Hosting papermerge on company network reddit / selfhosted ---------------------------------------------------------------------- Jolly_Molasses6566 · 2023-10-23 20:45 Hello I own a small company and I would like to host papermerge locally in my office network. Ofc before I do that I have a question about security. My plan is to host papermerge on a Linux machine. (Docker or not) When it’s hosted on let’s say 192.168.0.x:8000 all the machines in the network are able to see it and login to their accounts and people can work with it. My questions are the following: If I am just running a Server inside my local network with http, am I right to assume that it should not be a big security concern? A malicious actor would need to go through my router before gaining access to a locally hosted service right? Is there usually a best practice way to forbid applications or docker containers to communicate with anything outside their specific network? Is this a stupid idea and I should rather not host anything? ---------------------------------------------------------------------- EnterpriseGuy52840 · 2023-10-23 21:07 If you can, secure with HTTPS (read: certificate deployment) and make sure you have login controls on that thing. ---------------------------------------------------------------------- Jolly_Molasses6566 · 2023-10-23 22:33 Thanks! Will read up on it. Login controls, meaning passwords for users and not running admin admin? ---------------------------------------------------------------------- EnterpriseGuy52840 · 2023-10-23 23:43 Yes. ---------------------------------------------------------------------- NotTryingToConYou · 2023-10-24 01:45 Agree that https will be better, but it is a little bit more hassle. If access from outside is not needed, lock it down to internal ips only. Or with a company vpn. Make sure to keep the thing updated and have some kind of monitoring on who's accessing it if you can. A reverse proxy like traefik can help with ease of use for employees and also offers observabilty/logging ---------------------------------------------------------------------- NotTryingToConYou · 2023-10-24 01:49 Also, I wouldn't say it's a stupid idea, but I think the better question to ask is: Does self hosting make business sense? That we can not answer for you without knowing more details. If you are tech savvy and can set up everything and maintain it, it shouldn't be an issue self hosting one service. But if there's more services, and more users, you might find that the time (which is money) you put in might be better spent elsewhere. Whether that be paying for a hosted version or hiring someone to take care of this. At the end of the day, one service shouldn't tip the scales and the benefit it will offer hoepfully outweighs the effort you'll put in - so long as you don't do dumb things and expose insecure stuff to the internet. ---------------------------------------------------------------------- Jolly_Molasses6566 · 2023-10-24 05:58 Yes thanks - from a business standpoint I considered it quite long and came to the conclusion that it makes sense for now. In future and with more resources available I would like to hire a network professional to rebuild our network and talk me through external hosting for multiple apps. I worked as a software dev before this so maintaining and updating Linux distros or containers is no problem. I just never touched security before even as a dev, except for basic basic stuff.