Selfhosted

46321 readers

833 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
No trolling.

Resources:

selfh.st Newsletter and index of selfhosted software and apps
awesome-selfhosted software
awesome-sysadmin resources
Self-Hosted Podcast from Jupiter Broadcasting

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 2 years ago

MODERATORS

HybridSarcasm@lemmy.world

HybridSarcasm@lemmy.hybridsarcasm.xyz

If Nothing is Exposed, Am I Safe? (lemmy.dbzer0.com)

submitted 1 week ago* (last edited 1 week ago) by No_Bark@lemmy.dbzer0.com to c/selfhosted@lemmy.world

16 comments fedilink hide all child comments

Hello most excellent Selfhosted community,

I'm very new to this and am confused about how vulnerable my server and/or home network is with my current setup.

I just got a basic server up and running on a machine with proxmox and a DAS for 10tb of storage. I've got two LXCs running for a docker deployed arr stack and jellyfin+jellyseer stack. The proxmox server is connected to a router attached to a fiber ONT. Everything is accessed over the home LAN network and that's it.

Everything is working correctly and my containers are all talking to each other correctly via ip addresses (gluetun network on the arr stack container). I've been reading up on reverse proxies and tailscale to connect to the server from outside my LAN network, and it's mostly gone over my head, but it did make me concerned about my network security.

Is my current set up secure, assuming strong passwords were used for everything? I think it is for my current uses - but I could use a sanity check, I'm tired. I'm open to any suggestions or advice.

I own a domain that I don't use for anything, so it would be cool to get reverse proxy working, but my attempts so far have failed and I learned I'm behind a double NAT (ONT and router) - and attempts to bypass that by setting the ONT into bridge mode have also failed. I don't really need to access anything from outside my home network right now - but I would like to in the future.

you are viewing a single comment's thread
view the rest of the comments

[–] Vinny_93@lemmy.world 2 points 1 week ago (1 children)

You can run nginx in a docker container and define reverse proxies there. That will only require your to open up 443 in your router if you use SSL (which I highly recommend and is simple with Let's Encrypt)

Then I'd recommend connecting to your arrs and torrent client in Nzb360 paid edition to manage everything in there.

As far as safety, well nothing is bulletproof. If they want to get in, they will. Best thing I can recommend is to run your arrs / indexers through a different IP address than your torrent client. But if they want to find you, they'll find you. Thing is they probably won't come after you if your ISP doesn't report you uploading terabytes a day. SSL helps and keeping your arrs behind complex passwords (use a password manager) will keep the server itself relatively safe.

Unless of course, ISPs in your country suddenly start to crack down on illegal downloading hard.

[–] kat@orbi.camp 9 points 1 week ago (1 children)

Why open a port when you can do tailscale/vpn or tunnel.

[–] ChapulinColorado@lemmy.world 1 points 1 week ago* (last edited 1 week ago)

Not to mention that some providers offer APIs to provide certificates without opening port(s) 80/443. This allows using nice host names on your personal domain with valid SSL over the internal network too. Want to migrate a server or service? Just change the IP associated with the domain on the internal DNS. Makes migrating and upgrading a lot easier.