glizzyguzzler

@glizzyguzzler@piefed.blahaj.zone

This is a remote user, information on this page may be incomplete. View at Source ↗

⁨Comment⁩ on ⁨Your fav guide/method for securing Jellyfin?⁩ ⁨⁨2⁩ ⁨days⁩ ago⁩:
I’ve been thinking about using client-side certificates that are validated by Caddy to bypass the Authentik wall (proxy provider) I use. I’ll give it a shot some time, it’s a good idea
⁨Comment⁩ on ⁨Your fav guide/method for securing Jellyfin?⁩ ⁨⁨2⁩ ⁨days⁩ ago⁩:
Other user summarized very well.

No I have accrued knowledge of those things over time, no one stop shop that I know of. But knowing these things exist and their general use are half the battle!

I was lazy with the “Authentik wall” because I couldn’t remember what they called it. It is the “proxy” option in their “provider” section https://docs.goauthentik.io/add-secure-apps/providers/proxy/ . There are many guides for Authentik at least, it’s complicated but you only need to do specific things for it to work - and most tell you and the rest are applicable via matching similar looking things.

OIDC is an open login protocol many things support. I think jellyfin can use it with a plugin, but keep in mind that regular user creation still exists so it’s not a security and convenience feature like for most things, it’s just a convenience feature.

DMZ is de militarized zone. I used the acronym to mean a gap between your system and a system that deals directly with the outside Internet. That gap is the VM separation. LXC containers and docker containers do not have that separation, I deploy Internet-facing stuff in a VM as extra insurance in case they get zero-day-hacked; it means the rest of my server will hopefully not get ransomwared.

Incus is an alternative to proxmox, but less needy since it doesn’t require its own Linux kernel. Zabbly is a package source (vs built-in Debian sources) that has the web ui in it. See their documentation for installation, it tells you how to add the Zabbly package; use the “stable” version if you do use incus.

“In the compose” means in the docker-compose.yml file.

‘Cap-drop: all’ is an entry you can make in the docker-compose file. It increases security. All of the ones I listed are entries you can add to the docker-compose file. You’ll likely need a

tmpfs:
/tmp

In the compose file you use read only.

Podman is the superior alternative to docker, and Podman quadlets are a way to deploy containers (they have a couple ways, like docker does - you don’t need a docker-compose.yml file to run docker containers). But it’s new and doesn’t have the community knowledge support via searching like docker does.

Hope that helps!
⁨Comment⁩ on ⁨Docker or Proxmox? Something else entirely?⁩ ⁨⁨3⁩ ⁨days⁩ ago⁩:
Thanks for the links! I had no idea there were special settings needed
⁨Comment⁩ on ⁨Your fav guide/method for securing Jellyfin?⁩ ⁨⁨3⁩ ⁨days⁩ ago⁩:
I am not familiar with deploying client side certificates unfortunately. I hope it works, if the certificate is at the OS level and the application will use it, I feel it will work… not sure, in-browser feels straight forward at least
⁨Comment⁩ on ⁨Your fav guide/method for securing Jellyfin?⁩ ⁨⁨3⁩ ⁨days⁩ ago⁩:
Reading jellyfin’s issues it’s clear it’s web ui and API cannot be allowed to talk to the general internet.

I’d push for a VPN solution first. Tailscale or wireguard. If you’re happy with cloudflare sniffing all traffic and that they make take it away suddenly someday use their tunnel with authentication.

The only other novel solution I’d suggest is putting jellyfin behind an Authentik wall (not OIDC, though you can use OIDC for users after the wall). That puts security on Authentik, and that’s their only job so hopefully that works. I’d use that if VPN (tailscale or wireguard) are problematic for access. The downside is that jellyfin apps will not be able to connect, only web browsers that can log into the Authentik web ui wall.

