Hi all,
I’m looking at exposing some self-hosted web-based services externally so that some relatives can access them and would appreciate some advice.
Vikunja is the starting point (mostly to facilitate my spouse and I using it when away from home) but in future I want to set up Immich or similar to replace Google Photos, and that in particular will need to be shared with friends and family (especially so that immediate family can have camera uploads on automatically).
I understand that ideally I’d use SSH, a VPN, or tailscale or similar (although I don’t have experience with tailscale), but that’s not going to be feasible. Most of the family will not be able to set up those connections themselves (which means I would need to) and several are far enough away that it is impractical for me to provide on-site support or do it myself. Even if I could get a VPN or similar deployed on all their devices, I suspect that they’re going to struggle with needing to connect to it just to upload or view photos, then disconnect afterwards to resume using the Internet – I really need this to “just work” for them.
So this brings me back to safely exposing these services to the outside world. My network architecture complicates this a little, so for context:
- Modem/router has basic firewall and points to a Raspberry Pi for DHCP. I already have No-IP set up with a domain name so that I can SSH into my LAN when away from home.
- RPi runs Pi-hole + dnscrypt, acting as DHCP and DNS server for the network.
- I want to use nginx as a reverse proxy running on this RPi, as I have experience with it and it can add SSL using certbot. The router would be configured to use port forwarding to direct external traffic for ports 80 and 443 to the RPi.
- Vikunja is hosted on a separate Raspberry Pi (with other things like Shiori)
- I have not yet determined where Immich or similar is going to go. I have existing home server that I use for backups and important family stuff, but I really don’t want this to be vulnerable to the outside world. If I were to install Immich here, I’d need it to be well-isolated from the rest of the system. The other option is to get a NUC or similar, which is what I am leaning towards as the less stressful option.
So my main questions are:
-
Beyond fail2ban and my router’s firewall, what else can I do to protect my network once I open ports 80 and 443?
-
How do I handle fail2ban configuration when the services are on different devices to the nginx proxy? I understand the best place to put fail2ban would be on the Pi running nginx (since it’s the access point to the outside world), but that it also needs to read the logs from Vikunja, etc. to be effective.
-
Where would you put Immich in my network architecture?
Any other tips/recommendations for making this easy to use for my less tech-inclined friends and family would be much appreciated as well. Thanks.
i have a VPS offsite to act as a gateway. it’s just a small piece of a machine somewhere in my region that routes requests to my home network via Tailscale. this has a few benefits:
- i don’t have to worry about my ISP changing my IP. my VPS has more stable IPs.
- i don’t have to expose ports directly to the internet. Tailscale authenticates the connection. plus i have Caddy routing the whole system. i use subdomains like
foundry.chrash.net,jellyfin.chrash.net, etc. - another benefit of Tailscale to point out is that you don’t need local IPs to be static either; Tailscale will allow you to access your machines by hostname or another static IP. this helps to decouple your local topology from your service network.
Thanks. So, just to make sure I’ve understood correctly, your recommendation would be a VPS that hosts nginx (or Caddy) as the reverse proxy and uses tailscale (or equivalent) to access my home LAN and make services (e.g. Vikunja) available?
There are even solutions that automate a lot of the configuration for such a setup. I’m using Pangolin for example:https://github.com/fosrl/pangolin
But you could set up something like this manually if you want more flexibility (pangolin is based on traefic rather than Nginx)
the key is just an offsite machine with a stable IP plus a VPN. that way you can route all public traffic to that stable IP and send it where it needs to go regardless of its physical destination.
I used swag, dockerproxy, and cloudflare in the past. That allowed me to run things without exposing ports on my home router.
I recently moved to Pangolin cloud. Still not exposing any ports on my home server. Also repositioned my VPS to use pangolin as well. Haven’t hashed out the details, but the idea will be to allow port 443 on public IP, and anything else over tailnet.
Moral of the story: look very hard for ways to do what you want to do without having to expose ports on your router. Unless you want your hobby to become your second job. I enjoy self hosting. I don’t enjoy being paranoid about some script kiddie pummeling my setup with some AI-generated attacks while I’m asleep.
