8 ms·

> Since my PKMS is hosted online to manage notes across devices, I have multiple layers of security to ensure my notes are kept private. {Screenshot of a login

> Since my PKMS is hosted online to manage notes across devices, I have multiple layers of security to ensure my notes are kept private. {Screenshot of a login form} The biggest life hack I can recommend for a self hoster is to set up a VPN on your local network and then just never expose your services on the public internet unless you're specifically trying to serve people outside your own household. Before I did this I was constantly worried about the security implications of each app I thought about installing or creating. Now it's not even worth setting up auth on a lot of simple services I build because if someone is able to hit their endpoints I'm already in deep trouble for many other reasons.

williamsss 1y ago
Good point. I also use my PKMS as a CMS for my blog. Might just split out the services and go this route.
sabellito 1y ago
For single page web apps I use pagecrypt [0] and just publish the html file (with inline scripts and styles) as public files. [0] https://pagecrypt.maxlaumeister.com https://pagecrypt.maxlaumeister.com
rafram 1y ago
The downside is that if you’re on a two-week vacation and your home network/server goes down on day two, there’s probably nothing you can do until you get home. If it’s hosted online, you can count on that 99.99…% uptime and SSH access no matter what.
- jauntywundrkind 1y ago
  Ssh exposed on a non-standard port, with root disabled, using key-based auth should be pretty non-controversial. The security through obscurity (non-standard port, no root) are both kinda silly but why not. That said, with awesome services like TailScale, it's pretty hard to get locked out of your network. TailScale is so so good at "just working".
  - accrual 1y ago
    Fail2ban or rate-limiting SSH into a block table are useful layers to have as well.
  - batch12 1y ago
    > The security through obscurity (non-standard port, no root) are both kinda silly but why not I think these are decent controls when layered with others. The effectiveness differs depending on your threat models, of course, but at the very least it helps reduce the noise seen from most automated scans reducing the effort involved in monitoring your assets.
  - cyberax 1y ago
    Another option is port knocking. Super easy to set up and with 4 knocks it provides 64 bits of randomness.
  - radlad 1y ago
    Disabling root provides more than security-through-obscurity if your sudo config requires a password to elevate: it essentially means you need both your SSH private key and your password to gain root.
- vhanda 1y ago
  I think what they meant is that if it's hosted online / home-network, only allow access to all services through a VPN. Wireguard is relatively easy to setup, and you can configure all your services to only be available through wireguard. Ever since ssh almost got backdoor-ed, the only thing "exposed" on my servers is Wireguard, which is UDP based and therefore harder to know if it's running. SSH also goes over wireguard.
  - blooalien 1y ago
    > ... Wireguard, which is UDP based and therefore harder to know if it's running. Isn't it basically impossible to know if it's running unless you have an authorize key? I thought it didn't respond at all unless you ping a valid entry key off it.
    - vhanda 1y ago
      Well, there is packet inspection. My ISP / Government will know.
- Zambyte 1y ago
  These solutions are composable. Just run it on a VPS over a VPN.
  - rafram 1y ago
    That’s a good point.
  - bloqs 1y ago
    But what if your home hypervisor goes down?
    - Zambyte 1y ago
      Nothing. You probably though I said "VPN over a VPS", which would just be the same as a VPN, which isn't composing the solutions.
      - akerl_ 1y ago
        You're suggesting to use a VPS in a thread that's specifically about self-hosting on a home network, and about there being cons to that compared to hosting on a cloud/VPS platform. So you're sort of driving parallel to the existing commentary.
        Zambyte 1y ago
        The parent comment to mine did that.
    - shellwizard 1y ago
      If you trust someone in your neighborhood/family, you can ask them to power cycle your host and water your plants
- accrual 1y ago
