Comment on How do you all handle security and monitoring for your publicly accessible services?

j4k3@lemmy.world ⁨1⁩ ⁨week⁩ ago

• a_fancy_kiwi@lemmy.world ⁨1⁩ ⁨week⁩ ago

  If you have access to all devices, why not just use your own self signed certificates to encrypt everything and require the certificate for all connections?

  Sounds like you are describing a VPN. I was using that setup before but small stuff like immich album sharing via a link won’t work properly. Also, having to ensure a vpn is on and connected is a little to much to ask of my partner; they would turn it off and forget about it and then ask why their app wasn’t working :/

  source

  • j4k3@lemmy.world ⁨1⁩ ⁨week⁩ ago

    I mean more like a self signed TLS certificate with your own host manually set in the browser. Then only make the TLS port available, or something like that. If you have access to both(all) devices, you should be able to fully encrypt by bruit force and without registering the certificate with anyone. That is what I do with AI at home.

    source

    • peregus@lemmy.world ⁨1⁩ ⁨week⁩ ago

      I don’t know much about certificates, but doesn’t that just alert the browser that the certificate is not trusted and you can decide if keep going or not?

      source

      • j4k3@lemmy.world ⁨1⁩ ⁨week⁩ ago

        Sorta, you have to install your certificate authority into the browser and it might complain about verifying that but it will still connect with the encryption.

        source

        • -> View More Comments
    • a_fancy_kiwi@lemmy.world ⁨1⁩ ⁨week⁩ ago

      oh, my mistake. tbh, I don’t know enough about it but I’m interested. Why set up a TLS cert for AI at home? How is that benefiting you and your setup?

      I’ve seen some people set up SSL certs for self hosted services and not make them publicly available but I didn’t get around to seeing why they were doing it

      source
  • peregus@lemmy.world ⁨1⁩ ⁨week⁩ ago

    Beside the fact that you would like to understand if you’ve done everything properly (that’s good, but I can’t help you here), a VPN on a smartphone can be always active. Mine is always on and I’ve never noticed any battery problem. If you prefer something simpler there’s Tailscale.

    source

    • a_fancy_kiwi@lemmy.world ⁨1⁩ ⁨week⁩ ago

      If it were only me using the apps, I’d be using a VPN. Over the years, I’ve used OpenVPN, Wireguard, and now Tailscale. In my experience, they work like 99% of the time. That last 1% though is weird connection issues; usually when switching between WiFi and cellular (or vice versa) but sometimes it’s my server or ISP and I havr to turn the VPN off and back on to troubleshoot. My partner will either turn off the VPN and forget to turn it back on or they will forget about the VPN completely and not be able to use their phone. Ideally, I’d like to set something up that doesn’t require any potential troubleshooting on their part so I can avoid hearing “why can’t we just use Google photos?” or “what’s wrong with Google home?” 😓

      source

      • jeena@piefed.jeena.net ⁨1⁩ ⁨week⁩ ago

        Yes this is the main reason for me. If you're alone then you don't care that things occasionally don't work. Once you have at least one more person or potentially the extended family it's a whole different story. And then in my opinion a potentially not 100% secured publicly accessible immich instance at home is magnitudes better than having the family just use google photos.

        Because like you say, every little hick up from your site is met with "why can't we just use $bigtech instead, it always works".

        source