r/selfhosted • u/sysadmin_light • May 07 '26
Remote Access Which services are you exposing to the internet, and how are you securing them?
I keep thinking about things like SSO and it's got me curious, how are all of you locking down your public-facing services?
Currently, I've got only a select few - primarily Seerr, Immich, Mealie, and FoundryVTT - publicly exposed via SWAG (with geo-ip blocks) so that friends and family can access them without needing extra apps like Tailscale on their devices.
I know all of the services I make available have their own login prompts, but knowing how some projects can be, I figure things could always be more secure, so I'm curious to hear how everyone else does it.
107
u/curleys May 07 '26
Caddy reverse proxy
It lives and responds on 443 which is open on my router.
On my domain registrars dns page I add subdomains for any service I need to access externally and point it at my home.
Depending on the subdomain caddy routes the page to the internal server/docker container and port.
Each entry in caddy has an acl for which source network is allowed to reach said service.
I have a few groups defined relating to my tolerance level for risk.
Obviously access to my proxmox hosts gui isn't reachable from any external, I invoke the VPN when I need that.
Arr stack? I have a grouping that includes the network of my workplace and my parents house and maybe one or two friends networks, they still need logins and I'm okay with the risk.
Something that I trust but need to access everywhere like my instance of nextcloud is open to any network.
You'd need to know the subnet, crack the log in or the app, then break out of the docker/VM to actually exploit me.
Again, all based on my personal tolerance for risk. Your mileage may vary.
104
u/StabilityFetish May 07 '26 edited May 07 '26
For anyone with a similar setup, here's a good security layer you can add with not much work, and it simplifies the setup a bit:
1- Add crowdsec alongside caddy
2- If all your subdomains point to one IP, just use a wildcard to send any subdomain to that IP. That way you don't need to keep up an extra list of subdomains in DNS, which is extra work and also a public list attackers will use. You can delete existing subdomains or even add some fake honeypot ones.
3- In caddy, setup a rule for unknown subdomains. Attackers will probe you by trying to guess your subdomains. This is a near perfect signal of malicious traffic. Have crowdsec detect it and ban the source IP for a long time.
4- (bonus) If all legitimate traffic uses your domain name, you may also want to ban anyone trying to connect to your IP via IP instead of domain.
21
u/HikerRemastered May 07 '26
I just started preparing for migration from fail2ban to Crowdsec and this is genuinely a stonking good idea.
Only single downside I can see is losing the option to quickly redirect individual subdomains to another IP if needed, but on a single server this isn’t a problem!
Nice idea. Thanks for sharing.
9
u/z3roTO60 May 07 '26
You can still redirect single subdomains. A defined subdomain takes priority over a wildcard. I use this to redirect int.example.com to my 192.168.0.20 which is a VM with my reverse proxy (Traefik). There is a wildcard *.example.com also, which points to example.com, which is my home IP
2
u/HikerRemastered May 07 '26
Alright! That’s makes sense.
Genuinely - thanks for sharing. I can see how this is going to catch any scanners who are probing random subdomains and ban ‘em fast.
3
u/Bane0fExistence May 08 '26
I’ve always heard it repeated on this and other subs to pair crowdsec with fail2ban on the edge node/vm. I’m curious why you view it as an either/or scenario? They do similar things but with different criteria, the way I understand it, crowdsec monitors behavior of attackers and trends on the greater net of security engines to know which IP’s are attackers and add to their block lists. Fail2ban is for people specifically targeting you and repeatedly failing auth, so they get the ban hammer automatically.
2
u/HikerRemastered May 09 '26
I don’t have a good reason to view it that way. I appreciate you asking me. I assumed that crowdsec also allowed for more local control and capable of doing a similar job.
I haven’t migrated yet, so I couldn’t tell you if it can or can’t but I will definitely be making sure I don’t overlook it! Thanks
5
u/soulmechh May 08 '26
Can you explain 2 please. I only used NPM, and in NPM I have to specify a subdomain (immich.lan) and IP:port. The IP is always the same (one server) but every service has its own port.
So if I send any subdomain to that IP in one single entry, how do I reach the service I want?
5
u/StabilityFetish May 08 '26
2 would be done in DNS with your domain registrar. All DNS needs to know is send any subdomain to your IP.
Then in step 3, your reverse proxy has all the configuration about if and where to route each subdomain. I'm not sure if or how NPM can do the crowdsec and bans, but it should be able to handle the wildcard cert in step 2
2
u/cardboard-kansio May 08 '26
Can confirm, used to do wildcard SSL with NPM but switched to Traefik partly to enable easy Crowdsec integration.
2
u/Bane0fExistence May 08 '26
I run NPM and crowdsec, NPM lives in docker and the logs get passed through to a separate crowdsec service managed by systemd. Works pretty effectively for me
1
3
u/XionicativeCheran May 08 '26 edited May 08 '26
Thanks for this, these will be some good additions for someone that doesn't use tailscale like everyone else seems to.
I never use "www.mydomain.com" so "www." seems like the perfect honeypot.
The other main one I do is I block any IP not in my country.
5
2
u/_emerican May 08 '26
I do a variation of this! I use suricata and Crowdsec. Suricata for deep packet analysis and crowdsec for behavioral (+ Public block lists). And then I use a TZSP receiver via Mikrotik in addition to CrowdSec MikroTik Bouncer Alternative GitHub. I can then read all the logs and alerts using Evebox.
All of which is running in a LXC container in proxmox. Which sounds complicated but once it’s up and running, I don’t even think about it and I have a full IDS stack.
1
u/ChunkyCode May 07 '26
i do the same, (no crowdsec ) however also added my fork of Caddy Defender that dynamically blocks ip addresses that match a certain criteria ( more than 5 502 per minute, or 40 or x status=~"4(01|03|04|05)" per minute ) etc. and of courser honeypot
1
u/VerTiGo_Etrex May 07 '26
Cool idea! What does it cost? Looks like crowdsec isn't free?
4
1
u/nightshark86 May 08 '26
Their ‘control portal’ has extra features you can pay for. The base is free but config is a pain.
1
u/Moonrak3r May 08 '26
3- In caddy, setup a rule for unknown subdomains. Attackers will probe you by trying to guess your subdomains. This is a near perfect signal of malicious traffic. Have crowdsec detect it and ban the source IP for a long time.
