Hi all,
I am running proxmox on a mini PC with a handful of services in my stack. I also run NPM in an LXC to reach my services through my domain name (service.domain.tld).
For my Arr related stuff, I use Usenet, and everything runs through a VPN.
I have three services which are public. Jellyfin, Seer and BookOrbit (for syncing Kobos).
Currently I have no security besides the built in login managers from the services, but I am considering setting up Authentik. I know I’m asking for trouble with my current set up.
I have elderly and extremely tech averse family members who live in two countries other than me, so tech support can be a challenge.
A lot of people suggest running a VPN, but it would be difficult for my family and I don’t know how to make it work syncing our Kobos with BookOrbit.
I’ve also seen some posts about tunneling to a VPS somewhere and users can connect to the VPS without a VPN.
I feel this question has been asked several times, and I tried searching here and on the internet in general, but my knowledge is not good enough to use the right terms and to get something that is idiot proof.
Any suggestions on best practices or links to guides you recommend would be much appreciated. Also, what EU based affordable VPS would you recommend?
Ask yourself: is there any service that really, really needs to be public? Or is this only about availability for you or a very limited group (family, friends), which could be implemented via a VPN solution?
It’s just for family, but elderly family in two different very far away countries, across multiple devices.
I have three services which are public. Jellyfin, Seer and BookOrbit (for syncing Kobos).
don’t expose services to the internet. expose a proxy.
Imagine if your house had doors to the outside for every room in your house. not very secure, right?
I’m going to hope when you mentioned NPM you were referring to nginx proxy manager.
also, use a separate host for your proxy that is firewalled off from everything else on your network other than the host with your services and only on those specific ports. it doesn’t have to be powerful, just has to have a fast network connection. I wouldn’t use anything less than 1gbps. you could vlan as well, but that would require advanced routing or a second NIC for your services host. don’t forget to firewall your services host off the rest of your network.
finally, monitor the shit out of that proxy host. use SIEM tools like graylog, wazuh, splunk, etc. you cannot make an impenetrable fortress, it’s only a matter of time before you experience a penetration. setting up proper logging and alerting is imperative to securing your network.
Yes everything goes through nginx proxy manager and I only forward port 443 in my router.
I guess running NPM on a raspberryPi could work?
it should as long as it’s got that 1gbps Ethernet. 100mbps just won’t be enough for video streaming with jellyfin.
having it separate also allows you to patch routinely with minimal downtime.
Get Jellyfin off the open internet. For family who’ll never install a VPN app, the setup that holds up is WireGuard on their router, or Tailscale on whatever TV box they use, set up before it ever ships to them. They never see it. If something has to stay public, CrowdSec plus Pocket-ID is a lot lighter than Authentik for three users. I’m building a home box that ships locked down like this by default, so I’m curious: which broke first for your family, remote access or the logins?
How would you handle a mother in law at a retirement community with a Roku and no access to the router that serves the condo?
Yeah that’s kinda my situation as well, but they have a firestick.
Pangolin on a cheap VPS.
If you don’t mind I’d share my scenario with you, but I’m far from a professional myself, so in the same time I’m also asking any thought about my own approach.
For my public facing services (e.g. Nextcloud) I’ve created a separate VLAN which is completely isolated from the rest of the system, I’ve deployed an nginx LXC with Crowdsec/fail2ban, and opened very specific “pinhole” style firewall rules towards the service layer VLAN in OPNsense. I’ve also separated this service / app VLAN layer from the database layer (which is another VLAN with strict firewall rules and SSL). For authentication I use what the service offers natively, except for some cases of keycloak / hardware key.
Based on my research, this should be a solid baseline, but honestly noone more knowledgeable than myself has confirmed it, so take it with a grain of salt.
I personally have been getting away from Nextcloud, because I feel it tries to do to much and does not do any of it great, except maybe file storage. It is also has a lot of php in its coding, so I have other services replacing it, and because I do not yet have the money to replace my iOS devices with stuff that can run GrapheneOS or Linux I use smb for file sharing. I do have a inexpensive VPS that hosts my blog and off site backup and that same host hosts my email (easyDNS), everything else is held locally.
If you are running crowdsec I hope that everything other than your honeypot (on its private vLAN) is using something other than port 22 for ssh?
Hm. I don’t think I had the chance to notice Nextcloud’s caveats as I’m the only user. I’ve set it up along with a collabora and Talk high-performance backend on separate vm-s, but I have noone to talk to as I’m the only user. <hide-the-pain-harold.jpg>
Speaking of GrapheneOS I used it on my Pixel8 for a year as daily driver, and it is great for the peace of mind of the privacy-cautious user, but at some point I came to the conclusion, that I want my mobile phone to be a single convenience device and returned to stock Android (I don’t like it, but this was a point of friction between my life and my hobby). I tried to live with an old Motorola Razr, then a modern 4G feature phone, tried using multiple phones, phone with a custom rom, GrapheneOS, but then my paranoia got defeated by everyday convenience.
VPS-es are useful, I totally agree. I have two usecases where I needed something with a static IP, and those were the solution attached to my home network with wireguard tunnel. 1. cloud connector to GoCardless to handle token exchange to retrieve my bank transaction information into an internal DB, and 2. email-relay server, so my mailcow instance can communicate with the world, but I don’t have to deal with mail traffic through my own firewall. Yeah these VPS-es have custom SSH ports, no password login, no root login, as I remember I’ve set it up to accept ssh connection only from the wireguard tunnel and fail2ban hands out ban for even pinging these VPS-es (yes, I managed to lock myself out twice. :D ).
Are you blogging about your homelab? I’d take a look if you don’t mind sharing the link just out of curiosity.
I am fairly confident I am not going to grant anyone access to homelab I do not know.
Oh, that is totally understandable, I wouldn’t even ask for that. I thought it would be a publicly accessible technical blog about homelabs in general.
You can see my blog blog.reannlegge.ca sure but I am not going to show off all of my services in a library
to get something that is idiot proof.
The problem with Jellyfin in particular is that it needs to support binary streaming protocols. You can implement some gateway/firewall-based security in front of Jellyfin, but in the end it is still Jellyfin’s internal mechanisms mostly responsible for its own security. I don’t use Authentik but I have read many good things. The only real “advantage” of it is that it forces your users to somewhat better credential handling. Jellyfin still only supports LDAP, so the users will have to enter their Authentik username and password – very similar to just local accounts managed by Jellyfin. So IMO, not offering you that much extra in terms of security. You will be better served by firewall tools like fail2ban, crowdsec, geo-fencing, etc.
Depending on where/how your users access Jellyfin you could have something a bit tighter. If they never run it on a TV you could do something more advanced like mTLS where you issue them a certificate with a TTL of several years, walk them through installing it on their phones/laptops, and then have that in a reverse proxy. But at that point you might as well walk them through setting up a VPN mesh network.
For Seerr, it’s just a standard web app .You could put a reverse proxy in front that requires OIDC with Authentik. Seerr is also pretty close to having native OIDC integration. Personally I prefer having two rounds of OIDC – reverse proxy really narrows what the public can see as a first layer.
For BookOrbit, I am not familiar enough with the Kobos. My guess is, you could put BookOrbit behind a reverse proxy that enforces OIDC, but you might have to allow a bypass for
/apiroute. Then you’re relying on BookOrbit to authenticate all/apirequests through API tokens. This would look like the normal Kobo linking process, so no real difference, but then your BookOrbit web UI is locked behind OIDC authentication.Hetzner is usually the top choice for non us cloud
Wireguard is fairly simple to configure and many routers support it; it could be made to be transparent to your relatives.