Selfhosted

40347 readers

351 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
No trolling.

Resources:

selfh.st Newsletter and index of selfhosted software and apps
awesome-selfhosted software
awesome-sysadmin resources
Self-Hosted Podcast from Jupiter Broadcasting

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 1 year ago

MODERATORS

HybridSarcasm@lemmy.world

HybridSarcasm@lemmy.hybridsarcasm.xyz

The "safest" way of self hosting (self.selfhosted)

submitted 10 months ago by Nester to c/selfhosted@lemmy.world

33 comments fedilink hide all child comments

Hello peoples,

I am looking for tips on how to make my self-hosted setup as safe as possible.

Some background: I started self-hosting some services about a year ago, using an old lenovo thin client. It's plenty powerful for what I'm asking it to do, and it's not too loud. Hardware wise I am not expecting to change things up any time soon.

I am not expecting anyone to take the time to baby me through the process, I will be more than happy with some links to good articles and the like. My main problem is that there's so much information out there, I just don't know where to start or what to trust.

Anyways, thank you for reading.

you are viewing a single comment's thread
view the rest of the comments

[–] naeap@sopuli.xyz 4 points 10 months ago (1 children)

I've setup wireguard, because it's only me and an employee using the services. But with that, externally I don't even seem to have a port open. But wireguard is so fast to be online, that I'm just always connected as soon as I'm online - using a domain and an IP update script

[–] BearOfaTime@lemm.ee 3 points 10 months ago (2 children)

Something like Wireguard, Tailscale (uses Wireguard but provides easier administration), Reverse Proxy, VPN, are the best approaches.

Since OP doesn't need for anyone else to access, I'd use Tailscale (Wireguard if you want a little more effort). Tailscale has a full self-host option with Headscale, though I have no problem with letting them provide discovery.

With Tailscale, you don't even need the client on devices to access your Tailscale network, by enabling the Funnel feature. This does something similar to Reverse Proxy, by having a Web-exposed service hosted by Tailscale which then routes traffic (encrypted) to your Tailscale network.

[–] naeap@sopuli.xyz 1 points 10 months ago

Yeah, but then I've a web exposed service and I want keep a low profile as possible with what I'm exposing. So I guess as long as there aren't many users to manage, wireguard (or a tailscale configuration) could work out for OP

[–] ULS@lemmy.ml 1 points 10 months ago (1 children)

Is the funnel feature free?

[–] BearOfaTime@lemm.ee 2 points 9 months ago (1 children)

As far as I can tell.

I assume that will eventually change as people start using it. Especially if they run data intensive stuff over it.

If I were to want to share video, I'd probably use a VPS as my own Tailscale/Wireguard Funnel. Or use some high performance VPN between the VPS and my media server.

[–] ULS@lemmy.ml 1 points 9 months ago

I saw the feature. Seems a bit over my head... Or at least I'm too lazy to figure it out.... Cool it's there though.