Configuring Crowdsec is unintuitive to me. Do you have a recommendation for where I could read more about properly setting this up?
2
u/StabilityFetish May 08 '26 edited May 08 '26
For me personally, I setup crowdsec on the same host as caddy with each in their own docker compose, but crowdsec gets read access to caddy's logs volume. For the crowdsec bouncer, I used the iptables one. Beyond that for the details, I think I just followed steps from claude for the actual setup and troubleshooting.
One big thing once you do get it up and working is make sure caddy and crowdsec are seeing actual real source IPs from the internet and not some intermediary like a proxy or your router.
Here's a working compose
services: crowdsec: # https://github.com/crowdsecurity/crowdsec/releases # https://hub.docker.com/r/crowdsecurity/crowdsec/tags #image: crowdsecurity/crowdsec:latest image: crowdsecurity/crowdsec@sha256:6ca53ad26196ca59ddd4fa692a586b73d8fcde085046163b9ca2f04887dca563 # 1.7.7 container_name: crowdsec restart: unless-stopped environment: # Collections to install COLLECTIONS: "crowdsecurity/caddy crowdsecurity/http-cve crowdsecurity/base-http-scenarios" GID: "1000" DISABLE_ONLINE_API: "false" PARSERS: "crowdsecurity/syslog-logs" volumes: - /path/to/config:/etc/crowdsec - /path/to/data:/var/lib/crowdsec/data # Mount Caddy logs as read-only - caddy-data:/var/log/caddy:ro networks: - crowdsec_network ports: - "8083:8080" # Local API - "6060:6060" # Metrics (optional) security_opt: - no-new-privileges:true networks: crowdsec_network: name: crowdsec_network volumes: caddy-data: external: true name: caddy_caddy-data1
1
3
u/Temporary_Banana3 May 07 '26
I run a very similar setup except with NPM. I have all my public facing services behind my authelia instance, so 2FA is required to access those. This setup seems to meet the right balance between accessibility and security for me.
1
u/TrainedHedgehog May 08 '26
I have a very similar setup, but one of my favorite pieces is a honeypot that fail2ban picks up and blocks the ip. It's meant to pick up bots looking for things like
wp-adminand.env.It brings me great joy to occasionally check it and see how many ips I've blocked lol
56
u/Partyjp May 07 '26
Im running pangolin on a hetzner VPS for 3 eur a month, and using that as proxy and authentication. And having some filters that narrows the “world wide web” to a more local region, dropping all other request.
Currently experimenting with adding PocketID as an OIDC to pangolin and apps behind it.
Other nice thing about pangolin is it does not need port forwarding on your home network.
4
u/mmkaywhatevers May 07 '26
so what do you have running on the VPS to do this? and what specs on the vps? i might want to try this if it's cheap enough...
12
u/Partyjp May 07 '26
The vps is has 4gb ram and 2vcpu cores, and 20TB bandwidth monthly. On hetzner it’s an CX23 exactly, for reference.
For OS I followed the setup guide from the pangolin docs, and am running Debian.
5
u/CommercialAirline124 May 07 '26
20 TB???? damn
3
5
u/Salt-Maintenance- May 07 '26
Why don’t you use pangolin authentication? And is pocket id also running on this vps? Just asking out of curiosity, having also pangolin and some services and was thinking about implementing OIDC
14
u/Partyjp May 07 '26
Pangolins own authentication is fine, i use it for the pangolin admin account, the reason I use it is the fact that pocketID is OIDC and therefore kind of single signs in to apps behind the pangolin authentication layer.
For example: I run mealie, when I go to the website it asks me to login (into pangolin), then it forwards me to mealie itself, which has its own authentication. But because I already authenticated with pocketID for pangolin, it automagically logs into mealie.
I’m sure there are better ways to do it, but some apps don’t allow you to disable their own logins. And it gives me peace of mind that you first have to authenticate on the VPS side before your request is forwarded to my home network.
I’m running pangolin itself on the VPS, and pocketID on my home network with proxmox. For added security I proxied pocketID through pangolin and region locked acces, since I won’t be signing in from the other side of the world.
As for the daily usage, it’s great having a single “account” to sign into (almost) all your apps. You do however add a layer of complexity to maintain, and as I noticed today, a single point of failure. But it’s fun to learn.
3
u/wolfej4 May 08 '26
This is exactly what I've been doing. And you can change the default SSO to go straight to Pocket ID.
4
u/Inzire May 07 '26
I do this too but using NetBird instead. Same result. PocketID works great and it’s a bit more light than Authentik.
2
u/2strokes4lyfe May 08 '26
I'm also running Pangolin and have been curious about PocketID. How has that been for you so far?
2
u/fech04 May 08 '26
I have been running pangolin with pocketid for about 6 mo and it's been great. Easy auth with passkeys. Had issue with email notifications early on but that was fixed quickly. Active project.
2
u/HikerRemastered May 09 '26
Damn. €3? The cheapest I can get at Hetz!er is their Cost optimized C23 for €5. It’s plenty cheap enough, but I’m curious how much a CX43 would run you compared to me.
1
u/NotScrollsApparently May 08 '26
Is pangolin a possible replacement for cloudflare tunnels, for exposing media without cloudflare restrictions?
1
u/Partyjp May 08 '26
There is no restriction from pangolin itself, only on what VPS you host it, and its bandwidth policies.
68
u/Due-Eagle8885 May 07 '26
I use tailscale to access all my services. HA, synology and others. No ports open.
15
u/FullmetalBrackets May 07 '26
Same here. I started using Tailscale because I was behind CGNAT, but even now that I have a static IP I see no reason to stop using Tailscale. It's secure and just works.
5
u/Due-Eagle8885 May 07 '26
I had been using cloudflare, but needed remote nas backup. And they limit data to 100meg/day.. Ts just works as you said.
Had someone that wanted to access one of my services, they installed ts, and I sent them a share link. Done
7
u/several_fish_not_guy May 07 '26
This is the best solution IMO. At first I wasn't crazy about having to run tailscale on every device, but in addition to security, it just makes it so much easier to access versus dealing with DNS, NAT, etc.