  Although not perfect, I added a couple features to help ensure uptime: * LAN components are on a UPS, helps keep continuity between power blips and breaker flips * Dynamic DNS, cron runs a script 4x per day to ensure a DNS name points to my IP, even if issued a new one by the ISP * Rebooting everything occasionally to ensure the network and services come back up on their own and I didn't make a mistake with some config that loads at boot, etc.
  - dpkirchner 1y ago
    I run Tailscale on an Apple TV which is on a UPS. The thing uses very little power so the UPS lasts a long, long time.
    - rasen58 1y ago
      Do you have to hack the Apple TV to run tailscale on it or how does that work?
      - dpkirchner 1y ago
        There's an official tvOS app and you just have to configure the Apple TV to be an exit node. It doesn't require any special setup otherwise.
- sammyteee 1y ago
  You can also enjoy your vacation instead :)
brightball 1y ago
Tailscale is actually great for this if you configure an exit node on a device in your home.
- walthamstow 1y ago
  It doesn't need to be an exit node unless you want to direct all traffic through that node, like a traditional VPN. The beauty of Tailscale is that it will only direct traffic to a node that is meant for that node, everything else goes via the internet.
SahAssar 1y ago
So you've managed to unlearn the last decade of security learnings in regards to zero-trust and similar concepts?
- xboxnolifes 1y ago
  You need to understand your own risk tolerance and, more importantly, effort/resource threshold. Zero-trust is great if you have the resources to put to it, and companies should do it. But individuals trying to manage multiple companies worth of services, alone, on their own network? There's going to be corners cut.
- caconym_ 1y ago
  That's a comically uncharitable extrapolation on what was said.
- sigmonsays 1y ago
  self hosting is entirely different than enterprise security practices. You're a little out of touch with reality if you don't realize this.
- lolinder 1y ago
  I'm not running a business, I'm running a home. The threat models are totally different and I adjust my security posture accordingly. Besides, I don't bother with auth for simple services, not stuff that actually hosts data. If someone unauthorized is inside my network they're not going to be interested in using my TTS/STT service or in finding out the last barcode I scanned or in using my tiny consumer GPU to generate tokens on an LLM—there are way worse things they could be doing at that point than fiddling with the many tiny services I have set up. Also: I couldn't set up so many silly, inconsequential services if I didn't have a VPN. With my setup, every new idea I have can be a quick service on my network accessible by me anywhere in the world. If I had to expose each of these things to the internet I wouldn't bother running them at all lest they have an exploit that ends up being an entrypoint into my network.
- dns_snek 1y ago
  I'm being serious - please educate us, how do you think that we can do better in a homelab setting? How do you apply zero-trust principles in homelab environment with reasonable effort and without relying on 3rd party services?
caconym_ 1y ago
+1. I have Wireguard set up on all my mobile devices and configured to automatically start when connecting to any wifi that isn't mine, so I can take my devices anywhere and I'm still on my home LAN. It works seamlessly and flawlessly. I self-host a lot of services, and without Wireguard (or equivalent), remote access just wouldn't be realistic.
- thepill 1y ago
  On Android devices? If so: how? :)
  - viraptor 1y ago
    I don't use it with wireguard, but Zerotier works just fine on Android.
    - Jarwain 1y ago
      As does tailscale!
      - ParetoOptimal 1y ago
        Or headscale: https://headscale.net/stable/ https://headscale.net/stable/
        _heimdall 1y ago
        This is my recommendation for anyone that wants full control. I use Tailscale, purely out of laziness and a willingness to trust them today, but I'd move to head scale if either of those caveats changed.
      - fluidcruft 1y ago
        My only issue with wireguard/tailscale is that somehow my work IT has managed to make it unusable on our wifi. It's really annoying. I'm pretty sure it's a misconfiguration on their end but they don't have any reason to care. OpenVPN does seem to always work everywhere (presumably because outside contractors and support personnel use OpenVPN when onsite so it's a squeaky wheel that matters) so I've moved to that instead. Beyond that I can't figure out what the hell is the problem and the way IT works, they have no reason to fix it. I did get them to somewhat work on it by reporting Google VPN as randomly failing, but they just fixed Google VPN and nothing more than that. So anyway wireguard is great until you encounter bullshit corporate firewalls.
