6·
8 days agoAll good answers so far.
Basically your internet gateway doesn’t support what’s called NAT hairpin, also called NAT loopback.
The DNS solution is better anyway, and that particular setup is called split-horizon DNS, which basically just means your internal DNS requests get different results than ones from outside your network.
I’m a big fan of mutual TLS, which I just do in nginx reverse proxy.
Client certs get installed on trusted devices and then it’s mostly seamless.
Not every app will support it, but I use Firefox as a fallback for stuff that doesn’t, or my VPN.
TBH, I’m just happy homeassistant supports it as that’s the one thing I’d rather be as seamless as possible.
Other things I don’t mind having to connect a VPN for, like jellyfin, which I don’t currently share with others.
For nextcloud I’m currently not running mTLS as it wasn’t supported back then and I had to share some links with some people where I wouldn’t deal with certs. I think mTLS support has been merged since, so if you just use it for devices under your control, or might be viable