• zenforyen@feddit.orgEnglish
    3·
    2 hours ago

    Nothing to protect if you don’t expose it.

    Plain and simple - Wireguard.

    All services run as separate services user in rootless podman containers.

    Only one nginx exposed to the open internet acting as reverse proxy to stuff where Wireguard requirement would be too inconvenient to be useful (shared calendar).

  • Tiger_Man_@szmer.infoEnglish
    2·
    3 hours ago

    i try to keep it secure by minimalism because the less complicated is the software the smaller is the chance of a vulnerability

    so everything related to file transfer/access uses sftp (with accounts with no ssh permissions because: 1. i dont want the password to my server to be stored anywhere in some sftp software 2. im not the only user of this server) and for other services i just run a small local program and remote access it with ssh

    i guess the biggest secuity threat is someone physically stealing the backup disk or the main hard drive because theyre both unencrypted

  • tired_n_bored@lemmy.worldEnglish
    1·
    6 hours ago

    I have 3 subnets. One for me, one for family members and one for the publicly accessible services I expose. Each process has limited access to the file system, no root shell and even in the case someone gains full control of it they can’t reach other subnets. I use fail2ban too.

    For the “me” part, I connect through a VPN. I’d like to run rootless docker services tho, or by using Podman

  • curbstickle_lw@lemmy.worldMEnglish
    5·
    10 hours ago

    Secure enough I suppose.

    f2b at the FW, auth with MFA for anything exposed, anything local only has restricted access at the FW level, with exposed (via proxy) and local-only (separate proxy) on different vlans. Each service is (typically, with some exceptions) an LXC, with additional rules and templated out based on use case. The few cases where docker is involved is local-only and that has its own vlan with additional rules.

      • fleem@piefed.zeromedia.vipEnglish
        7·
        11 hours ago

        like HOW ANNOYING is that shit these days? it is crazy how irked i get having to bring a monitor and keyboard over to the rack

        • Tiger_Man_@szmer.infoEnglish
          2·
          3 hours ago

          my only physical console option is composite video (its an rpi) connected to a crt (luckily the server is close to the crt so i dont have to move 16kg of leaded glass every time i want gui server access)

  • grue@lemmy.worldEnglish
    54·
    22 hours ago

    My stuff is only accessible from my LAN (because I haven’t figured out how to set up a tunnel or reverse proxy yet).

    • zebidiah@lemmy.caEnglish
      4·
      10 hours ago

      I’m in this boat too, my security is awful, bad practices everywhere, my solution: don’t let it go out in public…

      • Solrac@lemmy.worldEnglish
        52·
        7 hours ago

        Screw Tailscale, ZeroTier and specially cloudflare, all centralized, all with changable terms.

        Use a VPS, lowest spec but good bandwidth, and use Wireguard VPN for your VPS and homeserver, and nginx or caddy to make a Reverse Proxy

        • reddit_sux@lemmy.worldEnglish
          3·
          6 hours ago

          All agreed but not every homelabber can spend money for something that is not the main job or contributed to work. Tailscale for now works well enough for free.

          Cloudflare agreed is not something I would trust.

          • seang96@spgrn.comEnglish
            1·
            1 hour ago

            You can get some pretty cheap ones like sub $10/year. My current ones 2 cpu 3.5gb ram 64gb ssd for $33 a year.

      • grue@lemmy.worldEnglish
        4·
        9 hours ago

        I’ve tried to use ZeroTier because Tailscale still has centralized servers for starting the connection, but had trouble getting it to work. Maybe I should stop letting the perfect be the enemy of the good.

        • lemmyvore@feddit.nlEnglish
          2·
          6 hours ago

          If you have good IPv6 connectivity both at home and away you can look into the Yggdrasil network. It facilitates node-to-node encrypted communications, but it’s decentralized and community-run. Unlike Tailscale, each node can do both communication and relay.

          You run the Y client on each device you want to use and if you want to keep things completely private (and you have at least one device that’s not behind CGNAT) you can only add your own devices as peers. If you need to bypass CGNAT you can use one of the community-supplied nodes to act as relays, or set up your own node on a VPS.

          The cool feature of Y is that if you’re trying to communicate between nodes A and B and there isn’t a single node that’s peered with both A and B, you can still communicate as long as there are nodes somewhere in the network that know them both. The network will search for you and calculate the optimal relay path. Ofc like I said this is irrelevant if you decide to stick to your own devices, basically you will have your own personal mini Y network completely separate from the main public network.

          Even when using the public network there’s no privacy issue, relay nodes cannot snoop on communications only facilitate the connection or not, and once relay to a node has been accomplished the nodes will communicate directly thanks to ICE+STUN, if possible, like Tailscale does.

          Please note that nodes are identified by 2001:: random addresses. While the 2001:: address space is huge it’s still only obscurity not security. You still need to have a decent firewall setup on each node, Y does not enforce ACLs or anything like that. It’s also up to you to set up DNS and anything else you might need.

  • Oha@lemmy.pobierz.net
    11·
    18 hours ago

    Every Service is in its own VM and everything thats publicly accessible sits in its own network sepperated from everything else. I do daily backups in case anything goes wrong