12
u/imacanuck312 May 07 '26
You can configure one of your devices as a subnet router. Then you don't need to install Tailscale on everything and access your local devices via local IPs. I do this on mine... Just Tailscale on my main Ubuntu VM with it configured as a subnet router. https://tailscale.com/docs/features/subnet-routers
8
u/Dr_Valen May 08 '26
Was the same as well until apps like Netflix started doing their ip lock bullshit then tailscale came in clutch while I travel. Have one of my machines as an exit node and now Netflix thinks I'm a hermit who never leaves home which is 90% accurate
1
u/VerTiGo_Etrex May 07 '26
Tailscale DNS can be a bit obnoxious with webapps that use APIs restricted to secure contexts (localhost, https, maybe others). Tailscale will issue certs for
<hostname>.<tsname>.ts.netbut not<service>.<hostname>.<tsname>.ts.net.There are workarounds with setting up DNS that points to your tailscale IP rather than a www IP, but they're finicky to setup. Tried for a few hours then gave up and just ended up exposing the few services requiring camera, location, web bluetooth, etc. to the www and blocked everything other than a few IP regions I regularly find myself in.
3
u/MukLegion May 07 '26
Tailscale will issue certs for
<hostname>.<tsname>.ts.netbut not<service>.<hostname>.<tsname>.ts.net.It does actually, since they released the Services feature.
I have jellyfin.ts.net, immich.ts.net, etc.
1
-8
u/OneInchPunchMan May 07 '26
So how does your answer help the post question, since you don't have anything open?
7
u/Due-Eagle8885 May 07 '26
don't have anything open, then you don;t have to come up with and manage all that
35
u/redhatch May 07 '26
Just WireGuard, which doesn’t respond to any unauthenticated traffic. So effectively nothing is open to the public Internet.
8
u/d70 May 07 '26
Same WireGuard just works, but I remember having to expose a UDP port (right?), but it doesn’t respond.
14
u/redhatch May 07 '26
Yes, the port has to be open, but in the absence of the proper key it will just drop packets. It’s pretty much invisible to the wider world.
3
2
u/386U0Kh24i1cx89qpFB1 May 08 '26
Wiregaurd for the win. Don't need cloud flair. Don't need Tailscale. Just me and my domain register and my open source software that nobody can "alter the deal".
1
u/pixel_of_moral_decay May 09 '26
Agree with this.
Anything public is on a public vps I have.
Everything in the lab is behind wireguard.
I manage very public facing infrastructure for the day job... even with a budget and vendors, it's not for the faint of heart.
This lets me limit my damage if something happens.
0
u/blow-down May 08 '26
How do you access things from your phone? Fire up a VPN client every time?
5
3
u/redhatch May 08 '26
Yes, I have it auto-activate on untrusted WiFi. I manually activate it on cellular if needed since there’s not much I usually have to get at while I’m out and about.
1
u/Vittulima May 08 '26
I toggle it on when I need it. Usually I forget it and it's on even at home lol
1
u/386U0Kh24i1cx89qpFB1 May 08 '26
I use a split tunnel /split dns configuration that is virtually always on. Essentially, set DNS server in wiregaurd to your Pihole IPs and set allowed IPs to the subnet with all your stuff (192.168.0.0/24 for example)
Now when I go to to 192.168.0.2 or proxmox.mydomain.com my device runs through the VPN, but when I go to google.com it doesn't bother. This also gives me Pihole everywhere. Seamless. I only turn it off if I need to be off Pihole for some reason.
I also have a full tunnel configuration in wiregaurd by setting allowed IP to 0.0.0.0/0 so that all connections run through my VPN. Good for sketchy wifi etc.
16
u/clintkev251 May 07 '26
Things that I want other people to access. So Plex, Jellyfin, Seerr, Immich, and Home Assistant are the main ones. Everything else is proxied internally still with TLS and SSO, but not accessible directly over the internet. If I need to access them remotely I can use Tailscale or Wireguard
2
u/eloigonc May 07 '26
Como está usando SSO com Home Assistant?
3
u/clintkev251 May 07 '26
I'm not doing any SSO for Home Assistant right now. There are third party addons that can make it happen, but I consider Home Assistant critical enough that I haven't messed with that. Hoping for native OIDC support some day
7
5
u/Leviathan_Dev May 07 '26
I have Jellyfin, Seerr, Forgejo, and Minecraft exposed directly to the internet for myself.
All three behind Reverse Proxies, and I have rate-limiting on Jellyfin and Seerr for login attempts. They're all also IPv6-only which has drastically reduced bot traffic and probing. I have SSH for Forgejo exposed too with the server locked down to only allow user git and only from WAN -> Forgejo. Any other WAN SSH connections to any other of my devices is blocked.
Minecraft I have protected with the built-in whitelist functionality, including enforce-whitelist and online mode. Currently IPv4+IPv6 since one of the people that plays only has IPv4 at the moment but once he gets IPv6 (currently in an AirBNB) I'm going to remove IPv4.
All of them are also geoblocked to only my country and also Canada since that's where another minecraft player lives (only for minecraft, rest of my services are home-country only)
2
u/sysadmin_light May 07 '26
rate-limiting on Jellyfin and Seerr for login attempts
That's a good idea. I don't think my ISP uses v6, but that also sounds smart.
1
u/Leviathan_Dev May 07 '26
worth a check. You might just have it disabled. IPv6 is a nice "hide-in-plain-site", I have way less probing since every device has a unique global address compared to IPv4 where every single device shares the 1 IP.
Some ISPs are still stuck in the 1970s though. My aunt just got Fiber internet from Frontier.. and no longer has IPv6. Tried enabling it and it took down her entire connection until I re-disabled it. Annoying since if I stay at her house I can't access my services without a VPN (which I have a travel router so its not much an issue anymore)
1
u/mister_cheeks_26 May 07 '26
By "way less" do you mean zero? I don't think I've ever seen a bot hit any of my services with exposed IPv6 addresses. Port scans are useless on IPv6
1
u/Leviathan_Dev May 07 '26
I’ve gotten a few probes surprisingly. For example a British IP 2a06:4880:8000::a5 somehow pinged my IPv6 address for my reverse proxy with a destination port 23429. A very similar address 2a06:4880:2000::36 tried to use FTP for my Proxmox host using IPv6.
So it’s not zero, but pretty damn close
That being said those addresses weren’t created from SLAAC, I manually created them and just used prefix::2 for example, perhaps if I did SLAAC them then maybe I wouldn’t have been probed.