justsomehnguy 1y ago
welcome to the world when not TailScale, not a private WireGuard, not aL2TP, OpenVPN works. No, SSTP doesn't too. HTTPS works. Even on the devices you don't or can't control.
chris12321 1y ago
You can also set up DNS records pointing to your home server's VPN IP, which, with Tailscale, I've found to be pretty static and then a reverse proxy on your home server. So I have my home network apps running on app1.my-domiain.com app2.my-domain.com, app3.my-domain.com etc, which only work when I'm connected to the VPN. The downsides are that I need to be connected to the VPN at home to use the domain and I currently don't have SSL set up on the domains, so browsers complain when I connect to them. The second problem I could fix, but I'm not sure if there's a solution for the first.
- sebws 1y ago
  You can fix them both in one. In your local network you host a local DNS, in my case I’m using pihole. It has records which point to the local IP of a reverse proxy. With this setup you can have SSL for your domain names on your local network. To make it then work outside your local network, in tailscale settings you use “split dns” to set your DNS to be the IP of your pihole in the tailnet for your domain. Now when you try hit your local domains you should receive the same local IPs that you do at home. Then in the tailscale route settings of your machine hosting the reverse proxy you make it advertise the subnet of those local IPs. Now when you receive the local IPs your devices using the tailscale VPN should go to your home server with SSL and no external DNS. Hope that’s somewhat clear enough
- mynegation 1y ago
  There is a solution for the first. I have setup my home server torun Tailscale _and_ be a router to 192.168.2.x network (you can set this up in the Tailscale UI). I have server.mydomain.com to resolve to 192.168.2.x address and this way I can access it from the outside via Tailscale and from inside without the need to turn on Tailscale. I have https setup via DNS-01 challenge as well and updated automatically.
8fingerlouie 1y ago
The internet is not a friendly place, so a VPN is a great idea. With modern tools like Wireguard, you can even set it up relatively easy, either as Wireguard alone or as Tailscale (or ZeroTier, though that's not Wireguard). Wireguard (and Tailscale) allows you to setup the tunnel so that only local (RFC1918 ie) traffic is routed over it, meaning it won't eat up your battery like when just routing all traffic over it. I have Wireguard setup like that. It enables on any Wi-Fi network that isn't mine, as well as cellular, and the battery impact is less than 2% over a day.
old-gregg 1y ago
Your "life hack" is not a good advice. There's plenty of well-written explanations for why perimeter based security doesn't work. What is strange is that you've started in the right place: by being "constantly worried about security implications of each app". Unfortunately it's annoying and time consuming, but that's the right way to keep your data private. And if that's too much hassle, it means it's worth it to pay others to do it. When I'm thinking about a hypothetical situation when I need to save the world by hacking into a hypothetical villain, my best hope will be him using your approach to security.
- gugagore 1y ago
  Could you provide an example of one of the well written explanations?
  - marcusb 1y ago
    just go and look at any of the vendors selling “zero trust” solutions. They all have white papers available about how a) perimeter security is “dead” and b) how their specific flavor of zero trust is the One True zero trust and the only thing you can trust to protect your data. You will without exception need to provide an email address to access these white papers, so their inside sales team can ensure you fully understand the importance of trusting their zero trust, and not trusting anyone else’s. I’m not kidding - even a little.
    - PhilipRoman 1y ago
      It's sad that "zero trust" has become almost the opposite of what it originally meant. Now you can have the same insecure RDP server with admin/admin login but at least it's protected by a VPN that only a few tens of thousands of people have access to.
    - datadrivenangel 1y ago
