Your Address and HTTPS

When you opt into web serving, the server gets a hostname of its own under nas2.dk and a real, browser-trusted certificate. There are no self-signed warnings and no certificate to install on the devices that connect.

Only when you ask

The network drive needs none of this. It works on names local to your network, and a server used only as a drive never contacts my backend at all. The hostname and certificate are provisioned on demand: the app offers to set them up the first time the server is serving with Internet reach turned on, and Settings → Hostname does it whenever you ask. Provisioning takes about two minutes, where most of the time is spent waiting for DNS, and the app shows you the progress.

The hostname

The server registers and is assigned a hostname such as x7k2q9.nas2.dk. That name follows the server wherever it goes, as NAS Reborn keeps the DNS records pointed at the current address of the device, on your home network and, when it is reachable, on the wider internet. Share links use this hostname, so they keep working when your connection changes.

The certificate

The certificate is a genuine Let's Encrypt certificate and the device does the work itself. It proves control of its hostname through a DNS challenge, orders the certificate and installs it. The private key is generated on the device and never leaves it, and renewal happens automatically well before expiry.

The app shows you where the certificate is in its lifecycle: validating through Let's Encrypt, active with its expiry date, or a legible error when something is wrong, such as DNS trouble, rate limits or no network.

Over that connection the server speaks HTTP/2 to any browser asking for it, so the images, stylesheets and scripts of a page all travel down one connection instead of queueing. HTTPS is also what makes low-latency camera feeds play at full speed, since the video player from Apple only accepts them over HTTPS.

Why the hostname is used even at home

Certificates from public authorities cannot be issued for .local names or bare IP addresses, so those would normally produce browser warnings. The nas2.dk hostname works both ways. On your own network it resolves to the local address of the device and from outside it resolves to your public one, so you use the same URL with valid HTTPS everywhere. For networks where the hostname cannot help, such as one with no internet at all, the server can also make its .local address trusted: Trusted HTTPS on Your Own Network.

Your own domain

With the Pro unlock the server also answers on a name you own, such as files.yourdomain.com, or the bare yourdomain.com itself, since a plain A record sits on an apex just fine. In Settings → Hostname choose Custom domain… and create the A record (and AAAA record, when the app shows one) at your DNS provider, with the values displayed on the screen. The screen checks as you go and only offers the certificate step once the domain actually points at your server.

The certificate is the server's own doing here too, with one difference: your domain is validated by Let's Encrypt connecting to the server directly, so nothing about it goes through my backend. The two DNS records are the entire arrangement, and they are records you own at a provider you chose. This does mean the server must be reachable from the internet on port 443 for the certificate to be issued and renewed.

The records are also yours to maintain. When your internet provider assigns you a new public address, the nas2.dk hostname follows it automatically; your own records do not. The app keeps watch: it tracks how often your address actually changes and tells you, before you commit to a domain, whether this connection looks like a steady home for one. If the address later changes under a running domain, it warns you with the new value to paste at your DNS host.

Both names serve at once. The server answers each connection with the certificate for the name that connection asked for, so the nas2.dk hostname keeps working, and keeps following the device, while your own domain serves. Which of them the app itself shows and hands out is the address picker on the Serve tab, and removing the domain leaves the hostname exactly as it was rather than starting a new setup.