Hi all,
I am running proxmox on a mini PC with a handful of services in my stack. I also run NPM in an LXC to reach my services through my domain name (service.domain.tld).
For my Arr related stuff, I use Usenet, and everything runs through a VPN.
I have three services which are public. Jellyfin, Seer and BookOrbit (for syncing Kobos).
Currently I have no security besides the built in login managers from the services, but I am considering setting up Authentik. I know I’m asking for trouble with my current set up.
I have elderly and extremely tech averse family members who live in two countries other than me, so tech support can be a challenge.
A lot of people suggest running a VPN, but it would be difficult for my family and I don’t know how to make it work syncing our Kobos with BookOrbit.
I’ve also seen some posts about tunneling to a VPS somewhere and users can connect to the VPS without a VPN.
I feel this question has been asked several times, and I tried searching here and on the internet in general, but my knowledge is not good enough to use the right terms and to get something that is idiot proof.
Any suggestions on best practices or links to guides you recommend would be much appreciated. Also, what EU based affordable VPS would you recommend?
don’t expose services to the internet. expose a proxy.
Imagine if your house had doors to the outside for every room in your house. not very secure, right?
I’m going to hope when you mentioned NPM you were referring to nginx proxy manager.
also, use a separate host for your proxy that is firewalled off from everything else on your network other than the host with your services and only on those specific ports. it doesn’t have to be powerful, just has to have a fast network connection. I wouldn’t use anything less than 1gbps. you could vlan as well, but that would require advanced routing or a second NIC for your services host. don’t forget to firewall your services host off the rest of your network.
finally, monitor the shit out of that proxy host. use SIEM tools like graylog, wazuh, splunk, etc. you cannot make an impenetrable fortress, it’s only a matter of time before you experience a penetration. setting up proper logging and alerting is imperative to securing your network.
Yes everything goes through nginx proxy manager and I only forward port 443 in my router.
I guess running NPM on a raspberryPi could work?
it should as long as it’s got that 1gbps Ethernet. 100mbps just won’t be enough for video streaming with jellyfin.
having it separate also allows you to patch routinely with minimal downtime.