← TrendWatcher
Hacker News
5/10

Inward — plug-and-play Let's Encrypt for self-hosted internal apps

A small appliance-style CLI that wraps ACME, split-horizon DNS, and a reverse proxy so you can serve https://grafana.yourdomain.com on your LAN with a real publicly-validated certificate — no public exposure, no self-signed bypasses, no per-machine trust config.

Target user

Platform and SRE engineers running self-hosted dashboards and APIs behind a corporate VPN

Features
  • One `inward up grafana.yourdomain.com` that wires a Let's Encrypt cert with DNS-01 or HTTP-01 standalone mode
  • Built-in split-horizon DNS config for NetBird, Tailscale, or plain BIND
  • Daily auto-renew cron with hot reload of nginx or Caddy and pre-expiry health alerts
  • WAF rule template that binds the HTTPS listener only to the VPN interface
Why now

HN's 68-point, 47-comment thread on the awkwardness of mixing ACME + split-horizon DNS + WAF shows developers want a single opinionated tool now, not another five-step tutorial.

Signals · overall 5/10
Demand
6/10

Multiple recent tutorials, LE community threads, and homelab guides confirm ongoing pain around issuing publicly-trusted certs for internal split-horizon domains — real but niche audience.Wildcard certficate with split-horizon DNS - Help - Let's Encrypt CommunitySSL for My Homelab - Paul Bruce

Whitespace
4/10

step-ca (Smallstep) is the established, ACME-compatible private CA that already solves most of this problem; mkcert, Caddy+ACME, and Technitium+certbot cover the rest, leaving the 'opinionated wrapper' niche very narrow.GitHub - smallstep/certificates: A private certificate authorityBe the LetsEncrypt in your homelab with step-ca

Monetization
4/10

Free OSS alternatives (step-ca, mkcert, certbot) dominate the space; Smallstep itself pivoted away from a simple internal-cert product to enterprise device identity, signaling weak direct monetization at this layer.Enterprise Device Identity Pricing & Plans | Smallstep

Longevity
7/10

TLS-everywhere, zero-trust, and mTLS trends make secure internal HTTPS a durable multi-year need; ACME ecosystem continues to grow and DNS provider APIs are standardizing.

Feasibility
6/10

Each component (ACME client, DNS-01 provider plugins, reverse proxy) exists, but wiring split-horizon + LE DNS-01 challenge across many DNS providers and proxy targets is non-trivial integration work.

TLS certificates for internal services done right · 68 points · 47 commentsHacker News · 2026-07-09 (15d ago)