Maybe I’m using the wrong terms, but what I’m wondering is if people are running services at home that they’ve made accessible from the internet. I.e. not open to the public, only so that they can use their own services from anywhere.

I’m paranoid a f when it comes to our home server, and even as a fairly experienced Linux user and programmer I don’t trust myself when it comes to computer security. However, it would be very convenient if my wife and I could access our self-hosted services when away from home. Or perhaps even make an album public and share a link with a few friends (e.g. Nextcloud, but I haven’t set that up yet).

Currently all our services run in docker containers, with separate user accounts, but I wouldn’t trust that to be 100% safe. Is there some kind of idiot proof way to expose one of the services to the internet without risking the integrity of the whole server in case it somehow gets compromised?

How are the rest of you reasoning about security? Renting a VPS for anything exposed? Using some kind of VPN to connect your phones to home network? Would you trust something like Nextcloud over HTTPS to never get hacked?

  • droidpenguin@lemmy.worldEnglish
    2·
    1 year ago

    Ya my paranoia only allows me to expose Wireguard to access everything. I sleep better at night knowing that’s the only thing exposed. Too many instances of major companies getting hacked who have dedicated security teams to manage that. I am one person, learning to manage my own stuff in my free time.

  • somedaysoon@lemmy.worldEnglish
    1·
    1 year ago

    Unless you need to share/provide services for a public, then you shouldn’t be setting up reverse proxies or cloudflare tunnels in my opinion. All you need is WireGuard for you and the handful of users that might be using it.

    I have two ports open for:

    1. WireGuard

    2. SSH Tunnel

    Both of these services will only accept key based authentication.

    WireGuard is the main way that my wife and me access the services away from home. When our phones disconnect from our home’s SSID, Tasker automatically connects to the WireGuard tunnel so we never lose access to services.

    The SSH tunnel is just a fallback in case I get behind a firewall that might be doing DPI and blocking VPN traffic. The SSH tunnel operates on 443 to hopefully appear to be SSL traffic and allowed through. I’ve used it a very limited amount of times to get out from strict corporate firewalls.