      Defense in depth though: against a strong threat actor, perimeter based security won't prevent you from getting pwnd, but it will likely take them longer than if everything is on the public internet, and a private network will make weak threat actors ignore you, so it is still valuable.
deleted 1y ago
[deleted]
miki123211 1y ago
Even better, set up Tailscale. It's far easier to set up, is much more reliable (e.g. when devices are behind firewalls), and uses direct (encrypted) connections when possible. You can get it to do what you want with just a few clicks. Things like exposing a IoT VLAN on your Tailnet or setting up an exit node to tunnel all internet traffic through your home are super easy. You can even share specific devices with friends, which is super useful. If you have anything particularly sensitive (e.g. a notes app that you wouldn't want your children / partner to have access to), you can limit access to specific users / devices on the TS side, without bothering with implementing auth. I think there's even a way to look up the user and device based on their IP, which is one way to add painless authentication to your apps. There are reverse proxies that do it and inject the info as HTTP headers. If you aren't comfortable with trusting them with control over your network, you can always host your own Headscale server.
- airtonix 1y ago
  or zerotier
- dankebitte 1y ago
  > If you aren't comfortable with trusting them with control over your network Wrt the possibility of Tailscale being compromised, there's the in-beta tailnet lock feature: > Tailnet lock lets you verify that no node is added to your tailnet without being signed by trusted nodes in your tailnet. When tailnet lock is enabled, even if Tailscale infrastructure is malicious or hacked, attackers can't send or receive traffic in your tailnet. [1] [1] https://tailscale.com/kb/1226/tailnet-lock https://tailscale.com/kb/1226/tailnet-lock
  - ra 1y ago
    The pricing page suggests this is only for the "enterprise" plan.
    - dankebitte 1y ago
      Not sure which page you're referencing, but the linked page states it's available for Personal (free) as well: > Tailnet lock is available for the Personal, Personal Plus, and Enterprise plans.
wkat4242 1y ago
I do this too yes. It's a great extra level of security though probably not too smart to rely on as the only one. It's true you're already screwed if they get past the VPN and I also don't set up Auth for stuff that doesn't have any private details. But don't count on just the VPN for sensitive stuff. Like password manager.
- lolinder 1y ago
  Yeah, definitely don't do turn off auth for things that matter, if only because I'm not perfectly disciplined at keeping my guests off my main network. I'm talking about tiny services that do one thing—ollama, tts/stt, and similar. Stuff where the worst case scenario is someone using up some processor cycles, not data leaks.
varenc 1y ago
This is what Tailscale is great at.
cobertos 1y ago
Any idea on how to segment a VPN between friends? I have a few critical servers on my VPN I only want one or two devices to access, but no other devices. Mostly so that in case a rogue device enters or a friend gets hacked, there's no access to my sensitive services.
- abinmn 1y ago
  You can do this on tailscale with their ACL. It is super flexible for nailing down exactly which users/devices can talk to what on your network.
- hexmiles 1y ago
  In my case I simply create two wireguard tunnels (one called "vpn", the other called "guest") and use firewall rules to block all traffic from the "guest" tunnel to all service except the one that should be "public" (in my case a minecraft server). I think you could technically do it with a single tunnel by using firewall rules that refer to the IP address of the single peer but it's less convenient. NOTE: I also added a dedicated dnsmasq instance only for the "guest" tunnel so that they have DNS working and can use hostnames instead of IP address. This setup is trivial with both OpenWrt and OpnSense, but it should be doable also with manual setup
colordrops 1y ago
I built a home server project that manages many of the rough edges around deployment of self-hosted apps. It includes DDNS, router+firewall, headscale, automatic setup of apps, and automatic deployment of subdomains and TLS certs for each app. Apps are blocked to the public by default but accessible using a Tailscale client. It's built on top of NixOS and completely configurable through a single module. Still in heavy development but I've replaced an entire rack in my closet with an Intel NUC. https://homefree.host https://homefree.host

