Comment on Best way to get IPv4 connectivity to my self-hosted services

• 2xsaiko@discuss.tchncs.de ⁨3⁩ ⁨weeks⁩ ago

  If someone manages to get root (!) access on this VPS it’s over either way.

  source

  • rirus@feddit.org ⁨2⁩ ⁨weeks⁩ ago

    NO, an attacker getting control over a vps used as a tunnel could not read Data captured in the past. Also they could not do a MITM with decrypted SSL without breaking HSTS

    source
• gray@pawb.social ⁨3⁩ ⁨weeks⁩ ago

  Your reverse proxy should have a cert with HTTPS.

  source

  • 2xsaiko@discuss.tchncs.de ⁨3⁩ ⁨weeks⁩ ago

    Tbf, technically data is still decrypted at the reverse proxy and then re-encrypted. So if someone manages to reconfigure the proxy or read its memory somehow they could read traffic in plain text.

    However then since they have to control the VPS, they could also get a new cert for that domain (at least the way I’ve configured it) even if it was passed as is to the real host via a tunnel and read the plaintext data that way, so I don’t think a tunnel protects against anything.

    source

    • hank_and_deans@lemmy.ca ⁨3⁩ ⁨weeks⁩ ago

      Or just use Nginx stream proxy, and all the encryption happens on the endpoints. No need for certs on the proxy at all.

      This is how I make https and mqtts available on ipv4.

      source

      • 2xsaiko@discuss.tchncs.de ⁨3⁩ ⁨weeks⁩ ago

        Oh interesting, I’ll have to look into that. Is this with that “proxy protocol” I’ve seen mentioned? If not, does this preserve it pass through the client socket address?

        source

        • -> View More Comments
    • amdim@lemmy.dbzer0.com ⁨3⁩ ⁨weeks⁩ ago

      I use this setup and don’t terminate SSL at the VPS and solely tunnel the encrypted traffic over a wire guard tunnel to the home lab where SSL is terminated.

      The VPS solely serves to move the traffic from an external IP to an internal one.

      It’s possible that someone could log into my server, change the nginx config to terminate SSL and then siphon data but it would take a few steps and can be somewhat mitigated by stapling the SSL certs that should be seen from the homelab.

      source