Question about Cloud Zero Trust Services (Cloudflare)
reddit / selfhosted

----------------------------------------------------------------------
4cki · 2023-10-03 11:55

*Information to my setup:*

I often read discussion about security issues, what ports to open and
what not to expose. This is pretty clear to me. I host quite an array
of services in/out of my home, but I only expose very few (3) of them,
namely those I need access to from the outside world.

* Vaultwarden
* Stirling-PDF
* Uptime Kuma

Now I  expose those 3 via Cloudflare Zero Trust (and yes I don't mind
the risk, that they could make the services a paid services).

I have Vaultwarden exposed through Zero Trust only and for Stirling
PDF and Uptime Kuma I added my Azure as pre-Authentication
Application. I can't do that for Vaultwarden, as this would make the
iOS / Android Apps not useable or limit the useability a lot.

Also I have no ports open to the outside internet and a dynamic IP-
Address.

​

>Should I still look into hardening my Server / NAS or can this be
considered secure enough?

​

----------------------------------------------------------------------
NekoLuka · 2023-10-03 12:33

It's never a bad idea to harden security, since your services are
still accessible from the internet, cloudflare or not.

----------------------------------------------------------------------
ericesev · 2023-10-03 16:22

Vaultwarden would be the one I'd prioritize hardening first, since
it's accessible without pre-Authentication. Add AppArmor/SELinux to
confine it if you'd like. However, it's written in Rust, so I think
it's fairly safe already.

>and yes I don't mind the risk, that they could make the service a
paid service

The other downside is that they can see all your data. Just mentioning
that in case you weren't aware. I still use CF for public sites.