this post was submitted on 12 Jul 2023
1 points (100.0% liked)

Selfhosted

40041 readers
647 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

  1. Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.

  2. No spam posting.

  3. Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.

  4. Don't duplicate the full text of your blog or github here. Just post the link for folks to click.

  5. Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).

  6. No trolling.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 1 year ago
MODERATORS
ruud@lemmy.world
Loki@lemmy.world
CannaVet@lemmy.world
devve@lemmy.world
HybridSarcasm@lemmy.world
HybridSarcasm@lemmy.hybridsarcasm.xyz
1
Is it considered bad practice to expose selfhosted services on public internet? (lemmy.world)
submitted 1 year ago by OmltCat@lemmy.world to c/selfhosted@lemmy.world
3 comments fedilink hide all child comments
 

I see a lot of people here uses some form of remote access tool (VPN/Tailscale) to access their home network when not at home. I can’t really do this because my phone (iOS) can only activate one VPN profile at a time, and I often need this for other stuff.

So I chose to expose most web based services on the public internet, behind Authelia. But I don’t know how safe this is.

What I’m really unsure are things like Vaultwarden: while the web interface is protected by Authelia (even use 2FA), its API address needs to be bypassed for direct access, otherwise the mobile APP won’t work. It feels like this is negative everything I’ve done so far.

all 5 comments
sorted by: hot top controversial new old
[–] cyberpunk007@lemmy.world 1 points 1 year ago

I'm a network engineer and >15 years of experience in IT. It's never "safe". Not even in corporate IT. You're a home user and it's less likely you'll be targeted but bad actors do comb the internet for known vulnerabilities. Patch your shit, limit exposure, enable MFA on everything. I don't run it, but I feel slightly sketched out not behind something like a Palo Alto. But again I'm just a small potato in a big sea and I patch everything.

There will always be risk. Just do what feels right for you. Follow beat practices.

[–] banditoitaliano@lemmy.world 1 points 1 year ago

It’s only bad practice if you don’t keep up on vulnerabilities/patching, don’t have any type of monitoring or ability to detect a potential breach, etc.

The nice thing about tucking everything behind a VPN is you only have one attack surface to really worry about.

[–] RunningInRVA@lemmy.world 1 points 1 year ago

I use a reverse proxy and client certificate authentication for anything I expose. That requires me to pre install the client certificate on all of my devices first, but afterwards they can connect freely via a web browser with no further prompting to authenticate. Anybody without the client certificate gets a 403 before they even get past the proxy.

There are limitations to this and overhead of managing a CA and the client certificates for your devices.