williamsss 1y ago

Good point. I also use my PKMS as a CMS for my blog. Might just split out the services and go this route.

sabellito 1y ago

For single page web apps I use pagecrypt [0] and just publish the html file (with inline scripts and styles) as public files. [0] https://pagecrypt.maxlaumeister.com https://pagecrypt.maxlaumeister.com

rafram 1y ago

The downside is that if you’re on a two-week vacation and your home network/server goes down on day two, there’s probably nothing you can do until you get home. If it’s hosted online, you can count on that 99.99…% uptime and SSH access no matter what.

jauntywundrkind 1y ago
Ssh exposed on a non-standard port, with root disabled, using key-based auth should be pretty non-controversial. The security through obscurity (non-standard port, no root) are both kinda silly but why not. That said, with awesome services like TailScale, it's pretty hard to get locked out of your network. TailScale is so so good at "just working".
- accrual 1y ago
  Fail2ban or rate-limiting SSH into a block table are useful layers to have as well.
- batch12 1y ago
  > The security through obscurity (non-standard port, no root) are both kinda silly but why not I think these are decent controls when layered with others. The effectiveness differs depending on your threat models, of course, but at the very least it helps reduce the noise seen from most automated scans reducing the effort involved in monitoring your assets.
- cyberax 1y ago
  Another option is port knocking. Super easy to set up and with 4 knocks it provides 64 bits of randomness.
- radlad 1y ago
  Disabling root provides more than security-through-obscurity if your sudo config requires a password to elevate: it essentially means you need both your SSH private key and your password to gain root.
vhanda 1y ago
I think what they meant is that if it's hosted online / home-network, only allow access to all services through a VPN. Wireguard is relatively easy to setup, and you can configure all your services to only be available through wireguard. Ever since ssh almost got backdoor-ed, the only thing "exposed" on my servers is Wireguard, which is UDP based and therefore harder to know if it's running. SSH also goes over wireguard.
- blooalien 1y ago
  > ... Wireguard, which is UDP based and therefore harder to know if it's running. Isn't it basically impossible to know if it's running unless you have an authorize key? I thought it didn't respond at all unless you ping a valid entry key off it.
  - vhanda 1y ago
    Well, there is packet inspection. My ISP / Government will know.
Zambyte 1y ago
These solutions are composable. Just run it on a VPS over a VPN.
- rafram 1y ago
  That’s a good point.
- bloqs 1y ago
  But what if your home hypervisor goes down?
  - Zambyte 1y ago
    Nothing. You probably though I said "VPN over a VPS", which would just be the same as a VPN, which isn't composing the solutions.
    - akerl_ 1y ago
      You're suggesting to use a VPS in a thread that's specifically about self-hosting on a home network, and about there being cons to that compared to hosting on a cloud/VPS platform. So you're sort of driving parallel to the existing commentary.
      - Zambyte 1y ago
        The parent comment to mine did that.
  - shellwizard 1y ago
    If you trust someone in your neighborhood/family, you can ask them to power cycle your host and water your plants
accrual 1y ago
Although not perfect, I added a couple features to help ensure uptime: * LAN components are on a UPS, helps keep continuity between power blips and breaker flips * Dynamic DNS, cron runs a script 4x per day to ensure a DNS name points to my IP, even if issued a new one by the ISP * Rebooting everything occasionally to ensure the network and services come back up on their own and I didn't make a mistake with some config that loads at boot, etc.
- dpkirchner 1y ago
  I run Tailscale on an Apple TV which is on a UPS. The thing uses very little power so the UPS lasts a long, long time.
  - rasen58 1y ago
    Do you have to hack the Apple TV to run tailscale on it or how does that work?
    - dpkirchner 1y ago
      There's an official tvOS app and you just have to configure the Apple TV to be an exit node. It doesn't require any special setup otherwise.
sammyteee 1y ago
You can also enjoy your vacation instead :)

brightball 1y ago

Tailscale is actually great for this if you configure an exit node on a device in your home.

walthamstow 1y ago
It doesn't need to be an exit node unless you want to direct all traffic through that node, like a traditional VPN. The beauty of Tailscale is that it will only direct traffic to a node that is meant for that node, everything else goes via the internet.

SahAssar 1y ago

So you've managed to unlearn the last decade of security learnings in regards to zero-trust and similar concepts?

xboxnolifes 1y ago
You need to understand your own risk tolerance and, more importantly, effort/resource threshold. Zero-trust is great if you have the resources to put to it, and companies should do it. But individuals trying to manage multiple companies worth of services, alone, on their own network? There's going to be corners cut.
caconym_ 1y ago
That's a comically uncharitable extrapolation on what was said.
sigmonsays 1y ago
self hosting is entirely different than enterprise security practices. You're a little out of touch with reality if you don't realize this.
lolinder 1y ago
I'm not running a business, I'm running a home. The threat models are totally different and I adjust my security posture accordingly. Besides, I don't bother with auth for simple services, not stuff that actually hosts data. If someone unauthorized is inside my network they're not going to be interested in using my TTS/STT service or in finding out the last barcode I scanned or in using my tiny consumer GPU to generate tokens on an LLM—there are way worse things they could be doing at that point than fiddling with the many tiny services I have set up. Also: I couldn't set up so many silly, inconsequential services if I didn't have a VPN. With my setup, every new idea I have can be a quick service on my network accessible by me anywhere in the world. If I had to expose each of these things to the internet I wouldn't bother running them at all lest they have an exploit that ends up being an entrypoint into my network.
dns_snek 1y ago
I'm being serious - please educate us, how do you think that we can do better in a homelab setting? How do you apply zero-trust principles in homelab environment with reasonable effort and without relying on 3rd party services?

caconym_ 1y ago

+1. I have Wireguard set up on all my mobile devices and configured to automatically start when connecting to any wifi that isn't mine, so I can take my devices anywhere and I'm still on my home LAN. It works seamlessly and flawlessly. I self-host a lot of services, and without Wireguard (or equivalent), remote access just wouldn't be realistic.