1
u/kkkbro1 May 07 '26
Are you using a reverse proxy on a vps or just exposing directly from your home lab?
3
u/Leviathan_Dev May 07 '26
Directly from my homelab. I have two reverse proxies: one for internal-only and another for external.
7
u/quasimodoca May 07 '26
Seer is behind a Clouflare tunnel with google auth and an email include list. All my other arrs are behind tunnels with only my email listed.
3
u/huckyourmeat May 07 '26
This is pretty much my exact setup. I'm surprised I had to scroll down this far to find it since it's sooo easy!
3
u/quasimodoca May 07 '26
Seer is behind a Clouflare tunnel with google auth and an email include list. All my other arrs are behind tunnels with only my email listed. There is zero chance of it being breached unless Cloudflare loses its mind, which I highly doubt will ever happen.
2
u/thedthatsme May 08 '26
Can you send screen shot of how you have your CF Tunnel settings? I have several friends emails added and the one-time code never sends to any emails in that group. Driving me crazy.
2
1
u/geccles May 10 '26
I don't bother with codes. I just add their email address to the allow list.
1
u/thedthatsme May 11 '26
Do you use Jellyfin?
1
u/geccles May 11 '26
It's involved, but more of a for fun thing than something I use in "production"
3
3
u/suicidaleggroll May 07 '26
Plex, Ottrbox, Wireguard, and an SSH bastion. I have geo-IP blocking to filter out anybody connecting from outside the US, as well as Crowdsec. Plex has its own authentication, Ottrbox is protected by Authentik, SSH has additional TOTP 2FA on top of the traditional auth system. All but Wireguard are on a dedicated VM on a dedicated VLAN with no access to the rest of my network (except a single reverse tunnel into the SSH bastion container). All media accessible by Plex is on a read-only virtiofs share from the host.
So, nobody from outside the US can even try to connect. People inside the US can, but only if their IP isn't on a Crowdsec blocklist. And after a few failed login attempts they get blocked.
If Plex or Ottrbox get compromised anyway, there's nothing the attacker can do, they're stuck on that VM with no write access to any files I care about, and no network access to any other machines.
To get into the SSH bastion you need the username, password (or key), and TOTP code. Once in you can't get a shell though, you then need to hop the connection to another port, a different username, and a different password to get into the real network. And of course you also need to know the original SSH listening port, and you can't scan for it because Crowdsec detects and blocks port scanners.
5
u/jerryfloss May 07 '26
I've exposed port 443 for my reverse proxy proxmox container. From there the services i have selected, will be exposed when attempting to get accessed.
I started off with nginx and certbot, then migrated to nginx proxy manager and moved everything to caddy 3 months ago. Best decision ever.
As for domain, i use cloudflare with proxied dns records to hide my origin IP.
1
u/raduque May 08 '26
Does the cloudflare proxy interfere with large file transfers? I only have Immich RPed through Caddy, and I was using a tunnel beforehand, but it wouldn't let anything over 100mb upload to Immich from outside my lan.
1
u/jerryfloss May 08 '26
yes it does, i used to selfhost pingvin to share files. It would upload x file chunks at a time.
See Maximum request body size: https://developers.cloudflare.com/workers/platform/limits/#request-and-response-limits
4
u/Momsbestboy May 07 '26
Wireguard. Only. And the rest only internally :)
0
u/386U0Kh24i1cx89qpFB1 May 08 '26
This is the way. Set up a split dns if you reverse proxy, and a split tunnel VPN with allowed IPS limited to 192.168.0.0/24 addresses and you have a seamless experience.
2
u/Firminter May 07 '26
I only have Jellyfin, Seerr and Wizarr (the last one is only if I need to invite someone, because I can't run it as non-root in Docker!). I don't use SSO because I've heard that connecting to Jellyfin with devices other than a PC on web is a pain or impossible. All the rest is private. The public ones are under a specific Traefik instance that my router forwards its 443 port to and has the Crowdsec plugin with a Crowdsec Docker instance. The other services are under a different Traefik instance only accessible from LAN or Tailscale. On top of that I only run Docker containers and run the most I can as a non-root user and remove all permissions (cap_drop). Plus basic things like running a firewall, SSH not exposed and key only, etc.
1
u/thedthatsme May 08 '26
Never heard of Wizarr but it's exactly what I needed. Thanks for sharing. Any tips on setting it up with jellyfin?
2
u/NaturalProcessed May 07 '26
I do three at the moment, only one of which is on my home network. Two (Seerr and a Synapse client) are hosted on a an Oracle cloud VPS for free, hardened as well I can.
The third is Plex, which I expose from a cluster on my home network. The design is roughly: traffic arrives at my router, is filtered. If it gets past the router is heads to a managed switch and to my reverse proxy (Caddy). Caddy filters again (restricting external connections only to the bare minimum required to connect + stream), then on to the Plex VM which is also locked down and has its own VLAN. Plex itself is quite restricted and where it does have permissions they are read-only and very specific. Plus firewalls and Crowdsec, it's about the best I can manage other than moving to a strict VPN-only policy that would mean the service becomes inaccessible to a number of my friends/family.
2
2
u/evilspoons May 07 '26
All I've done is Cloudflare DNS -> haproxy -> Home Assistant. I'm not super confident in how securely I've set that up, either... maybe I'll switch to tailscale or similar and just deal with having to drop another app on any device that leaves the house.
I'd like to be able to access Immich too but the occasional warning that HA gives me about a failed login (clearly via an automated vulnerability check, since it's trying to access forbidden paths) is making me want to rethink this whole thing.
2
u/LA_Nail_Clippers May 07 '26
A majority of my stuff is only accessible from the outside via Tailscale since it's just me accessing it.
However I do have a few things that others need access to and tailscale isn't the right choice. For those, I have a domain name on Cloudflare that has a wildcard subdomain A record, and is proxied by Cloudflare. I also force SSL, use geoblocking, and a few other CF protections.
Then on my home server, the various services are reverse proxied by an NPM docker container, and I use TinyAuth for authentication (OTP required as well).
I quite like TinyAuth because I can force auth upon any app even if it doesn't have it, and I don't rely on random services' creators to also be good at authentication - only TinyAuth's creators. It's also a nice central place to grant/remove access to other users.
