Comment

Comment on How do you all handle security and monitoring for your publicly accessible services?

So among my services I self host, a few need to be publicly accessible for work. For those I wish to remain private, I use Caddy allowing only private IP ranges, plus then Authelia as auth which is set to 30 days. There is then the login of each service being Authelia as well. It’s as good as it needs to be for my needs.

If I were only self hosting private services, then as others have said, I would put all access through a VPN.

source

Sort:hotnew top

a_fancy_kiwi@lemmy.world ⁨1⁩ ⁨week⁩ ago

Caddy only allows private IP ranges

Do you mind telling me more about this? How does that work; a VPN?

source
- q7mJI7tk1@lemmy.world ⁨1⁩ ⁨week⁩ ago
  Sure, so I use Caddy as a reverse proxy for all my subdomains, the public ones direct straight to whatever service(s) are on IP:port etc, then the private ones only allow private IP ranges of which one is my VPN subnet, therefore only allowing LAN and VPN access. I then also have a section for each of the private subdomains with Authelia authentication which is omitted here:
  
  (allowed) { @allowed client_ip 192.168.1.0/24 192.168.10.0/24 192.168.20.0/28 } sub.domain.com { import allowed handle @allowed { reverse_proxy 192.168.80.8:8080 } handle { abort } }
  
  source