You’re spot on. I just checked LetsEncrypt (and anything using the certbot and most ACME clients) use port 80 by default.
There’s workaround like DNS challenge but you will most likely have to do it manually and play with the DNS zone records, I think in Duckdns you will only be able to do this for one domain\subdomain as you only have on TXT record.
https://jmorahan.net/article/lets-encrypt-without-port-80
https://github.com/certbot/certbot/issues/6496
At this point I recommend you to dump Duckdns and get your own domain in Cloudflare, having your own domain and having Cloudflare as DNS makes everything work effortlessly and more secure. It will probably cost you about 15-20USD for 2 years, the longer the cheaper it is. It is basically the domain cost only.
What you get from Cloudflare is security features which you should take advantage of since you’re exposing your instance to the internet. Using the FREE tier you get:
-
Cloudflare acts as a proxy, the IP resolved from your hostname does NOT point to your public IP. It will be pointing to Cloudflare servers. This is HIGHLY desirable.
-
You get DNSSEC
-
Firewall rules. Managed rules (You get protected from HTTP,UDP,SYN,ACK,QUIC flood), firewall rules (block known bots, block based on threat score of IP).
In my case I block ALL bots and just allow Google and UptimeRobot bots to reach my instance so I can use Google Assistant. I do a JavaScript Challenge for low threat score IP and block high threat score (IPs known for malicious activity). I have also blocked or put challenge to HIGH risk countries such as Ukraine, Russia, China. You can have rate limiting so if any IP exceeds at threshold limit it will be blocked, this is highly effective. You can also block specific user agents. -
Cloudflare access. This is VERY good, but you’re limited to 5 users. Basically you can have an extra authentication step in Cloudflare, so anyone using your domain MUST authenticate. You can add exceptions to Cloudflare access, in this case I added Google API and UptimeRobot IPs as an exception so they do NOT have to authenticate.
You will run into this authentication page, you can authenticate via several methods as per below and more. I can either get a “magic” link to authenticate without putting any codes, getting a code on my email or use other methods like FB or Google authentication.
You can also create page rules to disable or enable features based on the URL. So you can expose specific URLs.
Once you’ve done such things you can basically DROP everything in your firewall that is NOT coming from Cloudflare servers, you only allow stuff coming from their proxy servers. Everything will have to go through Cloudflare including API calls, webhooks, etc but you get the extra layers of security.
Or you can also disable the proxy feature in Cloudflare and let everything go straight to your instance, let it be just a DNS resolver. Basically what DuckDns is doing.
As an extra you get one free wildcard certificate, analytics, FAST DNS resolver, and additional modes if you think you’re getting hacked. Also they do some black magic to speed up everything. Not a pro in this, just got started but I am more than happy with the features.
So basically anyone running into a HA instance will run into the Cloudflare firewall (dangerous IPs, bots, high risk countries and others get blocked or challenged based on the risk), then Cloudflare Access authentication, then you can reach your instance. Authentication can be saved so you do it once from known clients.
And anyone trying to reach you by IP address directly will be dropped by your firewall since only Cloudflare servers will be whitelisted.
I have a bunch of subdomains for several services like NextCloud, PLEX, HA, Unifi, CCTV system, etc. Definitely not a must have, but a really nice thing to have.
