Inward — plug-and-play Let's Encrypt for self-hosted internal apps
A small appliance-style CLI that wraps ACME, split-horizon DNS, and a reverse proxy so you can serve https://grafana.yourdomain.com on your LAN with a real publicly-validated certificate — no public exposure, no self-signed bypasses, no per-machine trust config.
Platform and SRE engineers running self-hosted dashboards and APIs behind a corporate VPN
- One `inward up grafana.yourdomain.com` that wires a Let's Encrypt cert with DNS-01 or HTTP-01 standalone mode
- Built-in split-horizon DNS config for NetBird, Tailscale, or plain BIND
- Daily auto-renew cron with hot reload of nginx or Caddy and pre-expiry health alerts
- WAF rule template that binds the HTTPS listener only to the VPN interface
HN's 68-point, 47-comment thread on the awkwardness of mixing ACME + split-horizon DNS + WAF shows developers want a single opinionated tool now, not another five-step tutorial.
Multiple recent tutorials, LE community threads, and homelab guides confirm ongoing pain around issuing publicly-trusted certs for internal split-horizon domains — real but niche audience.Wildcard certficate with split-horizon DNS - Help - Let's Encrypt Community ↗SSL for My Homelab - Paul Bruce ↗
step-ca (Smallstep) is the established, ACME-compatible private CA that already solves most of this problem; mkcert, Caddy+ACME, and Technitium+certbot cover the rest, leaving the 'opinionated wrapper' niche very narrow.GitHub - smallstep/certificates: A private certificate authority ↗Be the LetsEncrypt in your homelab with step-ca ↗
Free OSS alternatives (step-ca, mkcert, certbot) dominate the space; Smallstep itself pivoted away from a simple internal-cert product to enterprise device identity, signaling weak direct monetization at this layer.Enterprise Device Identity Pricing & Plans | Smallstep ↗
TLS-everywhere, zero-trust, and mTLS trends make secure internal HTTPS a durable multi-year need; ACME ecosystem continues to grow and DNS provider APIs are standardizing.
Each component (ACME client, DNS-01 provider plugins, reverse proxy) exists, but wiring split-horizon + LE DNS-01 challenge across many DNS providers and proxy targets is non-trivial integration work.