a_fancy_kiwi

joined 2 years ago
sorted by: new top controversial old
*Permanently Deleted* in c/technology@lemmy.world
[–] a_fancy_kiwi@lemmy.world 8 points 3 months ago

To go along with that, Telegram doesn't make it easy to set up an encrypted chat. First, you have to set up a regular chat, then tap on the profile image of the person you are messaging, then tap the 3 dot menu, and finally tap "secret chat". It's there but they clearly don't want people using it.

Linux Prepper - Where to Begin (selfhosting services) FOSS podcast in c/selfhosted@lemmy.world
[–] a_fancy_kiwi@lemmy.world 1 points 4 months ago (1 children)

I'll DM you in a bit but real quick I just wanted to say I thought you improved in this episode. Great work

How do you all handle security and monitoring for your publicly accessible services? in c/selfhosted@lemmy.world
[–] a_fancy_kiwi@lemmy.world 4 points 4 months ago (1 children)

has some basic monitoring on them.

What monitoring software are you using?

I feel like the other measures you talked about (backups, condom of network traffic, etc) I'm doing ok on. Its really just the monitoring where I'm stuck. There's so many options

How do you all handle security and monitoring for your publicly accessible services? in c/selfhosted@lemmy.world
[–] a_fancy_kiwi@lemmy.world 2 points 4 months ago

I'll look into it, thank you

How do you all handle security and monitoring for your publicly accessible services? in c/selfhosted@lemmy.world
[–] a_fancy_kiwi@lemmy.world 1 points 4 months ago

I've seen a bunch of people recommend Authelia. Do you mind if I ask why you went with it over other software? I only went with authentik because I found a tutorial on it first

How do you all handle security and monitoring for your publicly accessible services? in c/selfhosted@lemmy.world
[–] a_fancy_kiwi@lemmy.world 4 points 4 months ago (1 children)

  1. check

  2. check

  3. check

  4. I saw someone else recommend crowdsec. I'll look into it, thanks

if you use one of those 5$/month VPSes, with a VPN tunnel to your backend services, that adds one layer of “if it’s compromised, they’re not in your house”.

I've heard this mentioned before but I don't really understand how this works in practice. If the VPS was compromised, couldn't they use the VPN to then connect to my home?

How do you all handle security and monitoring for your publicly accessible services? in c/selfhosted@lemmy.world
[–] a_fancy_kiwi@lemmy.world 1 points 4 months ago (1 children)

Caddy only allows private IP ranges

Do you mind telling me more about this? How does that work; a VPN?

How do you all handle security and monitoring for your publicly accessible services? in c/selfhosted@lemmy.world
[–] a_fancy_kiwi@lemmy.world 3 points 4 months ago

will do, thanks

How do you all handle security and monitoring for your publicly accessible services? in c/selfhosted@lemmy.world
[–] a_fancy_kiwi@lemmy.world 5 points 4 months ago* (last edited 4 months ago) (1 children)

If it were only me using the apps, I'd be using a VPN. Over the years, I've used OpenVPN, Wireguard, and now Tailscale. In my experience, they work like 99% of the time. That last 1% though is weird connection issues; usually when switching between WiFi and cellular (or vice versa) but sometimes it's my server or ISP and I have to turn the VPN off and back on to troubleshoot. During those rare times, my partner will either turn off the VPN and forget to turn it back on or they will forget about the VPN completely and not be able to use their phone. Ideally, I'd like to set something up that doesn't require any potential troubleshooting on their part so I can avoid hearing "why can't we just use Google photos?" or "what's wrong with Google home?" 😓

How do you all handle security and monitoring for your publicly accessible services? in c/selfhosted@lemmy.world
[–] a_fancy_kiwi@lemmy.world 2 points 4 months ago

that's awesome. thanks!

How do you all handle security and monitoring for your publicly accessible services? in c/selfhosted@lemmy.world
[–] a_fancy_kiwi@lemmy.world 2 points 4 months ago (1 children)

oh, my mistake. tbh, I don't know enough about it but I'm interested. Why set up a TLS cert for AI at home? How is that benefiting you and your setup?

I've seen some people set up SSL certs for self hosted services and not make them publicly available but I didn't get around to seeing why they were doing it

How do you all handle security and monitoring for your publicly accessible services? in c/selfhosted@lemmy.world
[–] a_fancy_kiwi@lemmy.world 3 points 4 months ago (2 children)

Have also set it up so they get banned on Cloudflare’s side, so before another malicious request ever reaches me.