Yeah, I don’t like the thought of worrying about vulnerabilities either, hence my asking this question!
I haven’t heard of Pangolin cloud before – I’m assuming this is a competitor to tailscale. Are you self-hosting it or using one of their paid plans, and if you’re self-hosting, how hard was it to set up?
Pangolin handles proxying (it runs traefik under the hood) and cloudflare-like protection (crowdsec). I did self-host it, but the free tier does what I need.
It does set up a wireguard tunnel between itself and the Newt resources you set up. That’s hard for proxy traffic. I have Tailscale set up for any other traffic between my resources.
I asked a similar question as you a few months ago (I think in this community), and one of the responses kind of put the fear in me. I went forward anyway, and never really did anything with my VPS. I’m still setting this new arrangement up, but so far really happy with it.
Thanks. I think I’ll need to do a bit more reading - I have no experience with any of the wireguard technologies (my VPN experience is with OpenVPN and enterprise-grade networking hardware that uses IPsec tunnels), but Pangolin’s abilities do sound useful.
I guess I need to work out if something like tailscale (as per one of the other comments) set up on just the small group I want to share with will do the job, or whether I really need to expose services to the Internet and hence would benefit from a VPS with something like Pangolin.
If you’re not going the VPS route it’s even easier. Pangolin handles the wireguard tunnel for you with a docket container running newt. Very straightforward.
My goals have been:
- Avoid opening ports on my home network.
- Don’t require people using my services to join my Tailnet (or some other VPN).
- Require 2FA/passkeys (via Authentik for the moment) on anything that’s publicly accessible.
There’s plenty of YT stuff out there for Pangolin, but I haven’t seen a lot for their cloud service. Personally, I prefer it to self-hosting it. Similar to tailscale, the free tier meets my needs, and their security team is (hopefully) more competent and better staffed than… me.
Of course, you get what you pay for, but I see this as a similar position as Tailscale & Cloudflare. With my free account, I’m piggy-backing off the security infrastructure of their enterprise offerings. Obviously I don’t get all the fine-grained controls of those tiers, but like the other two companies, they have a reputation to uphold, and from that perspective a breech is a breech. Even if it only affects free tier users, it makes them look bad.
That sounds like it may be a good fit for my use case, then. Thanks again and I’ll definitely look into it!
Make sure everything is behind a VPN, like tailscale. Then you setup your router to only forward the tailscale ports, and that will be the only possible attack vector
As long as tailscale is safe, you should be safe
Tailscale also has Funnel.
Good to know, thanks.
Since you’re just sharing things within a small group, I think it’s safe to give out your IP or a domain pointing to it. However, you need to put your services behind a DMZ. Make a separate VLAN on your network and put the Pis behind it. Make sure traffic from your private LAN can enter the DMZ but nothing from the DMZ can go to your LAN unless it’s return traffic for a session started in your LAN. If a machine in your DMZ is compromised, it shouldn’t affect your LAN.
Thanks. I had forgotten about setting up a DMZ and appreciate the reminder!
Posted in a similar thread
My baseline is a public VPS with Pangolin/Crowdsec installed. I have authentik as a login system. Pangolin let’s me put authentik in front of any service so they have to log into it before it gets to the service in question whatsoever. This is different than the app itself just using Authentik as the OIDC provider. Helps give a bit of peace of mind with the services which themselves might not be security focused. Also, these pangolin routes are able to block anything outside my country by rules, so that trims a good portion of attacks as well.
Some things don’t like that authentik layer in front though. Audiobookshelf’s phone app for example cant handle it. For that, I route those domains through cloudflare tunnels. Their tunnels do a good job blocking lots of attacks, so not having authentik in front is more acceptable.
But then there’s jellyfin that doesnt want to be on cloudflare tunnels and doesnt want authentik in front. For that, I just have it on my pangolin side with only crowdsec helping. Not ideal, but best I can do without making my grandma install a VPN on a raspberry pi in so her TV can connect or some shit.
