LAN dev box (custom cert)

Run a dev box on an internal Linux server that isn't exposed to the internet. Let's Encrypt can't reach it, so you bring your own certificate (internal CA or wildcard) and Traefik serves it via its file provider. Everything else matches the public VPS flow; only the differences are shown here.

Before you start

  • A PEM certificate + key covering the dev domain and its vite. / mail. subdomains — via SAN entries or a wildcard *.dev.corp.local. The key must be unencrypted (no passphrase).
  • Internal DNS (Active Directory, Pi-hole, Unbound…) resolving the domain + both subdomains to the box's LAN IP.
  • Clients must trust the issuing CA (internal CA root installed, or a publicly-trusted wildcard).

  1. Point internal DNS at the LAN IP:

    A   dev.corp.local        → 10.0.0.20
    A   vite.dev.corp.local   → 10.0.0.20
    A   mail.dev.corp.local   → 10.0.0.20

    The DNS pre-flight still applies — these just resolve on internal DNS, not publicly.

  2. Bootstrap with a custom certificate instead of --email:

    gon server:dev:setup 10.0.0.20 \
    --alias=dev-lan \
    --cert=~/certs/dev.pem \
    --key=~/certs/dev-key.pem \
    --ghcr-token=ghp_xxxxx

    gon uploads the cert to /opt/traefik/certs and configures Traefik's file provider. The server is recorded with cert_mode: custom.

  3. Add the project — it inherits cert_mode: custom automatically (no Let's Encrypt resolver):

    gon server:dev:add-project demo \
    --host=dev-lan \
    --repo=rozklad/demo \
    --domain=dev.corp.local

    This writes deployment.tls: custom into gon.json. Pass --tls=custom explicitly only if you need to override the server default.

  4. Verify (from a machine that trusts the CA and uses the internal DNS):

    curl -I https://dev.corp.local/api/v1/healthcheck

Renewing the certificate

Re-run setup with the new PEM — it's idempotent and Traefik's file provider hot-reloads, no downtime:

gon server:dev:setup 10.0.0.20 \
--cert=~/certs/dev.pem \
--key=~/certs/dev-key.pem

Everything past this — adding developers, .env reloads, DB tunnel — is identical to the public VPS flow.