3 ms·

Self hosting is much more accessible today. The security issue has not been solved yet though. How do you make available your services to other people? People

by aborsy 1y ago

Self hosting is much more accessible today. The security issue has not been solved yet though. How do you make available your services to other people? People won’t install VPNs. They are usually okay with authenticating to a web server, so you can put authentication with something like Authentik in front of your reverse proxy. But can you configure this front end security correctly and patch it, and are you sure it doesn’t have easy zero days?

elevation 1y ago
Your employees/contractors will install your VPN if it's a contingency of employment. If you don't need to serve to the world, this step dramatically limits your attack surface, though you should still use Authentik and TLS.
esseph 1y ago
front it with a cloudflare tunnel waits for the pitchforks and torches
- aborsy 1y ago
  CF terminated TLS and scans the traffic. It makes sense if you host your services on a VPS. If I run my services at home, I don’t want to provide Cloudflare with access to my data.
  - esseph 1y ago
    It also makes sense if you run public services at home
    - aborsy 1y ago
      Public in the sense that the actual content is public (like a blog), sure, anyone can access it, so does the reverse proxy). Since it’s public, I Would still take the trouble entirely out to a provider. Public in the sense that the front page is public, and the client still need to authenticate to the service at home, in this case, that does not make sense (the user authenticates to reverse proxy, which authenticates to the service), for the reason I mentioned.
      - esseph 1y ago
        > I Would still take the trouble entirely out to a provider. Frankly, because you don't trust your own abilities in that area, or you're simply not interested in taking responsibility for that piece - and that's totally fine. > Public in the sense that the front page is public, and the client still need to authenticate to the service at home Maybe your authentication doesn't live at home, or on the home network. It could be on a vps or a cloud radius/ldap/etc auth service. Some people have been writing code for 30+ years. I've been running internet facing systems for 30+. Different backgrounds, different levels of comfort and enjoyment out of different things!

by aborsy 1y ago

elevation 1y ago

Your employees/contractors will install your VPN if it's a contingency of employment. If you don't need to serve to the world, this step dramatically limits your attack surface, though you should still use Authentik and TLS.

esseph 1y ago

front it with a cloudflare tunnel waits for the pitchforks and torches

aborsy 1y ago
CF terminated TLS and scans the traffic. It makes sense if you host your services on a VPS. If I run my services at home, I don’t want to provide Cloudflare with access to my data.
- esseph 1y ago
  It also makes sense if you run public services at home
  - aborsy 1y ago
    Public in the sense that the actual content is public (like a blog), sure, anyone can access it, so does the reverse proxy). Since it’s public, I Would still take the trouble entirely out to a provider. Public in the sense that the front page is public, and the client still need to authenticate to the service at home, in this case, that does not make sense (the user authenticates to reverse proxy, which authenticates to the service), for the reason I mentioned.
    - esseph 1y ago
      > I Would still take the trouble entirely out to a provider. Frankly, because you don't trust your own abilities in that area, or you're simply not interested in taking responsibility for that piece - and that's totally fine. > Public in the sense that the front page is public, and the client still need to authenticate to the service at home Maybe your authentication doesn't live at home, or on the home network. It could be on a vps or a cloud radius/ldap/etc auth service. Some people have been writing code for 30+ years. I've been running internet facing systems for 30+. Different backgrounds, different levels of comfort and enjoyment out of different things!