Yeah but $30 USD vs $100 USD targets completely different customers and use cases.

I was willing to spend $30 per TV. But not $100.

Well they’re discontinuing the OG Chromecast and Chromecast w/ Google TV for this. So you’re probably right.

https://www.theverge.com/2024/8/6/24214471/google-chromecast-line-discontinued

Never invest too heavily in Google anything.

Use a Chromium browser to inspect the cert.

If anyone knows how to get Firefox to show a bad cert before loading the page, I’d love to know.

Assuming you’re the one adding HSTS, you’ll have to inspect the cert and/or view the content that is getting returned. On desktop Chromium you can type “thisisunsafe” to load a page even with HSTS. Not sure how to do it on mobile FF.

Would seem weird for it to be intercepting your domain’s traffic but not the rest of the internet.

Edit: just noticed you’re not even loading an SSL page. Are you using https in the URL?

Are you getting redirected to their captive portal?

Try this:

http://neverssl.com

Did you have to install an app called Company Portal or Intune? If no, then they probably don’t have access to your device, except for possibly being able to selectively wipe school data. They could also be using another MDM solution like Airwatch, but again, you would have had to have installed something (and unlikely, since universities get massive discounts on Microsoft licensing).

Even if you do have Company Portal, it doesn’t necessarily mean it’s managed as it’s still used to broker communication and authentication between Office apps on Android. The app itself would be able to tell you if the device is managed.

And as the other poster mentioned, if they had you install a root certificate for the university they can intercept and inspect HTTPS traffic from your device while on their network. But that still doesn’t give them access to the data-at-rest on your device.

If you’re sure you’ve got a DNS entry for the Pihole FQDN pointing at Traefik, open the dev panel in your browser (F12), switch it to the Network tab, and visit the pihole URL.

See if you get anything back and especially take note of the HTTP status codes.

Can you see the router and service in the Traefik dashboard and do they show any errors there?

I think you’re close.

You need to change service: pihole-rtr to service: pihole-svc.

Do I have to redefine all of the same information I did in my Traefik yml but in this separate config.yml?

No, you just need to reference it like you have. Define once, reference many.

No worries for the question. It’s not terribly intuitive.

The configs live on the Traefik server. In my static traefik.yml config I have the following providers section, which adds the file provider in addition to the docker provider which you likely already have:

providers:
  docker:
    endpoint: "unix:///var/run/docker.sock"
    exposedByDefault: false
  file:
    directory: /config
    watch: true

And in the /config folder mapped into the Traefik container I have several files for services external to docker. You can combine them or keep them separate since the watch: true setting tells it to read in all files (and it’s near instant when you create them, no need to restart Traefik).

Here is my homeassistant.yml in that folder (I have a separate VM running HASS outside of Docker/Traefik):

http:
  routers:
    homeassistant-rtr:
      entryPoints:
      - https
      service: homeassistant-svc
      rule: "Host(`home.example.com`)"
      tls:
        certResolver: examplecom-dns

  services:
    homeassistant-svc:
      loadBalancer:
        servers:
          - url: "http://hass1.internal.local:8123"

Hope this helps!

I use the Traefik file provider for this.

https://doc.traefik.io/traefik/providers/file/

It picks up all my .yml configs in the watched folder which define the routers and services external to Docker.

Yeah, but that security patch level.

Sooo many good memories.

Yeah &F is factory default, M1 is speaker on only until connect, S11=35 is the dial speed (although we later learned that 50 ms is the minimum). Dial speed was important because we’d have Telemate on constant redial trying to get into the BBSes that were popular but were busy because they only had one or two phone lines.

I believe you. I’m just saying their non-firewalls (i.e., switches and APs) don’t have that limitation.

My firewall is a Fortigate 60F.

I would never use their firewalls/gateways, but their switches are pretty good for the price and their APs are decent (although tbh after 3 generations my next AP will likely be an enterprise Aruba).

That said, I still use Unifi in docker, everything is up to date, and nothing is requiring a sign-in to the cloud. Am I missing something? If it’s just the firewalls, then I’m not surprised since I’ve never been remotely tempted to use them, but it sure isn’t all of their devices.

AT&FM1S11=35

In that case, if CF is taking to Traefik and not the actual origin server, you just need to forget about the origin certs altogether and use LE certs in Traefik.

If you, Traefik, and your origin server are on the same network, then it’s going to be one hop regardless of whether you’re hitting the Traefik proxy or the origin server. If Traefik is serving up the origin server’s cert and not the LE cert, then Traefik is misconfigured to pass through instead of proxy, but I’m still not sure that’s the case as it’s almost harder to configure it that way than the correct way as a proxy.

What IP:port is your origin server listening on, what IP:port is Traefik listening on, and how is Traefik configured to reach the origin server?