thepill 1y ago
On Android devices? If so: how? :)
- viraptor 1y ago
  I don't use it with wireguard, but Zerotier works just fine on Android.
  - Jarwain 1y ago
    As does tailscale!
    - ParetoOptimal 1y ago
      Or headscale: https://headscale.net/stable/ https://headscale.net/stable/
      - _heimdall 1y ago
        This is my recommendation for anyone that wants full control. I use Tailscale, purely out of laziness and a willingness to trust them today, but I'd move to head scale if either of those caveats changed.
    - fluidcruft 1y ago
      My only issue with wireguard/tailscale is that somehow my work IT has managed to make it unusable on our wifi. It's really annoying. I'm pretty sure it's a misconfiguration on their end but they don't have any reason to care. OpenVPN does seem to always work everywhere (presumably because outside contractors and support personnel use OpenVPN when onsite so it's a squeaky wheel that matters) so I've moved to that instead. Beyond that I can't figure out what the hell is the problem and the way IT works, they have no reason to fix it. I did get them to somewhat work on it by reporting Google VPN as randomly failing, but they just fixed Google VPN and nothing more than that. So anyway wireguard is great until you encounter bullshit corporate firewalls.

justsomehnguy 1y ago

welcome to the world when not TailScale, not a private WireGuard, not aL2TP, OpenVPN works. No, SSTP doesn't too. HTTPS works. Even on the devices you don't or can't control.

chris12321 1y ago

You can also set up DNS records pointing to your home server's VPN IP, which, with Tailscale, I've found to be pretty static and then a reverse proxy on your home server. So I have my home network apps running on app1.my-domiain.com app2.my-domain.com, app3.my-domain.com etc, which only work when I'm connected to the VPN. The downsides are that I need to be connected to the VPN at home to use the domain and I currently don't have SSL set up on the domains, so browsers complain when I connect to them. The second problem I could fix, but I'm not sure if there's a solution for the first.

sebws 1y ago
You can fix them both in one. In your local network you host a local DNS, in my case I’m using pihole. It has records which point to the local IP of a reverse proxy. With this setup you can have SSL for your domain names on your local network. To make it then work outside your local network, in tailscale settings you use “split dns” to set your DNS to be the IP of your pihole in the tailnet for your domain. Now when you try hit your local domains you should receive the same local IPs that you do at home. Then in the tailscale route settings of your machine hosting the reverse proxy you make it advertise the subnet of those local IPs. Now when you receive the local IPs your devices using the tailscale VPN should go to your home server with SSL and no external DNS. Hope that’s somewhat clear enough
mynegation 1y ago
There is a solution for the first. I have setup my home server torun Tailscale _and_ be a router to 192.168.2.x network (you can set this up in the Tailscale UI). I have server.mydomain.com to resolve to 192.168.2.x address and this way I can access it from the outside via Tailscale and from inside without the need to turn on Tailscale. I have https setup via DNS-01 challenge as well and updated automatically.

8fingerlouie 1y ago

The internet is not a friendly place, so a VPN is a great idea. With modern tools like Wireguard, you can even set it up relatively easy, either as Wireguard alone or as Tailscale (or ZeroTier, though that's not Wireguard). Wireguard (and Tailscale) allows you to setup the tunnel so that only local (RFC1918 ie) traffic is routed over it, meaning it won't eat up your battery like when just routing all traffic over it. I have Wireguard setup like that. It enables on any Wi-Fi network that isn't mine, as well as cellular, and the battery impact is less than 2% over a day.

old-gregg 1y ago

Your "life hack" is not a good advice. There's plenty of well-written explanations for why perimeter based security doesn't work. What is strange is that you've started in the right place: by being "constantly worried about security implications of each app". Unfortunately it's annoying and time consuming, but that's the right way to keep your data private. And if that's too much hassle, it means it's worth it to pay others to do it. When I'm thinking about a hypothetical situation when I need to save the world by hacking into a hypothetical villain, my best hope will be him using your approach to security.