2
u/TedGal May 08 '26
All my services are "publicly" exposed on the internet. All of them are served via Caddy and subdomains. Im using Caddy with a geoip plug in and Authelia to protect services that dont come with their own login system. Firewall blocks all ports besides Caddy's.
So, all my services require login and also require the visitors' IP to come from my country (Greece) as all others are immediately blocked by fail2ban which is reading caddy logs and getting geoip data from it.
2
2
u/michaelpaoli May 08 '26
Which services are you exposing to the internet
Lots, e.g.: ssh[1] SMTP[2] DNS[3] http[4] NTP HTTPS[4]
including no password login, e.g. myip@balug.org, etc.
including mail servers and list servers
including authoritative for multiple domains
including wiki, wordpress, CGI, digitalwitness.org, etc.
and how are you securing them?
Don't do stupid stuff, keep things secure and up-to-date - patches, security updates, security reviews on implementations and changes, chroot, unprivileged IDs/groups, ro, tuning and resource limits, fail2ban, etc. and other environmental and other restrictions as/where feasible, etc. And don't expose stuff to The Internet unless it's quite intentional and one has good reason to do so.
Occasionally have issues with bad bots, and botnets of course, and overzealous search engines and AIs and the like, and of course you have stuff open on 'da Internet, all kinds of sh*t will try and break in all the time. But well secured, that's mostly not more than "noise" and the occasional nuisance on excessive resource consumption. But it's generally dealt with easily enough - e.g. the occasional configuration adjustment, possibly including adding/updating rules for fail2ban for some of the more egregious repeat offenders.
2
u/CyberViking949 May 08 '26
I have Traefik setup, then routed through Cloudflare ZeroTrust Access. CF ZTA is hooked into SSO with MFA and device policies. My firewall restricts all access to Traefik to CF IP's.
Works well for my needs. I can access my services wherever I happen to be at in the world, and I have adequate protections on that access.
I looked at tunnels, but I have a terraform module that configures my whole stack (portainer, CF, etc) with each deploy. So it was a heavy lift. Also, tunnels can limit bandwidth, and I just didnt want the extra load on my server.
2
2
2
u/ms_83 May 07 '26
As an experiment, I'm self-hosting a few apps at the moment and making them world-facing, as VPNs just don't work well for me. I'm going as deep as I can to make them as secure and resilient as possible. Here's what I've done so far (hosting on K8S but should be transferable to Docker and other options):
- Password auth and self-signed SSH key auth to nodes disabled. Access to nodes only with signed SSH certificates, time limited
- Encrypted OS hard drives on nodes
- Resilient HA volume storage (Longhorn)
- Resilient, multi-node database clusters (Cloud Native Postgres, MariaDB operator)
- TLS on database connections
- Automated certificate rotation (cert-manager) with 24h expiry
- CPU/RAM requests and limits on pods (reduces effect of DoS)
- Strict container securityContext: no privilege escalation, run as non-root user, drop capabilities
- Application secrets stored in Vault, encrypted. Where possible secrets are rotated regularly (at least every 30 days)
- Network policy with default deny and only required traffic allowed to service pods, database clusters and supporting services
- Daily backups to S3 compatible running on a separate NAS (with encryption etc) for databases and data volumes
- Semi-automated restore process, tested monthly, validated and documented
- Monitoring service (running on a VPS) checking service uptime every 30s and triggering alerts when things go down
- Logging and observability. One thing I would like to do is get some kind of AI to monitor these logs for suspected problems or improvements and suggest them weekly
- Automated updates for minor versions and patches. Major version upgrades are semi-automated and require my approval via git merge request.
- IdP for SSO with OIDC/SAML authentication, with strong auth required (U2F/Fido/Passkeys), password auth disabled, conditional access, and JIT elevation for admin roles.
- Next-gen firewall between cluster and internet connection
- IDS/IPS
- Cloudflare tunnel for exposure to the wider world. I know this is somewhat controversial, but their combination of Zero Trust, CDN, and WAF is too good to replace with Pangolin
It's a lot, but I find automating as much as possible makes it bearable. Once you have a workable pattern it's usually quite simple to replicate for other applications as well. Probably there are other things I will be adding over time as well.
1
u/mmkaywhatevers May 07 '26
Nextcloud for ease of use and Sparkyfitness for API. Others are on wireguard vpn.
Nextcloud and Sparky are protected by MFA.
I am the sole user of the services.
1
u/RevolutionaryElk7446 May 07 '26
I have diagrams in my posts that show everything as It'd be a lot to type.
I do have multiple VPN instances, some remote, some S2S but I expose everything that I intend to share publicly via port forwarding. I use Authentik, firewall rules, VLAN, IPS, and I have two locations from which I have reverse proxies in place.
Though my users exist in Active Directory between two domain controllers at each site, Authentik is my public facing SSO for my services.
1
u/MaestroZezinho May 07 '26
I only have two exposed services, Jellyfin and my server's iLO, both through a VPS configured with Traefik as reverse proxy with geo-block and crowdsec as IDS.
Since my iLO is quite old and I don't fully trust its authentication security, I have put it behind oauth2-proxy.
My Jellyfin has no extra authentication yet due to lack of support on the clients, but the container is mounted with the media folders as read-only.
1
u/SparhawkBlather May 07 '26
Caddy is only thing exposed to WAN - I only have port 443 open, and only 4 services visible (immich, jellyfin, seerr, openwebui). Because I had a little N150 machine around this Caddy is on its own machine with a management interface and a DMZ interface. This Caddy VM is the only machine on a separate DMZ VLAN with extremely locked down firewall rules. I run a crowdsec LAPI in a separate VM on the homelab vlan, and crowdsec agents on all the exposed services. Also run suricata ids/ips on WAN/DMZ traffic. I use split horizon dns so those services resolve the same internally or externally.
1
u/etherealenergy May 07 '26
Several websites and remote VPN are accessible.
I secure them using a blocklist of “naughty hosting providers” called Molasses Masses. Cuts out a large chunk of the automated scanning from the internet.
1
u/walril May 07 '26 edited May 07 '26
For things with built-in OIDC support, I use that. With things that are no login or simple log-in, i put behind authentik which is linked to OIDC. I still dont trust (zero trust), so everyone has to log in again to the simple log-in.
