Welp. My Forgejo instance got popped with an RCE two days ago by CVE-2026-60004. Luckily, I noticed the following morning and had the day free to figure out what happened. Let’s dive in!
As a homelab enthusiast, I found this a very interesting post. Here are my take aways from the post that I’m implementing myself:
- Miner detection. I’ve updated monitoring rules to now watch the CPU on my hosts. If the same thing happened to me I would not have been alerted at all as I’m doing simple up / down monitoring. Fixed.
- Access logging. I turned on access logging for my homelab Caddy instances.
- Log retention. I have increased the amount and retention of my logging. The hope is this will help me reconstruct what happened after a breach.
- Logs offsite. The VPS access logs now ride along with the normal backup process, which runs hourly. The homelab side still only gets caught by the weekly VM backup, so that’s next.
- Closed an open signup. My webtrees instance (genealogy) had self registration enabled, which is the same door this guy got hit through. Oops. Fixed.
- Built a tool.
log-inventory.sh, so “could I actually reconstruct what happened” is a command I run instead of a thing I assume.
I’m a bit confused by what you’re saying, because to my knowledge the DNS entry you’re mentioning won’t help with getting a certificate at all. Challenges will typically require either having the DNS entry point to a publicly reachable website (doesn’t get you wildcard) or proving the ability to modify records for the domain by adding something like a TXT record on the fly, which shouldn’t require A/AAAA records.
So you should be able to do the second type of challenge without a global A record to get a wildcard certificate, and use local DNS for the A record?
The challenge dosent require your site to be public only the DNS to be public. So your second description works.
Your serve talks to LetsEncrypt. LE gives your server a challenge. Your server adds the challenge record to your public dns. LE confirms the challenge and issues a dns-01 wildcard certificate to your server. LE never had to vist your site to confirm the challenge.
See for yourself and, from a terminal of your choosing, run
You should get back my local ip which doesnt work for anyone outside of my local network.
The point is, the challenge doesn’t require a public DNS A record pointing to your IP, it’s not involved in issuing a wildcard certificate. It requires you to control DNS records for the domain to issue a temporary TXT or something record to prove it, one which you can remove afterwards. This was my point in the original comment.
It’s A and AAAA records that are used when you open a website in a browser to map the domain to an IP address, the ones I’m saying don’t need to be public.
And just to be clear, that was describing a different kind of challenge, the simpler one which most people probably use, and which does actually involve A records.
Right, i think we are talking about 2 different but very close things. Jet’s post is talking about a setup similar to mine, which is a wildcard certificate which LetsEncrypt only issue with a DNS-01 challenge, which, as you stated, requires the TXT record and not a text file on the server that the HTTP-01 challenge requires. Yes the HTTP-01 challenge would fail for an internal ip because letsencrypt wouldn’t be able to reach your site to check the acme challenge text file.
But for sanity’s sake you can setup a wildcard cert for your homelab. Traefik makes it pretty painless and now you are not having to configure DNS records for your subdomains. For added security your A record on your dns can point to your internal IP address of your reverse proxy which gives everything routed through your proxy TLS but no-one outside your network can access it.
Jet says the following
My point is, the A record, the one pointing to an IP address, doesn’t need to be public/external, it’s not needed for the wildcard cert, so it can be kept internal.
I’m mentioning the other challenge trying to make it clear why the record matters for that, and not for a wildcard cert, sorry if that just made things more confusing.