vpn on nextcloud?

Submitted ⁨⁨10⁩ ⁨months⁩ ago⁩ by ⁨milkytoast@kbin.social⁩ to ⁨selfhosted@lemmy.world⁩

https://kbin.social/m/selfhosted@lemmy.world/t/771146

I plan to selfhost nextcloud, for now just for bookmark sync. is there a point to installing a vpn on the computer running the instance? it shouldnt matter as long as i have https right? what about if i dont have a domain? i cant have https without a domain (ill buy one later just want everything to work first). or maybe use one of those free domain providers for now to get https? what do you guys think?

source

Comments

Sort:hotnew top

beta_tester@lemmy.ml ⁨10⁩ ⁨months⁩ ago
I’d use a free dynamic dns hoster

You can get SSL easily with ngninx proxy manager and letsencrypt

Easy setup with podman or docker compose nextcloud

github.com/nextcloud/docker#running-this-image-wi…

And

nginxproxymanager.com/guide/#quick-setup

source
Telodzrum@lemmy.world ⁨10⁩ ⁨months⁩ ago
This is all going to depend on your risk tolerance, overall attack surface, and network topology.

source
- milkytoast@kbin.social ⁨10⁩ ⁨months⁩ ago
  whats attack surface and network topology?
  
  source
  - BearOfaTime@lemm.ee ⁨10⁩ ⁨months⁩ ago
    If you don’t understand these terms, you probably shouldn’t be exposing any kind of port on your router. Seriously, not being snarky.
    
    I used to teach multiple levels of Cisco classes, and I wouldn’t expose a port these days, I don’t know enough.
    
    I stead, I’d recommend using Tailscale on a home machine and your mobile devices.
    
    Using Tailscale, you can also selectively expose a service to the wider world (not just devices running Tailscale), using the Funnel feature.
    
    I’d say it’s your safest intro to accessing self-hosted resources from just about anywhere.
    
    source
    -> View More Comments
  - SGG@lemmy.world ⁨10⁩ ⁨months⁩ ago
    In very basic terms, and why you want to do them:
    
    Attack surface is the ports and services you are exposing to the internet. Keep this as small as possible to reduce the ways your setup can be attacked.
    
    Network topology is the layout of your home network. Do you have multiple vlans/subnets, firewalls that restrict traffic between internal networks, a DMZ is probably a simple enough approach that is available on some home grade routers. This is so if your server gets breached it minimises the amount of damage that can be done to other devices in the network.
    
    source