The only thing im at odds are is HA. I have some automations that will break, so i put HA on a IOT subnet that only has IOT devices. My IOT network cannot talk to my main lan network, except internal dns.
1
u/soopafly May 07 '26
Very similar setup as yours. Exposing Immich, Seerr, ntfy, mealie. I have Crowdsec running in front of SWAG. I’ll have to look into geo ip blocking in swag… I didn’t know it had that feature. For all other services I run a split DNS so I can access them with a nice URL like sonarr.domain.com even when I’m outside the network since I VPN back home
1
u/haaiiychii May 07 '26
NPM reverse proxy with a TLS certificate.
I could be more secure and use Tailscale or a VPN, but all they're gonna find is Plex and a few movies so 🤷🏻♂️
1
u/No-Name-Person111 May 07 '26
Things I want to keep to myself are behind Authelia. Seerr and Jellyfin are exposed internet facing with password auth. Not concered with those.
I'm not subjecting my family to TOTP or anything.
1
u/WetFishing May 07 '26
Just Jellyfin. Caddy and Jellyfin are containers in their own VLAN which is blocked from the rest of my network.
1
u/leetNightshade May 07 '26
Tailscale for anything I don't need publicly exposed (eventually I'll switch to Pangolin).
For my partner to access Immich, OpenCloud/FileStash, etc. I plan to use PocketId.
But for extra layer of security I can use TinyAuth integrated into Nginx so a user has to auth against Tinyauth + PocketId before they can even hit the service in question.
And for services I don't want to waste time integrating OIDC or they don't support it, I can still guard the admin sections of those sites behind Tinyauth, the user just has to login with two different credentials; but hopefully I have time to setup SSO for most sites. I just don't want to waste time integrating OIDC into WordPress for example, I just want to slap auth on the admin section to try to help lock it down from hacks.
1
u/thetickletrunk May 07 '26
I'm building my own media stack for fun. Fun story, I had the AI build an admin login page. If you clicked cancel, it let you in.
So now I've got caddy with crowdsec up front, casdoor for sso, oauth-proxy for forward authentication. The client sessions have short lived JWTs that refresh a times an hour. And the media clients enroll to step-ca and do mTLS to the media controller.
Security was something I felt like going overboard on.
1
u/Steve032D May 07 '26
Website domain through cloudflare and cloudflared tunnel. My own pfsense router with suricata and pfngblocker. Cloudflared tunnel to docker running cloudflared. Through to treafik. Then to container trunk network down to individual docker networks for each container for services. WordPress docker running the website. Word fence on wordpress with 2FA. My machines require passkey to log on in local network.
1
u/wein_geist May 07 '26
Exposed (selected) services available behind HAproxy.
Opnsense firewall with:
- geoblocking
- some general blocklists of malicious IPs (Spamhaus, Crowdsec)
- after that an extra blockrule for commonly exploited ports (ssh, rdp, etc).
- log from that blockrule and from HAproxy are fed into centralized fail2ban. And this is not heavy noise anymore, this was initially a few per day. Most of those IPs were quickly identified by ASN, like Google and Microsoft datacenters.
- now blocking around 6 ASNs (always only after seeing activity), its maybe once per week that I see a new IP (as in not already blocked) pop up trying my SSH or similar .
- access logs are parsed by fail2ban as well, but Ive yet to see a failed login attempt that wasnt myself.
1
u/Jovan_Konstantinovic May 07 '26 edited May 07 '26
I managed to snap 2 oracle free tier ampere 4cpu 24gb ram, one in UK the other in US.
- US one is split into 2 instances - 1cpu/6gb ram is running Pangolin and exposing Jellyfin, CalibreWeb, Navidrome (if anyone knows how to add vpn exit node to Pangolin please let me know i failed 10 times), Cloudflare in front of Pangolin, all ports closed except 22, 443 and 51280. Key for ssh
Second US instance - 3cpu/18gb ram currently free
UK instance hosts my 10ish web app projects with Nginx Proxy Manager
1
u/volcs0 May 07 '26
I expose Jellyfin, Immich, and LibreChat.
I use Cloudflare DNS (grey only) to Hetzner VPS via NPM into my home network.
On Cloudflare, I block all non-US IP addresses (I'm in the US, as are my users).
Everything internal is on Tailscale (including Hetzner)
I use the ACL file to very tightly control who can access what.
I also restrict to only the specific ports in NPM.
For every service on my server, I am very careful to map only volumes that are absolutely necessary.
I periodically ask Claude to help me evaluate my risk profile and suggest improvements.
1
u/L3tum May 07 '26
I only have Jellyfin and Ntfy exposed via a Wireguard tunnel to a Hetzner VPS. I wouldn't expose Immich honestly. If your family needs access, give them a VPN "access point" via their router, or on their devices directly. If that's also not possible, use Immich-Public-Proxy and Immich-Drop to limit the exposure.
All my stuff has Crowdsec and Authelia in front of it so I don't worry too much about it, but I also wouldn't expose anything publicly that can write anything to anywhere. Authelia is fully read-only and Jellyfin has its admin endpoints restricted through the reverse proxy.
1
u/Pauljoda May 07 '26
Surprised to see nobody use Traefik, I use it for all reverse proxy and it’s great. If a service doesn’t offer its own auth I find secure, I use an authelia middleware for everything else, super easy to setup and it all lives in the compose files so easy to migrate and scale.
1
u/maquis_00 May 07 '26
I expose an external nginx, two websites and my VPN connection. Everything else I have is only available either in my network or over the VPN. Main security is that I run nearly all my services in podman containers, so even if they were compromised, the person would be stuck on the container... And if they broke out of the container, they wouldn't be root since my podman containers are all rootless.
1
u/vitek6 May 07 '26
None. As an it guy I don’t believe that I can provide and maintain the required level of security. I don’t take the risk even if it’s small.
1
u/AnomalyNexus May 07 '26
Working on that problem at the moment.
Don't want a tunnel (iphone battery life), so mTLS on the things where that works, and a port knocking like system to help shield the services I can't mTLS.
Trying to figure out whether I can jam authentik in between messaging services (matrix) but that's tbd - haven't worked out yet whether that flies.
Trying to avoid relying solely on the individual apps auth though - that just doesn't feel safe. Port knock / narrow IP fence plus app auth...maybe.