Flow would go caddy/other reverse proxy -> Authentik wall for jellyfin -> jellyfin

I’d put everything in docker, I’d put caddy and Authentik in a VM for a DMZ (incus + Zabbly repo web ui to manage the VM), I’d set all 3 in the compose to read-only, user:####:####, cap-drop all, no new privileges, limited named networks.

Podman quadlets would be even better security than docker, but there’s less help for that (for now). Do docker and get something working to start, then grow from there
⁨Comment⁩ on ⁨Docker or Proxmox? Something else entirely?⁩ ⁨⁨3⁩ ⁨days⁩ ago⁩:
I’m looking at Opnsense on an Incus VM soon, what was your fight there? Good to know what I’ll hit ;)

Agreed on that path - some networking (like mimicking proxmox’s bridge connections which give VMs their own MAC/IP) takes effort to find the solution. But the basic LXC/VM-shares-your-IP works super easily and the script ability is great. Plus it doesn’t feel like a yoke on your system that is heavy and drives it, but just another application! I feel it’s close enough, and when you get it where you want it, it’s perf. I assume they’ll get “one click” solutions for the harder stuff baked in as they get more attention and traction.
⁨Comment⁩ on ⁨Docker or Proxmox? Something else entirely?⁩ ⁨⁨3⁩ ⁨days⁩ ago⁩:
If you’ve got Debian already installed, I cannot resist advocating for Incus (stable branch from Zabbly repo with web ui https://blog.simos.info/how-to-install-and-setup-the-incus-web-ui/) in lieu of proxmox. Does the same thing but you don’t have to rip out the kernel Debian uses.

With Debian 13 you have access to podman quadlets, use that for any non-vm needs. The ease of docker compose files easily removes reason for programs in LXC containers, and podman removes reason for docker in an LXC. LXC is left only for programs that aren’t containerized. VMs for security DMZ. Podman for bulk of stuff you want.

Good luck!
⁨Comment⁩ on ⁨IPv6 & Opnsense & Not Exposing Machine-Specific IPv6s to Corpos⁩ ⁨⁨1⁩ ⁨week⁩ ago⁩:
Right right things don’t just have one… from searching I’ve found “SLAAC assisted mode” allows for the router to let SLAAC SLAAC while also being able to declare addresses for a server. Thanks for that tiny note!
⁨Comment⁩ on ⁨Exposing docker socket to a container⁩ ⁨⁨1⁩ ⁨week⁩ ago⁩:
I wanted Jellyfin on its own IP so I could think about implementing VLANs. I havent yet, and I’m not sure what I did is even needed. But I did do it! You very likely don’t need to do it.

There are likely guides on enabling Jellyfin hardware acceleration on your Asustor NAS - so just follow them!

I do try to set up separate networks for each service.

On one server I have a monolithic docker compose file with a ton of networks defined to keep services from talking to the internet or each other if it’s not useful (pdf converter is prevented from talking to the internet or the Authentik database, for example). Makes the most sense here, has the most power.

On this server I have each service split up with its own docker compose file. The network bit makes more sense on services that have an external database and other bits, it lets me set it up so only the service can talk to its database and its database cannot reach the internet at large (via adding a ‘internal: true’ to the networks: section). In this case, yes the pdf converter can talk to other services and I’d need to block its internet access at the router somehow.

The monolithic method gets more annoying to deal with with many services via virtue of a gigantic docker compose file and the up/down time (esp. for services that don’t acknowledge shutdown commands). But it lets me use fine-grained networking within the docker compose file.

For each service on its own, they expose a port and things talk to them from there. So instead of an internal docker network letting Authentik talk to a service, Authentik just looks up the address of the service. I don’t notice any difference in perceptible lag.
⁨Comment⁩ on ⁨IPv6 & Opnsense & Not Exposing Machine-Specific IPv6s to Corpos⁩ ⁨⁨1⁩ ⁨week⁩ ago⁩:
Good to know, didn’t know IPv6 can come with efficiency gains. Makes sense since the designers had a beat to think about why IPv4 sucks. I’ll avoid NAT IPv6
⁨Comment⁩ on ⁨IPv6 & Opnsense & Not Exposing Machine-Specific IPv6s to Corpos⁩ ⁨⁨1⁩ ⁨week⁩ ago⁩:
I got it, ULA for everything that doesn’t care, 1 GUA for the server. When everything else starts to care about the lack of IPv6 or has routing issues, convert the ULA to GUA and rock n roll.

