Should I be concerned with exposing my server to the public? - eviltoast

Hey all! For the longest time I’ve had a server that hosts some things (eg Syncthing), but is only available via SSH tunneling.

I’ve been thinking of self-hosting more things like Nextcloud and Vaultwarden. I can keep my SSH tunneling setup but it might make it difficult to do SSL.

How do you manage the security of having public-facing servers?

  • hib@lemmy.sdf.org
    link
    fedilink
    English
    arrow-up
    0
    ·
    edit-2
    1 year ago

    Here is my setup:

    Cloudflare fronts all of my webserver traffic, and I have firewall rules in Cloudflare.

    Then I have an OPNsense firewall that blocks a list of suspicious ips that updates automatically, and only allows port 80/443 connections from Cloudflare’s servers. The only other port I have open is for Wireguard to access all of my internal services. This does not go through Cloudflare obviously, and I use a different domain for my actual IP. I keep Vaultwarden internal for extra safety.

    Next I run every internet facing service in k3s in a separate namespace. This namespace has its own traefik reverse proxy separate from my internal services. This is what port 80/443 forwards to. The namespace has network policies that prevent any egress traffic to my local network. Every container in the WAN facing namespace runs as a user with no login permission to the host. I am also picky about what storage I mount in them.

    If you can get through that you deserve my data I think.

      • hib@lemmy.sdf.org
        link
        fedilink
        English
        arrow-up
        1
        ·
        1 year ago

        Unfortunately no guide, just things I’ve pieced together myself over the years.

        Cloudflare is probably the easiest and most intuitive part of the setup though, you can setup dns/proxy/firewall rules very intuitively, and I’m sure there are plenty of guides out there.