Hi all,

I am running proxmox on a mini PC with a handful of services in my stack. I also run NPM in an LXC to reach my services through my domain name (service.domain.tld).

For my Arr related stuff, I use Usenet, and everything runs through a VPN.

I have three services which are public. Jellyfin, Seer and BookOrbit (for syncing Kobos).

Currently I have no security besides the built in login managers from the services, but I am considering setting up Authentik. I know I’m asking for trouble with my current set up.

I have elderly and extremely tech averse family members who live in two countries other than me, so tech support can be a challenge.

A lot of people suggest running a VPN, but it would be difficult for my family and I don’t know how to make it work syncing our Kobos with BookOrbit.

I’ve also seen some posts about tunneling to a VPS somewhere and users can connect to the VPS without a VPN.

I feel this question has been asked several times, and I tried searching here and on the internet in general, but my knowledge is not good enough to use the right terms and to get something that is idiot proof.

Any suggestions on best practices or links to guides you recommend would be much appreciated. Also, what EU based affordable VPS would you recommend?

  • wr2623@midwest.socialEnglish
    2·
    1 day ago

    Are your exposed services all on their own ports externally, or behind a reverse proxy?

    Putting them behind a reverse proxy makes sure that attackers at least need to know the correct hostname to access your service.

    This is security by obscurity which isn’t proper security but it means that all of the port scanners out there likely won’t know your jellyfin server exists when a vulnerability for jellyfin is released.

    If you use let’s encrypt or something similar be aware that all issues certs show up in a public log so attackers like to harvest that log as a list of valid domain names. Switch those certs to wildcards so that you aren’t advertising those valid hostnames.

    There are often options in reverse proxies, or sometimes your router to do geo based blocking. If you can limit connections to your local country only you eliminate huge portions of the botnets out there.

    Combining this with auto updates/reboots on your services is probably enough to keep you safe, but if you want to really secure things a separate DMZ vlan for your services to prevent an attacker from compromising additional services on your LAN.

    The more network segmentation you can do the better. An ideal setup is every app/container in its own network/ACL that only allows traffic to the specific network devices that it needs to talk to. This is a lot to manage if you do this with your router/vlans. Containers orchestrators (i.e. k8s) make this easier, but don’t protect you from kernel level exploits to break out of the containers. I believe proxmox has VM level ACLs now so you could skip the vlans and do your segmentation at that level instead.

    • neo2478@sh.itjust.worksOPEnglish
      2·
      1 day ago

      I’m using NPM as a reverse proxy with let’s encrypt certs. I did not know about the public log.

      I have to look into hiwvto best segment my network given my hardware, and I think about deploying NetBird.

      Thanks a lot for the advice! Lot’s to read about.