Thanks for providing a sane way to approach it slowly and methodically!
⁨Comment⁩ on ⁨IPv6 & Opnsense & Not Exposing Machine-Specific IPv6s to Corpos⁩ ⁨⁨1⁩ ⁨week⁩ ago⁩:
I do appreciate you taking the time to write that up! Is the 50.50.0.0/22 crossing US and EU IPv4 allocations? From searching it looks like it’s around the boundary between US and Germany allocations. Interesting, I had no idea IP anonymization existed or was applied in such a haphazard way
⁨Comment⁩ on ⁨IPv6 & Opnsense & Not Exposing Machine-Specific IPv6s to Corpos⁩ ⁨⁨1⁩ ⁨week⁩ ago⁩:
Thanks for writing this up, really highlights the effective differences.

So for the internal delegation I’d SLAAC it and let things “just work” or DHCPv6 if I cared to specify IPv6s (which I will need to to have a static IPv6 address for a server to be reached at). Thanks again!
⁨Comment⁩ on ⁨IPv6 & Opnsense & Not Exposing Machine-Specific IPv6s to Corpos⁩ ⁨⁨1⁩ ⁨week⁩ ago⁩:
Thanks for taking the time to go into detail on this, it helps because I just haven’t been able to put acronyms to actionable meaning from just reading blogs and posts.

How do things outside the LAN talk to things inside the LAN that have ULA addresses (which I’m assuming are equivalent of 10.0.0.0/16 idea)? Will devices that are given ULA addresses be NAT’d just like IPv4 or will they not be able to talk to the outside world on IPv6?
⁨Comment⁩ on ⁨IPv6 & Opnsense & Not Exposing Machine-Specific IPv6s to Corpos⁩ ⁨⁨1⁩ ⁨week⁩ ago⁩:
I see now that a limitation I just understood for IPv4 (expose one port from one device only on the router) isn’t a thing for IPv6 working without NAT, every device on a LAN can be given a world wide routable address and expose the same port. Interesting, in my home I don’t think I’d ever run into that, but I can see issues like that pile up quick in big deployments.

Thanks for taking the time to explain all of this in detail!
⁨Comment⁩ on ⁨IPv6 & Opnsense & Not Exposing Machine-Specific IPv6s to Corpos⁩ ⁨⁨1⁩ ⁨week⁩ ago⁩:
I gather people talk like NAT is a rung of hell, but I guess it works because I never think of it. Maybe it becomes shittastic at multiple NATs? With one router it seems straight forward to have port forwarding.

I do not understand why I want better inbound connections - but maybe if I get hit with a cgnat then I’ll understand?
⁨Comment⁩ on ⁨IPv6 & Opnsense & Not Exposing Machine-Specific IPv6s to Corpos⁩ ⁨⁨1⁩ ⁨week⁩ ago⁩:
Mobile devices are largely IPv6-only now, messing with VPN to home. The IPv6-to-4 conversion seems to be shoddy for my mobile carrier.

Not here for what it represents, just want it to work.

