I have three services which are public. Jellyfin, Seer and BookOrbit (for syncing Kobos).

1000004791

don’t expose services to the internet. expose a proxy.

Imagine if your house had doors to the outside for every room in your house. not very secure, right?

I’m going to hope when you mentioned NPM you were referring to nginx proxy manager.

also, use a separate host for your proxy that is firewalled off from everything else on your network other than the host with your services and only on those specific ports. it doesn’t have to be powerful, just has to have a fast network connection. I wouldn’t use anything less than 1gbps. you could vlan as well, but that would require advanced routing or a second NIC for your services host. don’t forget to firewall your services host off the rest of your network.

finally, monitor the shit out of that proxy host. use SIEM tools like graylog, wazuh, splunk, etc. you cannot make an impenetrable fortress, it’s only a matter of time before you experience a penetration. setting up proper logging and alerting is imperative to securing your network.