And lastly, I have some private services like forgejo that don’t like authentik in front and only I myself care about. I tailscale to those rather than exposing sometimes.
Thanks - appreciate another recommendation for Pangolin + crowdsec, plus I didn’t know about authentik (which sounds super useful if the services behind it are compatible). I’m thinking I need to have a play around with tailscale and then Pangolin to see how they work and whether either will be appropriate for my use case.
I recommend proxmox. One VM for sensitive private data and backups, one VM for stuff exposed to the internet
Thanks for the recommendation. I have no experience with Proxmox, so this might be part of a longer-term project once I’ve got the Vikunja access working (at least that’s on a separate Pi and so would be similar to a distinct VM in that regard).
You’re going to be sending a url to your family to put into vikunja. That url could contain a port. You’ll dodge a LOT of hassle if you don’t use 80, 443, or any other well known port.
Good call. I’ll have to play around with certbot using DNS validation (only ever tried with HTTP validation), but certainly worth including in my plan. Thanks.
Going to throw myhat in the ring. I used to use Cloudflare tunnels which are super easy to use and work well. Issue: it’s cloudflare and cloudfalre bad, and works best if you also have your domain registered there.
Anyways, I now use https://docs.pangolin.net/ which does a very similar job. It works great and IMO is easier to admin than tunnels, especially with auth and such.
I run pangolin on a racknerd cheapo server and traffic in forwarded to the box in my cupboard. Pangolin have some refetal links to hosting that give you some discounts.
Good to know, thanks. Not keen on Cloudflare, so it’s good to see that there’s now multiple recommendations for Pangolin and Tailscale in this thread.
This is how my network is set up just as an example. Not to imply that this is the gold standard by any stretch of the imagination. It has served me well over the years, so I figured I’d drop it here and maybe you could get a few ideas.
- I would recommend a VPS for publicly facing services, you simply don’t want to open your home network, one mistake is enough, old router software, one small misunderstanding or a bit of bad luck. If someone gets into your VPS, few services will be hurt, if someone gets into your home network its game over.
- There is nice little app called immich proxy, I didn’t yet try it myslef (but I plan to), but basically if you want to just share some albums or photos, you can make the proxy accessible publicly but your Immich stays safe.
Thanks, didn’t know about Immich proxy. Sounds useful.
On the VPS point - beyond protection against DoS, I assume the main benefits only arise if you host the services on it? My understanding is that, if I open a port and forward it to nginx, then the largest attack surface would be nginx itself and the services it is acting as a reverse proxy for (e.g. Vikunja). nginx is well-established and I think most of the risk is from the plugins rather than nginx vulnerabilities itself, which leaves Vikunja and any other services I’d want to expose as the main attack surface. If I’m using a VPS as a gateway (e.g. hosting nginx there and still keeping Vikunja and Immich within my LAN), then that doesn’t seem like it’s much of a risk reduction. What am I missing?
Yes, the best option is to deploy your services on it. That Nginx is well established doesn’t mean its secure. A) popular software is preferred target for hackers and B) Nothing is safe, especially now, when LLMs are getting good at finding holes in software.
This is an interesting thread. Seems to make remote access easy. But are you not putting the trust on those that run that pangolin infrastructure? I suspect the answer is to go VPS if you dont trust? Also, are there workable step by step guides to help you set this all up? I find YT giudes a bit fustrating. Prefer reading :-)
deleted by creator
Make a new gmail or something everyone can access and then have them login through tailscale, its automati after doing it once, then they copy your devices ip, go http:ip:port eveytime and if your app is exposed over local networks it should work. Just safer than actually exposing over the web. Downside is shared gmail account ofc.
Thanks for the suggestion. I’m trying to move away from Google, but the idea of a shared account for tailscale (which seems to support a lot of different SSO options) may be useful.
You can also use github so sign up for tailscale! if i remember correctly
You can indeed: https://tailscale.com/docs/integrations/identity
