Comment on Security considerations about hosting Immich from home

possiblylinux127@lemmy.zip ⁨1⁩ ⁨month⁩ ago

• nfms@lemmy.ml ⁨1⁩ ⁨month⁩ ago

  I think this should be talked about more. Does every selfhosted app need to be public facing?
  I use Immich as a backup service, so i really don’t have any need to have it public facing. It connects when I’m home. Same with contacts/calendar.

  original

  • daniskarma@lemmy.dbzer0.com ⁨1⁩ ⁨month⁩ ago

    I have many services that doesn’t “need” to be public, as public facing for one specific reason. TLS.

    A lot of the times android apps won’t connect to http directions, not even local ones, and require a proper https connection with a well known CA.

    For that I put the services behind a caddy reverse proxy to get a valid tls certificate.

    And them I do the trick, and basically on caddy reject all connection that’s not local. Thus, making the supposedly “public” site a practical “local” one.

    Once there I just connect through wireguard.

    original

    • nfms@lemmy.ml ⁨5⁩ ⁨weeks⁩ ago

      Clever. I’m just starting to mess with Caddy. Been struggling with Vaultwarden lately and your solution might fit my needs.

      original

      • trilobite@lemmy.ml ⁨5⁩ ⁨weeks⁩ ago

        Yeah, i got stuck on this a few months ago when trying to set up Vaultwarden. I gave up for the time being. I need a proper guide that walks you through all the steps :-)

        original
  • trilobite@lemmy.ml ⁨5⁩ ⁨weeks⁩ ago

    I tend to agree. Slight problem is when u r away from home for long periods

    original