Password on public services reddit / selfhosted ---------------------------------------------------------------------- jack_of_caruggi · 2023-10-06 11:11 hi, I have many container for many little services; many of this are public and without any password (dashboard, pdf tools, etc.) I just want to protect this services just with a password (no serious security; just not public) there is a simply way also quickly updatable for new services? what would you recommend to get started? now I use nginx proxy manager for https and domain name, but I can easly change to another service ---------------------------------------------------------------------- thekrautboy · 2023-10-06 11:26 Since you already use NPM you can enable very basic user/pass auth in there, nothing else required. Or combine with something like Authelia. /r/NginxProxyManager can help ---------------------------------------------------------------------- mirandanielcz · 2023-10-06 12:07 This is what I use with my NGINX setup: https://docs.nginx.com/nginx/admin-guide/security- controls/configuring-http-basic-authentication/ ---------------------------------------------------------------------- her3814 · 2023-10-06 12:32 As theyve already told you, you could try NGINX proxy manager, or as an alternative you could use CloudFare Tunnels which let you protect sites with some kind of security, usually you white list mails, when you try to access a site a code is sent to your email address and that gives you access to the site ---------------------------------------------------------------------- F1DNA · 2023-10-06 12:34 Wtf. Get everything off the Internet that doesn't need to be. Like your dashboard! There is absolutely no valid reason to ever put a dashboard on the internet. If you want to access that remotely, use a VPN. Things that make sense to be on the internet but require a certain level of security are nextcloud, plex or jellyfin, overseer. A dashboard? Absofucki glutely not. ---------------------------------------------------------------------- lilolalu · 2023-10-06 13:23 I would suggest Authentik + Traefik with Forward Auth. You can also use nginx but traefik seems easier for me if it's for docker containers. https://goauthentik.io/docs/providers/proxy/forward_auth ---------------------------------------------------------------------- jack_of_caruggi · 2023-10-06 13:27 it’s already off what I don’t need out of office 😅 that are tool specific… like my second dashboard with my common-use url ;) like google and duckduckgo 🤣 ---------------------------------------------------------------------- sk1nT7 · 2023-10-06 13:45 Access list of NPM, which adds Basic Authentication. Alternatively implement Authelia. ---------------------------------------------------------------------- xdocx · 2023-10-06 15:35 Authelia, authentik, keycloak... Plenty stuff like this ---------------------------------------------------------------------- jack_of_caruggi · 2023-10-06 15:36 really thanks ---------------------------------------------------------------------- jack_of_caruggi · 2023-10-06 15:37 thanks I will check soon ---------------------------------------------------------------------- jack_of_caruggi · 2023-10-06 15:38 oh thanks, that’s cool ---------------------------------------------------------------------- Schecher_1 · 2023-10-06 15:48 I actually use a Nginx reverse proxy for something like this. It then uses that typical htaccess file (basic auth). All you need to do is block the port(s) of the service so only the reverse proxy can access it. (Internal access only, no external access). For the reverse proxy, expose only port 80 and 443 and work with subdomains, like "plex.mydomain.com". ---------------------------------------------------------------------- Simon-RedditAccount · 2023-10-06 17:00 I use plain nginx (no NPM) with mTLS (aka TLS Client Certificates). Zero user interaction, impossible to bruteforce (unlike passwords). ---------------------------------------------------------------------- PaulEngineer-89 · 2023-10-07 03:05 Just run a VLAN like Tailscale and get that stuff off the internet. ---------------------------------------------------------------------- arcadianarcadian · 2023-10-10 09:41 Authelia, lightweight but does the job. ---------------------------------------------------------------------- slkdwkaWDm1kl23ksd · 2023-10-16 21:45 I’d love to implement something like this - got a write up or a guide you liked? ---------------------------------------------------------------------- Simon-RedditAccount · 2023-10-17 06:16 Also, I would recommend exporting end-user certs as .p12 file - it's the only way to install them on iOS, other OS support .p12 as well. ---------------------------------------------------------------------- slkdwkaWDm1kl23ksd · 2023-10-17 10:26 Thanks for the tip - I've read 20+ tutorials and people seem to use all sorts of extensions for the same files :) I've got a [minimal example](https://gist.github.com/ducklol2/65037956 7c7e0843b807a6fd588a515b) working, and if you have a minute to look and know the answer, there's a couple things I'm still trying to figure out in my quest for a minimal teaching example: * If it's possible to skip the Chrome `Select a certificate` prompt - setting the `CN` / `SAN` on the client cert didn't seem to help. * If it's possible to generate the client cert without a password. This [StackOverflow answer](https://superuser.com/a/1756649) doesn't seem to work for me - Chrome still prompts for a password (but it accepts an empty string). ---------------------------------------------------------------------- Simon-RedditAccount · 2023-10-17 10:41 I usually install the certificate into OS store (`certmgmt.msc`) and every browser happily worked with it. Only Firefox required importing into its own store. *> If it's possible to generate the client cert without a password.* IDK. I never exported certs without a password :) And once they're imported in OS store or FF, nobody asks for *file container* password any more. iOS Asks for Touch/FaceID; FF asks for Master password; Windows may ask for a Windows Hello PIN or whatever.