Hello peoples,

I am looking for tips on how to make my self-hosted setup as safe as possible.

Some background: I started self-hosting some services about a year ago, using an old lenovo thin client. It’s plenty powerful for what I’m asking it to do, and it’s not too loud. Hardware wise I am not expecting to change things up any time soon.

I am not expecting anyone to take the time to baby me through the process, I will be more than happy with some links to good articles and the like. My main problem is that there’s so much information out there, I just don’t know where to start or what to trust.

Anyways, thank you for reading.

N

  • naeap@sopuli.xyzEnglish
    4·
    9 months ago

    I’ve setup wireguard, because it’s only me and an employee using the services. But with that, externally I don’t even seem to have a port open. But wireguard is so fast to be online, that I’m just always connected as soon as I’m online - using a domain and an IP update script

    • BearOfaTime@lemm.eeEnglish
      3·
      9 months ago

      Something like Wireguard, Tailscale (uses Wireguard but provides easier administration), Reverse Proxy, VPN, are the best approaches.

      Since OP doesn’t need for anyone else to access, I’d use Tailscale (Wireguard if you want a little more effort). Tailscale has a full self-host option with Headscale, though I have no problem with letting them provide discovery.

      With Tailscale, you don’t even need the client on devices to access your Tailscale network, by enabling the Funnel feature. This does something similar to Reverse Proxy, by having a Web-exposed service hosted by Tailscale which then routes traffic (encrypted) to your Tailscale network.

      • naeap@sopuli.xyzEnglish
        1·
        9 months ago

        Yeah, but then I’ve a web exposed service and I want keep a low profile as possible with what I’m exposing. So I guess as long as there aren’t many users to manage, wireguard (or a tailscale configuration) could work out for OP

        • BearOfaTime@lemm.eeEnglish
          2·
          9 months ago

          As far as I can tell.

          I assume that will eventually change as people start using it. Especially if they run data intensive stuff over it.

          If I were to want to share video, I’d probably use a VPS as my own Tailscale/Wireguard Funnel. Or use some high performance VPN between the VPS and my media server.

          • ULS@lemmy.mlEnglish
            1·
            9 months ago

            I saw the feature. Seems a bit over my head… Or at least I’m too lazy to figure it out… Cool it’s there though.