I haven’t run into NAT issues that I’ve noticed, would IPv6 avoid issues with cgnat that people complain about? (If/when it happens in the future)
⁨Comment⁩ on ⁨IPv6 & Opnsense & Not Exposing Machine-Specific IPv6s to Corpos⁩ ⁨⁨1⁩ ⁨week⁩ ago⁩:
I know, but when you get captcha’d all of the time you feel like you’re kinda winning (but not really of course). I don’t want them to just have a nice fingerprint of my devices without having to try at all. I see others have mentioned “IPv6 privacy extensions” that let the devices cycle the multitude of IPv6 address space to keep a semblance of privacy - that seems to be the “default” solution
⁨Comment⁩ on ⁨IPv6 & Opnsense & Not Exposing Machine-Specific IPv6s to Corpos⁩ ⁨⁨1⁩ ⁨week⁩ ago⁩:
I see, I saw someone else mention “IPv6 privacy extensions”. So basically it’s up to the individual devices to handle privacy instead of the router doing it for them in IPv6 land
⁨Comment⁩ on ⁨IPv6 & Opnsense & Not Exposing Machine-Specific IPv6s to Corpos⁩ ⁨⁨1⁩ ⁨week⁩ ago⁩:
I had never picked up on this, thank you for name dropping what to look for!
⁨Comment⁩ on ⁨IPv6 & Opnsense & Not Exposing Machine-Specific IPv6s to Corpos⁩ ⁨⁨1⁩ ⁨week⁩ ago⁩:
I see people say “not worth it” but never expound on what exactly makes it not worth it?

Most I get is a vibe (using a metaphor) “python-like judging where people prefer to do it in a ‘pythonic’ way” but of course that’s silly. There must be more to it, but I never seen interoperability issues called out
⁨Comment⁩ on ⁨IPv6 & Opnsense & Not Exposing Machine-Specific IPv6s to Corpos⁩ ⁨⁨1⁩ ⁨week⁩ ago⁩:
Thank you for the guide! It’s very straightforward and looks hella easy to implement. From reading it I would not have guessed it would do what I wished
IPv6 & Opnsense & Not Exposing Machine-Specific IPv6s to Corpos
Submitted ⁨⁨1⁩ ⁨week⁩ ago⁩ to ⁨selfhosted@lemmy.world⁩ | ⁨32⁩ ⁨comments⁩

⁨Comment⁩ on ⁨Exposing docker socket to a container⁩ ⁨⁨1⁩ ⁨week⁩ ago⁩:

So I've found that if you use the user: option with a user: UserName it requires the container to have that UserName alsoo inside. If you do it with a UID/GID, it maps the container's default user (likely root 0) to the UID/GID you provide user: 1500:1500. For many containers it just works, for linuxserver (a group that produces containers for stuff) containers I think it biffs it - those are way jacked up. I put the containers that won't play ball in a LXC container (via Incus GUI), or for simple permission fixes I just make a permissions-fixing version of the container (runs as root, but only executes commands I provide) to fill a volume with the data that has the right permissions then load that volume into the container. Luckily jellyfin doesn't need that.

I give jellyfin read-only access (via :ro in the volumes:) to my media stuff because it doesn't need to write to it. I think it's fine if your use-case needs :rw, keep a backup (even if you :ro!).

Here's my docker-compose.yml, I gave jellyfin its own IP with macvlan. It's pretty janky and I'm still working it, but you can have jellyfin use your server's IP by deleting everything after jellyfin-nw: (but keepjellyfin-nw:!) in both the networks: section and services: section. Delete the mac: in the services: section too. In the ports: part that 10.0.1.69 would be the IP of your server (or in this case, what I declare the jellyfin container's IP to be) - it makes it so the container can only bind to the IP you provide, otherwise it can bind to anything the server has access to (as far as I understand).

And of course, I have GPU acceleration working here with some embeded Intel iGPU. Hope this helps!

