I’m in this boat too, my security is awful, bad practices everywhere, my solution: don’t let it go out in public…
Comment on How "secure" is your setup?
grue@lemmy.world 3 weeks ago
My stuff is only accessible from my lab (because I haven’t figured out how to set up a tunnel or reverse proxy yet).
zebidiah@lemmy.ca 3 weeks ago
reddit_sux@lemmy.world 3 weeks ago
Tailscale is your friend.
Solrac@lemmy.world 3 weeks ago
Screw Tailscale, ZeroTier and specially cloudflare, all centralized, all with changable terms.
Use a VPS, lowest spec but good bandwidth, and use Wireguard VPN for your VPS and homeserver, and nginx or caddy to make a Reverse Proxy
reddit_sux@lemmy.world 3 weeks ago
All agreed but not every homelabber can spend money for something that is not the main job or contributed to work. Tailscale for now works well enough for free.
Cloudflare agreed is not something I would trust.
horus_son_of_isis@lemmy.world 3 weeks ago
I’m so close to doing this. Cloudflare makes me nervous. Have you heard of Rathole? That was recommended to basically do what my cloudflared tunnel is already doing. The only trouble I could see was I was going to have to keep the cloudflared access controls.
grue@lemmy.world 3 weeks ago
I’ve tried to use ZeroTier because Tailscale still has centralized servers for starting the connection, but had trouble getting it to work. Maybe I should stop letting the perfect be the enemy of the good.
lemmyvore@feddit.nl 3 weeks ago
If you have good IPv6 connectivity both at home and away you can look into the Yggdrasil network. It facilitates node-to-node encrypted communications, but it’s decentralized and community-run. Unlike Tailscale, each node can do both communication and relay.
You run the Y client on each device you want to use and if you want to keep things completely private (and you have at least one device that’s not behind CGNAT) you can only add your own devices as peers. If you need to bypass CGNAT you can use one of the community-supplied nodes to act as relays, or set up your own node on a VPS.
The cool feature of Y is that if you’re trying to communicate between nodes A and B and there isn’t a single node that’s peered with both A and B, you can still communicate as long as there are nodes somewhere in the network that know them both. The network will search for you and calculate the optimal relay path. Ofc like I said this is irrelevant if you decide to stick to your own devices, basically you will have your own personal mini Y network completely separate from the main public network.
Even when using the public network there’s no privacy issue, relay nodes cannot snoop on communications only facilitate the connection or not, and once relay to a node has been accomplished the nodes will communicate directly thanks to ICE+STUN, if possible, like Tailscale does.
Please note that nodes are identified by 2001:: random addresses. While the 2001:: address space is huge it’s still only obscurity not security. You still need to have a decent firewall setup on each node, Y does not enforce ACLs or anything like that.
undefinedTruth@lemmy.zip 3 weeks ago
There is Headscale if you don’t want to use Tailscale servers.
fleem@piefed.zeromedia.vip 3 weeks ago
or pangolin