<p>I'm self-hosting a few applications on my NAS, like tt-rss. I normally run them with docker-compose. To access an app like this when I'm not on my local network, I point a port of my home router to the port of my NAS where the app is running, and then I can just access the app through <code>htpp://public_ip_router_here:port_number/tt-rss</code>.</p>
<p>I decided to move these apps to a k8s cluster. For &quot;fun&quot;, but also because I can setup my ingress controller to do the TLS termination, and I would unlock https for all my apps.</p>
<p>The cluster is running (provisioned with microk8s). TLS works too, with some conditions:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: fanout-ingress
spec:
  ingressClassName: nginx
  rules:
  - host: fancy_domain.com
    http:
      paths:
      - backend:
          service:
            name: api
            port:
              number: 8080
        path: /
        pathType: ImplementationSpecific
  tls:
  - hosts:
    - fancy_domain.com
    secretName: tls-secret
</code></pre>
<p>If I modify my <code>/etc/hosts</code> file (I run Linux), and put this inside:</p>
<pre><code>192.168.0.203 fancy_domain.com
</code></pre>
<p>I can access my service through <code>https://fancy_domain.com</code>. This works perfectly, but it's a bit annoying because it would force me to modify my <code>/etc/hosts</code> file on all the devices I use. Is there a way to use an IP address instead of hostname? Or any workaround really, as long as I can do the fanout and keep the TLS termination.</p>
<p>I tried something like this but weirdly, I'm getting a 404 error then:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: minimal-ingress
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
spec:
  ingressClassName: nginx-example
  rules:
  - http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: api
            port:
              number: 8080
  tls:
  - hosts:
    - 192.168.0.203
    secretName: tls-secret
</code></pre>

JPFrancoia
<p>Check out <a href="https://traefik.me" rel="nofollow noreferrer">https://traefik.me</a>
You get TLS certificates and DNS for your services. I recommend to only use it for development purposes.</p>
<p>For a more elaborate setup, get a domain/DNS yourself, point it to your router and let the router forward port 443 to your cluster. You can get TLS certificates for your domain without cost using Let's Encrypt.</p>