How did you end up setting that up?

125
How do you all handle security and monitoring for your publicly accessible services? (lemmy.world)
submitted 4 months ago* (last edited 4 months ago) by a_fancy_kiwi@lemmy.world to c/selfhosted@lemmy.world
70 comments fedilink
 

This is a continuation of my other post

I now have homeassistant, immich, and authentik docker containers exposed to the open internet. Homeassistant has built in 2FA and authentik is being used as the authentication for immich which supports 2FA. I went ahead and blocked connections from every country except for my own via cloudlfare (I'm aware this does almost nothing but I feel better about it).

At the moment, if my machine became compromised, I wouldn't know. How do I monitor these docker containers? What's a good way to block IPs based on failed login attempts? Is there a tool that could alert me if my machine was compromised? Any recommendations?

EDIT: Oh, and if you have any recommendations for settings I should change in the cloudflare dashboard, that would be great too; there's a ton of options in there and a lot of them are defaulted to "off"

85
How do you handle SSL certs and internet access in your setup? (lemmy.world)
submitted 5 months ago* (last edited 4 months ago) by a_fancy_kiwi@lemmy.world to c/selfhosted@lemmy.world
89 comments fedilink
 

tldr: I'd like to set up a reverse proxy with a domain and an SSL cert so my partner and I can access a few selfhosted services on the internet but I'm not sure what the best/safest way to do it is. Asking my partner to use tailscale or wireguard is asking too much unfortunately. I was curious to know what you all recommend.

I have some services running on my LAN that I currently access via tailscale. Some of these services would see some benefit from being accessible on the internet (ex. Immich sharing via a link, switching over from Plex to Jellyfin without requiring my family to learn how to use a VPN, homeassistant voice stuff, etc.) but I'm kind of unsure what the best approach is. Hosting services on the internet has risk and I'd like to reduce that risk as much as possible.

  1. I know a reverse proxy would be beneficial here so I can put all the services on one box and access them via subdomains but where should I host that proxy? On my LAN using a dynamic DNS service? In the cloud? If in the cloud, should I avoid a plan where you share cpu resources with other users and get a dedicated box?

  2. Should I purchase a memorable domain or a domain with a random string of characters so no one could reasonably guess it? Does it matter?

  3. What's the best way to geo-restrict access? Fail2ban? Realistically, the only people that I might give access to live within a couple hundred miles of me.

  4. Any other tips or info you care to share would be greatly appreciated.

  5. Feel free to talk me out of it as well.

EDIT:

If anyone comes across this and is interested, this is what I ended up going with. It took an evening to set all this up and was surprisingly easy.

  • domain from namecheap
  • cloudflare to handle DNS
  • Nginx Proxy Manager for reverse proxy (seemed easier than Traefik and I didn't get around to looking at Caddy)
  • Cloudflare-ddns docker container to update my A records in cloudflare
  • authentik for 2 factor authentication on my immich server
0
Help with understanding throughput of pcie and hard drives (lemmy.world)
submitted 2 years ago* (last edited 2 years ago) by a_fancy_kiwi@lemmy.world to c/selfhosted@lemmy.world
3 comments fedilink
 

I've been interested in building a DIY NAS out of an SBC for a while now. Not as my main NAS but as a backup I can store offsite at a friend or relative's house. I know any old x86 box will probably do better, this project is just for the fun of it.

The Orange Pi 5 looks pretty decent with its RK3588 chip and M.2 PCIe 3.0 x4 connector. I've seen some adapters that can turn that M.2 slot into a few SATA ports or even a full x16 slot which might let me use an HBA.

Anyway, my question is, assuming the CPU isn't a bottle neck, how do I figure out what kind of throughput this setup could theoretically give me?

After a few google searches:

  • PCIe Gen 3 x4 should give me 4 GB/s throughput
  • that M.2 to SATA adapter claims 6 ~~GB/s~~ Gb/s throughput
  • a single 7200rpm hard drive should give about 80-160MB/s throughput

My guess is that ultimately, I'm limited by that 4GB/s throughput on the PCIe Gen 3 x4 slot but since I'm using hard drives, I'd never get close to saturating that bandwidth. Even if I was using 4 hard drives in a RAID 0 config (which I wouldn't do), I still wouldn't come close. Am I understanding that correctly; is it really that simple?

view more: next ›