General security concerns with self-hosted services reddit / selfhosted ---------------------------------------------------------------------- SecondSkoll · 2023-10-19 01:49 I'm relatively new to self-hosting, and I'm wondering what additional security the community might recommend for my setup. I initially started because I wanted to host a VTT for my friends and I to play D&D, so I spun up a Foundry server, and that's now expanded to a few other services hosted on a NUC. I know a lot of you use services that aren't intended for public access, and use things like Cloudflare Zero Trust, or Tailscale, but I don't know if they're really applicable to my use case and if I should expand my current security measures / what to implement from here. As a summary, I have a domain that uses Cloudflare DNS to route to my IP through Cloudflare's proxy service, my router directs HTTP/HTTPS traffic to an Nginx reverse proxy which then sends traffic to specific services based on FQDN. The NUC has UFW and only specific ports are allowed, and Nmap shows only HTTP/HTTPS ports open (both through my domain and my IP). Also, most of the services are running in Docker containers. The services I run are intended for external consumption by a limited number of users, and I don't really want to have them jump through hoops and force Zero Trust or an equivalent on them. Would you say my setup is relatively safe? What security measures would you change or put in place? ---------------------------------------------------------------------- No_Dragonfruit_5882 · 2023-10-19 02:25 First of all => Always expect the worst and then minimize the damage. In your Case => Currently if your Server gets bricked all your devices are reachable and you whole private network got compromised from Smartphone to Smart Lightbulb. ==> do seperate Networks (guest / lan / selfhosted) . With this configuration if really someone gets into the network, only a section gets compromised and your lan and guest network is still safe. 2. Reverseproxy is great if configured correctly. 3. Docker is good aswell, just keep in mind that every container bypasses the ufw Firewall and the traffic goes str8 into the container. If that would be my Network these would be the steps i would take: -Setup VLAN's and firewall configuration -Install Crowdsec -Setup access acl in reverseproxy -Setup ratelimiting on every source that can hit your Server -Check if all forwarded Ports are still needee -Update EVERYTHING -Scan my Network from the outside using Nmap again -Run the Openvas vun scanner to Check for vuns in Software i run -Educate urself about security + new emerging threads -Setup Network Monitoring + Alerting on change Ps: in some cases you can setup dnsblock and / or geoip Blocks aswell ( Main Attacks come from Russia / China) ---------------------------------------------------------------------- SecondSkoll · 2023-10-19 02:59 Thanks for the reply. I'll look into all of this :) Side question: Was this not an appropriate post/question for the community? Did I miss posts covering this same topic? Or did I have the wrong flair or something? Despite lurking, I'm not super familiar with reddit so I'm unsure why this post was received poorly. ---------------------------------------------------------------------- schklom · 2023-10-19 10:35 Docker bypasses UFW, but Rootless Docker does not :) ---------------------------------------------------------------------- virgoerns · 2023-10-19 10:58 Regarding Docker bypassing UFW, AFAIR if you don't want this behaviour, you should forward ports (in your docker commands or docker-compose.yml) like 127.0.0.1:3000:80 instead of 3000:80. Unless there's something else going on when you say that Docker bypasses UFW? ---------------------------------------------------------------------- No_Dragonfruit_5882 · 2023-10-19 16:41 Setup docker in rootless mode ---------------------------------------------------------------------- No_Dragonfruit_5882 · 2023-10-19 16:42 Thanks mate! Its important to say but i thought i got everything in the text above, guess not. Thanks again. Ps: if you are running anything in production, the way to go is to run docker rootless