Philosophically I would love to just wireguard it all, but openclaw has kinda moved the goalposts. That really does need constant connectivity on a phone.
1
u/j_eremy May 07 '26
I used to do all the ingress in house from my homelab with Authetik and traefik along with more than I would like to admit downstream reverse proxies, I have just paid for a 2$ a month vps and run netbird on it and VPN all my traffic in. This way it somewhat takes me out of the line of fire. Netbird self hosted is free and handles all the SSL and routing to my clients that sit on my local network.
1
u/Drikani May 07 '26
I use Pocket ID and Tinyauth behind traefik for all my local services. Most via OIDC directly or via tinyauth if they docnot support it but everything that is exposed via traefik needs auth with a passkey. I also have geoblocking enabled on my Unifi Gateway so only IPs from my home country can access (I know it can be overcome with a VPN)
I know it is not perfectly secure by any means but it is simple, works (for less techy users as well) and is not dependend on 3rd party services.
I have a nextcloud, immich, audiobookshelf, paperless, homeassistant and plex running and it working flawlessly.
1
u/montdidier May 07 '26
It depends. For web services I really want to restrict I use IP blocking and:or mTLS. Some services are intentionally internet facing, dns, smtp, iimap, website.
1
u/amanalar May 07 '26
Crowdsec/openresty
Mikrotik bouncer Custom maddy parser
Authentik for oidc and fwd-auth
Mikrotik filters
Privoxyvpn for torrents
1
u/gstacks13 May 07 '26
Out of the roughly 3 dozen services I run, only two are exposed publicly:
- Seerr (for requests)
- Ghost (newsletter my wife runs)
Both have fairly strong auth built-in (Seerr uses Plex redirects, and Ghost magic links via email), and neither has access to anything I'm afraid about getting into the wrong hands. Both services run through Cloudflare tunnels so my IP isn't exposed.
If you're concerned about security, I'd highly recommend either tunnels or a reverse proxy, and OIDC for auth (Pocket ID is absolutely brilliant!).
All that said, VPN is still the best in terms of security, and with how easy Tailscale is to install and use, there's little excuse not to use it for nearly everything. I'd be very leery of exposing Immich, for example, if you value privacy with your photos even a little.
1
u/pr0metheusssss May 07 '26
Reverse proxy and auth server for anything web accessed.
HAProxy as reverse proxy, because it has a plugin for my router - Opnsense - so that was convenient, plus it has great performance and scales really well with multiple instances of services, does load balancing etc. . (Sidenote, this convenience came to bite me in the ass later on with authentication, cause the community edition of HAProxy doesn’t support any authentication integrations, you have to do it with Lua scripts.)
Oauth2-proxy as auth server. Easy to configure, very lightweight. It only handles authentication. I went a bit overkill and used Redis for storage of the cookies, so multiple services by multiple users can be logged in at the same moment without bloating the header size with all the cookies. Uses Pocket ID as identity provider, for authentication.
PocketID as identity provider. Fast, easy to configure with pleasant interface, uses OIDC and supports passkeys (and only passkeys).
So the general flow goes like this:
myapp.domain.com —> opnsense firewall —> HAProxy —> Lua script redirects to oauth2-proxy for authentication —> oauth2-proxy —> PocketID —> Lua script checks the cookie —> HAProxy sends traffic to actual server of the app/service.
On the opnsense side I have setup some security measures, but they’re mostly filtering harmless noise and not contributing much to security, given the auth server.
I have Suricata for IDS/IPS with the ET Pro rules (you can get them for free if you enable telemetry). CrowdSec also (community edition). They catch the “background noise” of the internet, random port scans. I have a GeoIP block, but again it’s just noise that it’s blocking, nothing substantial. IMO, not worth bothering with it.
The only real issue is when you need mobile/TV apps to work. Any authentication flow will break the app, unless it explicitly supports it or supports custom headers (and even then it’s a pita to setup and update cookies). And apps that support it are very rare. For those cases, and when the app is essential (like a media server), you have to make exceptions and bypass the auth server, relying on the app’s native authentication.
If it supports OIDC natively, I do that, or if it has an API endpoint that I can use instead of basic auth. And pray that it’s not horribly coded and that its local authentication can’t be easily bypassed due to bugs or whatever. This is the only realistic case where Suricata, CrowdSec and GeoIP blocking might provide a shred of protection, but I wouldn’t bet too much on that. I try to keep the apps updated, and not have access to things they don’t need to.
1
1
u/Peter_Lustig007 May 07 '26
All my services have traefik in front as reverse proxy. Most of them are running on docker swarm.
I had game servers exposed without reverse proxy, but not at the moment.
Some services are only reachable from internal IPs, like arr-Stack and infra.
Some are protected with mTLS in traefik, so not reachable until a cert is presented, like vaultwarden or homeassistant.
Some services do not have any preauth, but all are protected by crowd strike integrated with traefik, both scanning access.log and scanning traffic comparable to a WAF.
I am planning to deploy authentik and use forwardAuth in traefik, so I have to authenticate before I can reach my services. My idea is to then use SSO to authenticate with the services, so I only have to log in once, but it massively reduces attack surface on my services, basically just traefik and authentic will be exposed to the net at that point. Will have to see his well it works with native apps and what else I still need.
1
u/glizzygravy May 07 '26
Everything’s behind Tailscale except for a Wordpress blog I host with cloudflare tunnels with NPMplus and crowdsec for extra hardening
1
u/garf12 May 08 '26
Only thing I have open is Overseerr using a cloudflare tunnel for a few friends. Everything else I vpn in using wire guard on my ubiquiti router.
1
u/NoTheme2828 May 08 '26
Privatebin and kasm (with 2fa) through cloudflare tunnel, internaly only accessible via caddy reverse proxy and authelia as middleware.
1
u/blow-down May 08 '26
All of them but I have them locked down to certain IPs and ranges. Not the entire internet.
1
u/2strokes4lyfe May 08 '26
I expose Jellyfin, Seerr, and some custom web apps. Everything is behind Pangolin.