# --- NETWORKS ---
networks:
  jellyfin-nw:
    # In docker, `macvlan` gets similar stuff to 
    driver: macvlan
    driver_opts:
        parent: 'br0'
    #    mode: 'l2'
    name: 'doc0'
    ipam:
        config:
          - subnet: "10.0.1.0/24"
            gateway: "10.0.1.1"

# --- SERVICES ---
services:
    jellyfin:
        container_name: jellyfin
        image: ghcr.io/jellyfin/jellyfin:latest
        environment:
          - TZ=America/Los_Angeles
          - JELLYFIN_PublishedServerUrl=https://jellyfin.guzzlezone.local
        ports:
          - '10.0.1.69:8096:8096/tcp'
          - '10.0.1.69:7359:7359/udp'
          - '10.0.1.69:1900:1900/udp'
        devices:
          - '/dev/dri/renderD128:/dev/dri/renderD128'
        #  - '/dev/dri/card0:/dev/dri/card0'
        volumes:
          - '/mnt/ssd/jellyfin/config:/config:rw,noexec,nosuid,nodev,Z'
          - '/mnt/cache/jellyfin/log:/config/log:rw,noexec,nosuid,nodev,Z'
          - '/mnt/cache/jellyfin/cache:/cache:rw,noexec,nosuid,nodev,Z'
          - '/mnt/cache/jellyfin/config-cache:/config/cache:rw,noexec,nosuid,nodev,Z'
          # Media links below
          - '/mnt/spinner/movies:/data/movies:ro,noexec,nosuid,nodev,z'
          - '/mnt/spinner/shows:/data/shows:ro,noexec,nosuid,nodev,z'
          - '/mnt/spinner/music:/data/music:ro,noexec,nosuid,nodev,z'
        restart: unless-stopped
        # Security stuff
        read_only: true
        tmpfs:
          - /tmp:uid=2200,gid=2200,rw,noexec,nosuid,nodev
        # mac address is 02:42 then 10.0.1.69 in hex for each # betwen the .s mapped to the :s in the mac address
        # its how docker assigns so there will never be a mac address collision
        mac_address: 02:42:0A:00:01:45
        networks:
            jellyfin-nw:
                # Docker is pretty jacked up and can't get an IP via DHCP so manually specify it
                ipv4_address: 10.0.1.69
        user: 2200:2200
        # gpu capability needs render capability, see the # for your server with `getent group render | cut -d: -f3`
        group_add:
          - "109"
        security_opt:
          - no-new-privileges:true
        cap_drop:
          - ALL

⁨Comment⁩ on ⁨Exposing docker socket to a container⁩ ⁨⁨1⁩ ⁨week⁩ ago⁩:
Per this guide https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html I do not. I have a cron/service script that updates containers automatically (‘docker compose pull’ I think) that I don’t care if they fail for a bit (pdf converter, RSS reader, etc.) or they’re exposed to the internet directly (Authentik, caddy).

Note that smart peeps say that the docker socket is not safe as read-only. Watchtower is inherently untenable sadly, so is Traefik (trusting a docker-socket-proxy container with giga root permissions only made sense to me if you could audit the whole thing and keep auditing with updates and I cannot). https://stackoverflow.com/a/52333163 https://blog.quarkslab.com/why-is-exposing-the-docker-socket-a-really-bad-idea.html

I then just have scripts to do the ‘docker compose pull’ for things with oodles of breaking changes (Immich) or things I’d care if they did break suddenly (paperless).

Overall, I’ve only had a few break over a few years - and that’s because I also run all services (per link above) as a user, read-only, and with no capabilities (that aren’t required, afaik none need any). And while some containers are well coded, many are not, and if an update makes changes that want to write to ‘/npm/staging’ suddenly, the read-only torches that until I can figure it out and put in a tmpfs fix. The few failures are worth the peace of mind that it’s locked the fuck down.

