Real domain useful for installation?

UCS - Univention Corporate Server
#1

Hi@all,

I will be rebuilding my UCS network in the foreseeable future.

So far I have used a fancy domain like : intern.lan etc. for the installation of the master.

This makes it difficult or costly in some cases to use local services Jitsi, Rocketchat etc from external.

Is it advisable to do the UCS installation with a real domain like ourcompany.com? or create a subdomain externally like intern.ourcompany.com and use that for the UCS installation?

with best
sven

#2

create a subdomain externally like intern.ourcompany.com and use that for the UCS installation?

I do it like that and I can remember threads here discussing that. Also the reason why the external domain isn’t a good choice in most cases.

Best, Bernd

#3

Do I understand you correctly. You choose a created subdomain (of your real external one) during the installation. But it is not a good idea?

Am a little confused right now

#4

Hi @pixel

I use the subdomain.
Thought of this Welcher Domänenname? - #2 by Grandjean thread.

Best, Bernd

#5

ok. now there is clarity

#6

Additionally, check this:
article

#7

Thanks for the tip. The certificates are not the problem for me. The HA proxy on the pfSense accepts the requests and provides the appropriate LE certificate for the requested subdomain.

#8

Hi@all,

I have read the article. One question arises for me.

I have installed the UCS with the subdomain ‘internal’ under my real domain ‘example.de’. The UCS DNS is now responsible for ‘intern.example.de’. The external server for ‘example.de’.

I install my UCS nodes as ‘cloud01.intern.example.de’, for example. On the external DNS, I create the subdomain ‘cloud.example.de’ for this host and set a corresponding record.

Can I now create an alias on the UCS DNS?

cloud.example.de → cloud01.intern.example.de

so that it can also be directly addressed internally? I always thought that an alias must not be ‘higher’ in the hierarchy than the domain for which the DNS is responsible. So ‘‘internal.example.de’’

#9

Hi,

Just a simple thing: as soon as you use SSL/HTTPS or similar you can not get what you want. Certificates are bound to hostnames. Trying to access the internal server with it’s external hostname will cause certificates issues (name mismatch). No matter if you use internal certificates or “official” ones. They will always match only one hostname.

Ignoring (or working around with some sort of proxy) certificate issues you can generate “overwrites”. So far as I remember they are called “RPZ” entries in DNS which those you will be able to overwrie public entries with your desired ones. Take a look here.

#10

Ok, then I’ll continue to use the HA proxy. It also listens on the internal interface of the pfSense and delivers the correct certificates. I just thought I could leave that out.

Mastodon