Comment on They Said Self-Hosting Was Hard! - arthurpizza

• realitaetsverlust@piefed.zip ⁨3⁩ ⁨weeks⁩ ago

  People who don’t care about security are the cancer of the selfhosting-world. Billions of devices are part of a botnet because lazy owners don’t care about even the most basic shit, like changing the stock password. It’s insane.

  source

  • autriyo@feddit.org ⁨3⁩ ⁨weeks⁩ ago

    Still feels like I’m doing too little, but kinda hate 2fa.

    And I kinda don’t want to know if complex passwords and low retries before an account gets locked out are enough.

    source

    • realitaetsverlust@piefed.zip ⁨3⁩ ⁨weeks⁩ ago

      And I kinda don’t want to know if complex passwords and low retries before an account gets locked out are enough.

      I’ve created a custom cert that I verify within my nginx proxy using ssl_client_certificate and ssl_verify_client on. I got that cert on every device I use in the browser storage, additionally on a USB stick on my keychain in case I’m on a foreign or new machine. That is so much easier that bothering with passwords and the likes.

      source

      • autriyo@feddit.org ⁨2⁩ ⁨weeks⁩ ago

        That would only work if I’m the only one using my hosted stuff, but can’t really expect non tech ppl to deal with stuff like that.

        They already struggle with the little 2fa they have to use. Introducing yet another system is too much to ask.

        source

        • -> View More Comments
  • LunaChocken@programming.dev ⁨2⁩ ⁨weeks⁩ ago

    A lot of people simply don’t have time to go the extra steps.

    Instead you should be focused on secure by default design. E.g. not setting a static router password to admin admin.

    It’s stupid in this day and age to continue to see default logins occur still.

    source

    • realitaetsverlust@piefed.zip ⁨2⁩ ⁨weeks⁩ ago

      simply don’t have time

      Sorry, but that is no reason. That’s a bit akin to having a dog and saying: “Nah I don’t have time to walk the dog now”. Selfhosting something that is publicly available (not as in “everyone can use it” but “everyone can access it") bears some level of responsibility. You either make the time to properly set up and maintain it, or you shouldn’t selfhost stuff.

      source
• LunaChocken@programming.dev ⁨3⁩ ⁨weeks⁩ ago

  I setup caddy and a proxy server for ingress.

  Essentially I have a server with wireguard connections between my home server and the external VM.

  Proxy using proxy protocol with nginx so it preserves the ip.

  DNS certificate management with cloudflare, and I’ve got Authelia in front of the majority of my websites, with some exclusion rules, say for a share link.

  Authelia has mandatory 2FA, anything less is silly, with Grafana alloy scrapping caddy metrics.

  Anywho most of my stuff runs in docker. The stuff I don’t want on the WAN but on tailscale/Lan has a filter to block the wireguard interface.

  source

  • Croquette@sh.itjust.works ⁨3⁩ ⁨weeks⁩ ago

    Tell that to someone starting out and look at their deer in the headlight face. Then you’ll realize that the point went over your head.

    source