do valid certs for localhost work? Does that require installing an unconstraint root certificate to sign the dev certs? Or is there a less risky way (name constraints?)
replies(2): >>43645298 #>>43645643 #
2. sangeeth96 ◴[10 Apr 25 16:06 UTC] No.43645298[source]▶
It's mentioned in the README:

  - If Caddy has not already generated a local root certificate:
     - Generate a local root certificate to sign TLS certificates
     - Install the local root certificate to the system's trust stores, and the Firefox certificate store if it exists and an be accessed.
So yes. I had written about how I do this directly with Caddy over here: https://automagic.blog/posts/custom-domains-with-https-for-y...
replies(2): >>43648598 #>>43651755 #
3. worewood ◴[10 Apr 25 16:38 UTC] No.43645643[source]▶
I think an alternative to local root certs would be to use a public cert + dnsmasq on your LAN to resolve the requests to a local address.
4. lxgr ◴[10 Apr 25 22:25 UTC] No.43648598[source]▶
> Install the local root certificate to the system's trust stores

I really wish there was a safer way to do this, i.e. a way to tag a trusted CA as "valid for localhost use only". The article mentions this in passing

> The sudo version of the above command with the -d flag also works but it adds the certificate to the System keychain for all users. I like to limit privileges wherever possible.

But this is a clear case of https://xkcd.com/1200/.

Maybe this could be done using the name constraint extension marked as critical?

5. CodesInChaos ◴[11 Apr 25 08:50 UTC] No.43651755[source]▶
But is this an unconstraint root, or does it use name constraints to limit it to localhost domains/IPs? And how does it handle/store the private key associated with that root?
replies(1): >>43654961 #
6. peterldowns ◴[11 Apr 25 15:28 UTC] No.43654961{3}[source]▶
What's your threat model here? The way this works is that on your development machine, localias (through caddy/mkcert) generates a root cert and the per-site certs and installs them to your development machine's trust store. All of the certs live entirely on your device and never leave. You have full control over them and can remove them at any time.

The certs and keys live in the localias application state directory on your machine:

    • tree /Users/pd/Library/Application\ Support/localias/caddy/pki/authorities/local/
    /Users/pd/Library/Application Support/localias/caddy/pki/authorities/local/
    ├── intermediate.crt
    ├── intermediate.key
    ├── root.crt
    └── root.key
The whole nicety of localias is that you can create domain aliases for any domain you can think of, not just ".localhost". For instance, on my machine right now, the aliases are:

    • localias list
    cryptoperps.local -> 3000
    frontend.test -> 3000
    backend.test -> 8080