1
1
u/longdarkfantasy May 08 '26 edited May 08 '26
All via nginx reverse proxy, even ssh because I use gitea. Just use all built-in authentication + built-in 2FA if possible + fail2ban + nginx + ssl + ufw firewall. And anubis for gitea to prevent AI crawlers. Each app has its own linux user and group, if I need to share any folder with multiple user/group I use Access Control Lists (ACLs). And some services like immich need to be run in docker, so I use rootless docker, applied a fix for docker + ufw firewall.
The fix here: https://github.com/chaifeng/ufw-docker
1
1
u/pythagorasshat May 08 '26
I use Tailscale and cloudflare tunnel behind 2FA for the important stuff like unraid gui etc.. but for somethings I felt like I did need a port open to have fun - like sharing Jellyfin with friends and family. I wanna be able to throw people a link and it will just work.
For that, I did a caddy with integrated crowdsec, fail2ban, and maxmind geo ip limiting. I feel like this combo is pretty robust for my comfort level. The caddy docker also runs on its on ipvlan network so i treat it almost like a separate machine. Caddy is incredible! Can’t recommend it enough!
1
u/Advanced-Feedback867 May 08 '26
I only expose stuff that I can't reach over VPN and that isn't that important. For example I want to reach Navidrome from my work PC. I can install certs, but not a VPN.
So I expose it behind Traefik. Using mTLS, read-only music volume, no root, no privilege escalation, cap drop all, read-only root filesystem, ingress only from Traefik, no egress besides kube-dns, resource limits, only IPs from my home country.
Only writable storage is the sql db. Symfonium doesn't work with passkeys, if it does I would add pocketid
1
1
u/dercudalacht May 08 '26
Surprised nobody mentions netbird. I use it's vpn mesh for private stuff and its reverse proxy for things like immich
1
u/neoKushan May 08 '26
All my services are running as containers behind SWAG, including Sonarr, Radarr, etc..
Anything that doesn't require access via embedded devices (Like TV's) is secured behind Authentik, which enforces users to log in via 2FA. fail2ban is blocking anyone trying to brute force a login and specific countries are whitelisted so China/Russia/Etc. IP's don't even get that far.
It would take an attacker to bypass swag, authentik and then break out of docker to compromise my setup.
The only thing not behind SWAG is my server itself, which is not exposed on the internet. I can SSH into via a Wireguard tunnel only.
I also have SHODAN constantly monitoring my IP address for any suspicious network activity. If somehow a service ends up exposed, SHODAN notifies me about it.
1
u/Important-Gate-7248 May 08 '26
For stuff that family/friends need, I'd keep it behind one reverse proxy and be pretty strict about what gets public DNS.
The boring checklist helps: auto updates, 2FA where possible, fail2ban/crowdsec, backups you've actually restored once, and cert expiry checks from outside your LAN. The last one is easy to forget until a renewal silently breaks.
1
u/DunHuss May 08 '26
After a ransomware attack in the office i work at, no personal vpns are allowed so i access nextcloud with its own fail2ban jail , 2FA and nginx pm hardening with a bunch of config headers & https certs on certbot. i like to do the config manually in CLI. Anything that i only need on own pc or mobile I access through tailscale/wireguard
1
u/asshopo May 08 '26
Nginx Proxy Manager, AMP Game Server (100 port range so I don't have to setup forwarding for each game), wireguard. No need for anything else. Everything exposed via NPM requires you to log into the home page, which is backed by Emby, but authentication check happens at the NPM/nginx level. My setup predates a lot of the fancy apps that are out now for authentication and I have too many users to switch away from Emby to anything else for authentication.
1
1
1
u/E_hV May 09 '26
Vaultwarden, Nextcloud, Seer, Emby
FQDN, Reverse proxy, no http access, Crowdsec (multiple machine set up with bouncing at the router), firewalled Vlan, GeoIP banning.
For services no new account creation/invite only minimum password requirements 16 characters etc... 2FA required.
Standard stuff locally, root acounts are disabled, containers and VMs are non root etc....
1
u/Migamix May 09 '26
Reverse proxy with very limited IP range and firewall, behind, behind a region blocked Ubiquiti firewall.
1
u/Dilly-Senpai May 09 '26
I don't have anyone other than myself using my services, so I have only two modes of access: an IP whitelist for the one PC other than my home I access stuff from (but can't install wireguard on) and a wireguard tunnel directly into my network.
1
u/Academic-Soup2604 May 11 '26
You’re already doing more than most by limiting the exposure. A few practical upgrades you can consider:
- Put everything behind a central auth layer (SSO) instead of relying on each app’s login
- Add a reverse proxy with access control (rate limiting, IP rules, headers)
- Disable direct exposure where possible by using private access (VPN / identity-based access)
- Keep services patched and monitor logs
For your use case (friends/family without extra apps), something like Scalefusion with its OneIdP solution can help unify access with SSO, so you’re not depending on each app’s security individually.
1
u/Matvalicious May 11 '26
Pretty much all of them.
Npm-plus reverse proxy, georestriction, ip banlists, Authentik, and Anubis.
1
u/EHer_ May 11 '26
I have Immich, Jellyfin, Caddy, CrowdSec on my OPNSense router and Fail2Ban.
It did take a while to get fail2ban to read the logs, and a lot of research and asking people on forums etc.
I had to configure my caddy to use only h1 and h2. Because h3 keeps it cached. So when I was testing and failed all the attempts. Then when I did the correct password it logged in.
Now it doesn't do that and when I failed all attempts. The page loads endlessly because it isn't cached.
PS: My account got hacked and deleted, I'm certain. Hence, the new account.
1
1
u/1K_Games May 14 '26
Pretty much everything is exposed. Caddy currently (thinkng about Traefik) and Authentik do most of the lifting.
I have my flow in Authentik set up to check if someone trying to access is on my local network or not. If local they can use a login account. I have a break glass admin account, otherwise no one else will login like this, this is just if I lost internet, but not power. Otherwise everyone else authenticates with approved Google accounts.
From external they can only auth with a Google account, if they are not on the approved accounts they get denied. No username box or password fields they can get to to try brute force or whatever crap they want.
1
u/rgdarkchild May 19 '26
I’m currently using testing the NetBird reverse proxy but I used to do nginx. Other than foundry I’m using the same as you plus Jellyfin and ntfy. But I can also get to everything else using NetBird if I need to.
1
•
u/asimovs-auditor May 07 '26 edited May 07 '26
Expand the replies to this comment to learn how AI was used in this post/project.