gugagore 1y ago
Could you provide an example of one of the well written explanations?
- marcusb 1y ago
  just go and look at any of the vendors selling “zero trust” solutions. They all have white papers available about how a) perimeter security is “dead” and b) how their specific flavor of zero trust is the One True zero trust and the only thing you can trust to protect your data. You will without exception need to provide an email address to access these white papers, so their inside sales team can ensure you fully understand the importance of trusting their zero trust, and not trusting anyone else’s. I’m not kidding - even a little.
  - PhilipRoman 1y ago
    It's sad that "zero trust" has become almost the opposite of what it originally meant. Now you can have the same insecure RDP server with admin/admin login but at least it's protected by a VPN that only a few tens of thousands of people have access to.
  - datadrivenangel 1y ago
    Defense in depth though: against a strong threat actor, perimeter based security won't prevent you from getting pwnd, but it will likely take them longer than if everything is on the public internet, and a private network will make weak threat actors ignore you, so it is still valuable.

deleted 1y ago

[deleted]

miki123211 1y ago

Even better, set up Tailscale. It's far easier to set up, is much more reliable (e.g. when devices are behind firewalls), and uses direct (encrypted) connections when possible. You can get it to do what you want with just a few clicks. Things like exposing a IoT VLAN on your Tailnet or setting up an exit node to tunnel all internet traffic through your home are super easy. You can even share specific devices with friends, which is super useful. If you have anything particularly sensitive (e.g. a notes app that you wouldn't want your children / partner to have access to), you can limit access to specific users / devices on the TS side, without bothering with implementing auth. I think there's even a way to look up the user and device based on their IP, which is one way to add painless authentication to your apps. There are reverse proxies that do it and inject the info as HTTP headers. If you aren't comfortable with trusting them with control over your network, you can always host your own Headscale server.

airtonix 1y ago
or zerotier
dankebitte 1y ago
> If you aren't comfortable with trusting them with control over your network Wrt the possibility of Tailscale being compromised, there's the in-beta tailnet lock feature: > Tailnet lock lets you verify that no node is added to your tailnet without being signed by trusted nodes in your tailnet. When tailnet lock is enabled, even if Tailscale infrastructure is malicious or hacked, attackers can't send or receive traffic in your tailnet. [1] [1] https://tailscale.com/kb/1226/tailnet-lock https://tailscale.com/kb/1226/tailnet-lock
- ra 1y ago
  The pricing page suggests this is only for the "enterprise" plan.
  - dankebitte 1y ago
    Not sure which page you're referencing, but the linked page states it's available for Personal (free) as well: > Tailnet lock is available for the Personal, Personal Plus, and Enterprise plans.

wkat4242 1y ago

I do this too yes. It's a great extra level of security though probably not too smart to rely on as the only one. It's true you're already screwed if they get past the VPN and I also don't set up Auth for stuff that doesn't have any private details. But don't count on just the VPN for sensitive stuff. Like password manager.

lolinder 1y ago
Yeah, definitely don't do turn off auth for things that matter, if only because I'm not perfectly disciplined at keeping my guests off my main network. I'm talking about tiny services that do one thing—ollama, tts/stt, and similar. Stuff where the worst case scenario is someone using up some processor cycles, not data leaks.

varenc 1y ago

This is what Tailscale is great at.

cobertos 1y ago

Any idea on how to segment a VPN between friends? I have a few critical servers on my VPN I only want one or two devices to access, but no other devices. Mostly so that in case a rogue device enters or a friend gets hacked, there's no access to my sensitive services.

abinmn 1y ago
You can do this on tailscale with their ACL. It is super flexible for nailing down exactly which users/devices can talk to what on your network.
hexmiles 1y ago
In my case I simply create two wireguard tunnels (one called "vpn", the other called "guest") and use firewall rules to block all traffic from the "guest" tunnel to all service except the one that should be "public" (in my case a minecraft server). I think you could technically do it with a single tunnel by using firewall rules that refer to the IP address of the single peer but it's less convenient. NOTE: I also added a dedicated dnsmasq instance only for the "guest" tunnel so that they have DNS working and can use hostnames instead of IP address. This setup is trivial with both OpenWrt and OpnSense, but it should be doable also with manual setup

colordrops 1y ago

I built a home server project that manages many of the rough edges around deployment of self-hosted apps. It includes DDNS, router+firewall, headscale, automatic setup of apps, and automatic deployment of subdomains and TLS certs for each app. Apps are blocked to the public by default but accessible using a Tailscale client. It's built on top of NixOS and completely configurable through a single module. Still in heavy development but I've replaced an entire rack in my closet with an Intel NUC. https://homefree.host https://homefree.host