Hi all,

I am running proxmox on a mini PC with a handful of services in my stack. I also run NPM in an LXC to reach my services through my domain name (service.domain.tld).

For my Arr related stuff, I use Usenet, and everything runs through a VPN.

I have three services which are public. Jellyfin, Seer and BookOrbit (for syncing Kobos).

Currently I have no security besides the built in login managers from the services, but I am considering setting up Authentik. I know I’m asking for trouble with my current set up.

I have elderly and extremely tech averse family members who live in two countries other than me, so tech support can be a challenge.

A lot of people suggest running a VPN, but it would be difficult for my family and I don’t know how to make it work syncing our Kobos with BookOrbit.

I’ve also seen some posts about tunneling to a VPS somewhere and users can connect to the VPS without a VPN.

I feel this question has been asked several times, and I tried searching here and on the internet in general, but my knowledge is not good enough to use the right terms and to get something that is idiot proof.

Any suggestions on best practices or links to guides you recommend would be much appreciated. Also, what EU based affordable VPS would you recommend?

  • Reannlegge@lemmy.caEnglish
    61·
    6 hours ago

    I personally have been getting away from Nextcloud, because I feel it tries to do to much and does not do any of it great, except maybe file storage. It is also has a lot of php in its coding, so I have other services replacing it, and because I do not yet have the money to replace my iOS devices with stuff that can run GrapheneOS or Linux I use smb for file sharing. I do have a inexpensive VPS that hosts my blog and off site backup and that same host hosts my email (easyDNS), everything else is held locally.

    If you are running crowdsec I hope that everything other than your honeypot (on its private vLAN) is using something other than port 22 for ssh?

    • homelabrat@lemmy.worldEnglish
      11·
      5 hours ago

      Hm. I don’t think I had the chance to notice Nextcloud’s caveats as I’m the only user. I’ve set it up along with a collabora and Talk high-performance backend on separate vm-s, but I have noone to talk to as I’m the only user. <hide-the-pain-harold.jpg>

      Speaking of GrapheneOS I used it on my Pixel8 for a year as daily driver, and it is great for the peace of mind of the privacy-cautious user, but at some point I came to the conclusion, that I want my mobile phone to be a single convenience device and returned to stock Android (I don’t like it, but this was a point of friction between my life and my hobby). I tried to live with an old Motorola Razr, then a modern 4G feature phone, tried using multiple phones, phone with a custom rom, GrapheneOS, but then my paranoia got defeated by everyday convenience.

      VPS-es are useful, I totally agree. I have two usecases where I needed something with a static IP, and those were the solution attached to my home network with wireguard tunnel. 1. cloud connector to GoCardless to handle token exchange to retrieve my bank transaction information into an internal DB, and 2. email-relay server, so my mailcow instance can communicate with the world, but I don’t have to deal with mail traffic through my own firewall. Yeah these VPS-es have custom SSH ports, no password login, no root login, as I remember I’ve set it up to accept ssh connection only from the wireguard tunnel and fail2ban hands out ban for even pinging these VPS-es (yes, I managed to lock myself out twice. :D ).

      Are you blogging about your homelab? I’d take a look if you don’t mind sharing the link just out of curiosity.

      • Reannlegge@lemmy.caEnglish
        1·
        4 hours ago

        I am fairly confident I am not going to grant anyone access to homelab I do not know.