DIY web hosting safety tips?
reddit / selfhosted

----------------------------------------------------------------------
SavageSkillz75 · 2023-11-08 16:31

Hi all,

I've built a personal portfolio website for my photography hobby and
as a side project for myself to learn.

I'm using Node JS and Express to run a basic server on my raspberry pi
plugged into my home network. I'm using Nginx for proxy and SSL
encryption as well as UFW for firewall. This is as far as I know how
to do it safely, but I'm curious if there's anything I should be wary
about as I plan on having this site up 24/7.

Any advice is welcome, thanks!

----------------------------------------------------------------------
troubleshootmertr · 2023-11-08 16:57

I always put the following under location config in npm:

    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Real-IP $remote_addr;
    add_header Content-Security-Policy "default-src 'self'; connect-
src *; font-src * data:; frame-src *; img-src * data:; media-src *;
object-src *; script-src * 'unsafe-inline' 'unsafe-eval'; style-src *
'unsafe-inline';";
    add_header X-Frame-Options "SAMEORIGIN";
    add_header X-XSS-Protection "1; mode=block";
    add_header X-Content-Type-Options "nosniff";
    add_header Referrer-Policy 'strict-origin';

----------------------------------------------------------------------
SavageSkillz75 · 2023-11-08 17:24

Any explanation for what's these configs do? I'm new to node, no
problem if not!

----------------------------------------------------------------------
padamdam · 2023-11-08 18:19

Nginx ?

----------------------------------------------------------------------
troubleshootmertr · 2023-11-08 20:10

Essentially passes security-related headers to proxied app and
implements csrf and cors policy

----------------------------------------------------------------------
troubleshootmertr · 2023-11-08 23:54

Yes

----------------------------------------------------------------------
padamdam · 2023-11-09 08:07

You wrote npm mate !

----------------------------------------------------------------------
rrrmmmrrrmmm · 2023-11-09 13:29

There's an NGINX container which has [a bunch of security features
(i.e. WAF with OWASP, auto ban of strange actors, bot challenges,
integrated blocklists of bad actors, request limits etc) built-
in](https://docs.bunkerweb.io/latest/#security-features), is well
documented and even has an optional GUI.

It's called [Bunkerweb](https://www.bunkerweb.io/) and they're also at
/r/BunkerWeb [and Discord](https://discord.com/invite/fTf46FmtyD).