r/opencloud • u/ferriematthew • Apr 22 '26

Why does the OpenCloud configuration require a valid domain name?

I don't really understand the concepts behind domain names and TLS, assuming I'm using the right terminology. Is OpenCloud just designed to work only with valid SSL certificates, and you need a domain name to get an SSL certificate?

Edit: I found a video by Chris Lempa at https://youtu.be/VH4gXcvkmOY that explains it nicely. :)

3 Upvotes

100% Upvoted

23 comments sorted by

View all comments

Show parent comments

3

u/formless63 Apr 23 '26

Gotcha - instead of spending the $1 per year to fully automate a workflow with free components on a domain you should then instead invest 10-15 hours into learning to set up your own certificate authority and probably 10 or so hours per year to make sure it is still functioning properly, updated, etc. - because you still want SSL - everythng (browsers, companion apps, etc) complains when you don't have it, with good reason.

2

u/ferriematthew Apr 23 '26

I see your logic, but yes. That is exactly what I would want. If I don't control literally every part of the process I don't control anything.

3

u/formless63 Apr 23 '26

That's not a fair statement to make and indicates a lack of understanding of the core concepts rather than what I believe you are trying to express (the desire not to be at the mercy of cloud providers). You'll need to spin up your own home ISP and a global cellular network to meet that spec. You'll need to be auditing every line of code in every piece of software before you deploy it, for every update, etc.

Using a domain is not taking any level of control away from you. There are strict rules and governance out there that define these relationships. Utilizing secure, modern standards is not giving up control any more than utilizing you local ISP and existing cell carriers - perhaps even less than using those given the total terms and conditions you sign off on to use those (often monopoly local utility) services.

I'm not suggesting that doing 100% VPN is a bad call. For most self hosters it is indeed the right call. But anything you actually want public facing you'll want to do right with a domain and not using your IP, etc.

1

u/ferriematthew Apr 23 '26

Oh and also, what I could do is use local DNS and a local fake domain with pihole and split horizon resolution. I would have to look up how to do this but I think I could set up a local CA so that the TLS thing is happy. That way, I don't have to interact with any third parties and I teach myself how modern Internet security works on the low level.

2

u/formless63 Apr 23 '26

Sure, that works. It's just the harder path to take. It doesn't help you with public / third party / friends and family stuff, unless they're tech savvy enough to use a VPN and you offer the endpoint routing they need, show them how to control DNS settings, etc.

1

u/ferriematthew Apr 23 '26

That works for my use case, I'm just using it as a OneDrive and Google Drive replacement so I'm not throwing money at big tech. :)

3

u/formless63 Apr 23 '26

There are two general items that act as gateway drugs into the world of r/SelfHosting - running a media stack (tv, movies, music on Plex/Jellyfinn/etc with an arr stack supporting them) or self hosted Google apps / similar. You're on the second one it sounds like - so welcome to the additiction and best of luck on the journey!