Selfhosted
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
-
No spam posting.
-
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
-
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
-
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
-
No trolling.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
view the rest of the comments
I just worried about attacks on my router in case someone gets ahold of the link. Im learning all this security stuff. I actually helped my friend with his lemmy instance and got it running.
I just know next to nothing about security...
Give me something to try and get working I'll pick it up, but I don't even know where to start with this stuff. I read something the other day about using cloudflare to connect to a VPS and then direct that to my nas or something.
I have 2 VPS services and 1 already hosts my jellyfin instance but i was gonna try out emby however, I wanna share my library with family like I share my Jellyfin with them. Just the VPS I run my jellyfin on handles all the security stuff. shrugs
Absolutely a fair reason to be nervous. For this just follow the rules of minimum access. Only open the ports you need to open, and make sure they only point to the item you want to expose. That will take care of 99% of use cases. Most hacks you see happening right now with home labs are because someone did something pretty obvious - like exposing their router/firewall UI to the open internet (instead of it only being accessible to the local network), same with their data servers.
If you have a good network you can even restrict which IPs are allowed to connect through those ports, but remember if your mom's IP changes or you're sitting in a hotel then you're essentially blocking yourself out (without a VPN or something).
Finally, and I would save this for a little later, you can move your Emby/external services to an alternate VLAN. VLANs are virtual-lans, they are a block of IPs that have firewall rules in between each of them. So you could do rules like "Internal clients can talk to Emby, but Emby cannot talk to Internal Clients". This can be a daunting thing and will take a lot of trial and error, not to mention probably revamping your entire network - so I'd hold off for now.
I wanted to do vlan , but that would mean no more super fast local access
To reduce that, there are a few things you can do.
Option 1:
Only open port 443 and run everything through a reverse proxy like traefik. You can open other ports ad you need them (game server for example)
Run crowdsec to get rid of 95% of bad actors
Whitelist IPs that you know traffic will be coming from and drop everything else
Option 2:
Option 3:
Run tailscale
run fail2ban