I hope to move to podman sometime to eliminate the last security risk - the docker daemon running the containers, which runs as root. Rootless docker seems to be a significant hassle to do at any scale, so I haven’t bothered with that.
⁨Comment⁩ on ⁨Securing a 'public' service for family⁩ ⁨⁨1⁩ ⁨week⁩ ago⁩:
Just came back to say the same thing, I use this for geo ip blocking and it’s so well featured it’s insane. Any VPS, just make sure to clear local IPs (incl. docker range if using docker - though it’s been improving so much it may handle that automatically now)

https://github.com/friendly-bits/geoip-shell
⁨Comment⁩ on ⁨Securing a 'public' service for family⁩ ⁨⁨1⁩ ⁨week⁩ ago⁩:
Assuming you’re accessing the service (Peertube in this case) from a web browser and not an app - a thing I decided on “good enough” plus “easy enough” is Authentik sitting in front of the service.

Thought process is: Peertube or some other service’s first job is the purpose for the service, so security likely won’t be as good as a service who’s first job is security.

Authentik can also do stuff like OIDC if the service likes it - and you can chain them together. I’ve got services that hit Authentik 1st and then after you’re allowed to talk to service then you can log in with Authentik OIDC. Some services seem to do it seamlessly, some make you click a “log in with Authentik” again - either way painless enough. Everyone I know is haunted by the MS “remember this login y/n” page that pops up every time you log into some stupid MS thing and it never matters if you choose y or n, it’ll be back. So even 2 steps are chill in comparison for them.

Harden Authentik, and then you can apply it to any other service you want in the future too (maybe stirling PDF, don’t even need users for that). (Feel free to harden Peertube though too - just less important and likely not needed!)
⁨Comment⁩ on ⁨Turn linux server into a router?⁩ ⁨⁨2⁩ ⁨weeks⁩ ago⁩:
Add to that, for an extant installation I’d rec Incus for the VM work with its web-ui. You get to keep your kernel, you’re less tied at the hip to it.

2 port Intel NIC + some switch and your server is a router too. Opnsense’s web ui is great, can be difficult to find stuff but searching gets you there, but most is easy enough and it’s the best web ui + automatic updates for routers out there.
⁨Comment⁩ on ⁨Router suggestions for a complete noob⁩ ⁨⁨2⁩ ⁨weeks⁩ ago⁩:
I’d recc either the Unifi dream router (wifi 6 version for $200, just put a watch on the Unifi page to get it, they come back on the reg) for a one stop shop

or

A Dell Wyze 5070 Extended (make sure you get the power brick, needs to be the 130W one for a PCIe device) + some 2 port 1Gbps intel nic and you install opnsense on it directly or in a VM on top of incus/proxmox + external wifi like a Unifi AP + external switch with PoE++ or whatever the AP needs

Both options are gonna exceed $150 (unless you get fire deals on a super small PC that can hold a PCIe card), but they’ll be great and last. The opnsense box will be here forever, I’ve had mine for a long time now and it’s never given me trouble. External Unifi ap is solid as well, mesh out if needed easily too. Friend has the dream router and it’s also giving no trouble - but at some point Unifi will ditch the security updates and such, but that’s a long ways away for such a solid all in one (plus future mesh as needed)

I never could get openwrt devices to update how I’d like (automatically, not clear all settings), but opnsense does that no problem. I’ve heard from many people that you need proprietary wifi - the openwrt wifi is meh at best F tier at worst. So you bring your super router with an external wifi (or just the Unifi all-in-one).

You can flip out Unifi ap or Tp link Omada ap (spelling might be off), but I liked the look of the Unifi controller software better and trust them a smidge more than tp link for local controller software that’s always on

You can get away with an older cheaper wifi 5 Unifi ap easily also.
⁨Comment⁩ on ⁨Laboratory note book for my new research group⁩ ⁨⁨1⁩ ⁨month⁩ ago⁩:
Idk if latex is optimal for note taking, or if others will warm to it if forced, but overleaf is obv collaborative though not selfhosted.

I’ve liked Outline https://www.getoutline.com/ and while I haven’t used it collaboratively, it really highlights that it’s a primary goal. It’s supposed to be a collaborative/dynamic wyswyg wiki thing. You need a SSO service like authentik or authelia for it, it doesn’t do login. But that’s good for security anyway!