this post was submitted on 29 Jan 2024
100 points (97.2% liked)

Piracy: ꜱᴀɪʟ ᴛʜᴇ ʜɪɢʜ ꜱᴇᴀꜱ

54758 readers
222 users here now

⚓ Dedicated to the discussion of digital piracy, including ethical problems and legal advancements.

Rules • Full Version

1. Posts must be related to the discussion of digital piracy

2. Don't request invites, trade, sell, or self-promote

3. Don't request or link to specific pirated titles, including DMs

4. Don't submit low-quality posts, be entitled, or harass others

Loot, Pillage, & Plunder

📜 c/Piracy Wiki (Community Edition):

💰 Please help cover server costs.

Ko-Fi Liberapay
Ko-fi Liberapay

founded 1 year ago
MODERATORS
db0@lemmy.dbzer0.com
sunbrothersco@lemmy.dbzer0.com
dataprolet@lemmy.dbzer0.com
Flatworm7591@lemmy.dbzer0.com
RandomLegend@lemmy.dbzer0.com
100
Random requests to my private Jellyfin instance (lemm.ee)
submitted 10 months ago by nolight@lemm.ee to c/piracy@lemmy.dbzer0.com
30 comments fedilink hide all child comments
 

I have a Jellyfin instance on my local server which I forward to the public web via a cloudflare tunnel. I'm not sure how secure it is, and I keep getting random requests from all over the world. It's my first experience maintaining something on a public domain so I may be worrying about something obvious, but some advice would still be appreciated.

My SSL/TLS encryption mode appears to be "Full".

you are viewing a single comment's thread
view the rest of the comments
[–] Dempf@lemmy.zip 8 points 10 months ago

VPN drains my phone battery like crazy, plus eventually I'd like to be able to share my services with some less technical people, and want to keep the barrier to entry low for them, so I've been looking at what I'd want in order to be comfortable exposing services publicly.

Services are running on Truenas Scale (k3s).

What I've been thinking is:

  1. Isolate services' network access to each other and to my local network.
  2. Reverse proxy in front of all services (probably Caddy)
  3. Coraza as a WAF
  4. Crowdsec Caddy module
  5. Some sort of auth layer in the proxy, like oauth2-proxy (kind of tricky because not every service would work well with this, especially without client support). Probably would start with a 3rd party identity provider rather than rolling my own, especially since 3rd party will probably do a lot more monitoring around logins, patterns, etc.

Thinking of hosting the reverse proxy piece on a VPS. Probably not completely necessary because I don't think hiding my home IP really buys me much security, but Caddy might be easier to configure on the VPS compared to Truenas (though I guess I could run it in a VM on Truenas).

Each app could run a wireguard sidecar to connect it to the VPS.

Curious what others think about this setup, or if the recommendation is still to keep things behind a VPN.