Securing self hosted applications reddit / selfhosted ---------------------------------------------------------------------- gigadigg · 2023-12-22 01:20 Hi All, I'm hoping this is the right sub-reddit for this question I couldn't really think of anywhere better. I have a few different self hosted applications for a variety of things (plex, a few \*arr applications and overseerr). All of these applications have their own login screens with 2FA enabled if possible for each user. At the moment I'm making these accessible outside of my network (so I can do things when I'm not home and also so my users can use overseerr) using a cloudflared tunnel and out via a cloudflare domain. Minus Plex which I'll mention later on. To further secure them I've also setup a few firewall rules on Cloudflare (based on cloudflares recommendations) that cover blocking certain countries, common security threats etc. I've setup two access groups, an admin and a user group. The user group only has access to Overseerr and can only access it via an OTP pin or a google login. The OTP is limited to a list of users and the same goes for the google login. The admin group only has myself with the option of a Github login only (as this way I was able to setup a passkey for quicker access), the admin group has access to everything (\*arrs and overseerr). I think I've covered myself as best as I can to avoid any unwelcome visitors or attention however is this overkill? Should I just rely on the firewall rules and disable the cloudflare authentication page? My other concern was Plex, I'm currently allowing remote access via a port forward on my router. Is this the safest way to do it? I have UPNP disabled on my router so nothing can be set automatically. TIA ---------------------------------------------------------------------- zfa · 2023-12-22 01:32 The Cloudflare Tunnel / Cloudflare Access is excellent for the secure accessing of web services. As for Plex my general advice is to stick it behind a proxy (by that I mean local nginx, obivously you can't use CF). As long as that proxy is not the default site and the subdomain you use is both: a) somewhat obtuse so it isn't likely to be rnadomly stumbled upon; b) secured by a wildcard cert so the subdomain name is never put into the CT logs where people would see it; Then it is not going to be seen by anyone even if they probe your IP. The hostname can be as convulted as you like as Plex users never see it, the standard plex authnetication process points the plex clients (inc web access via https://plex.tv) to the right server for each lib a user has access to. ---------------------------------------------------------------------- gigadigg · 2023-12-22 02:06 Thank you for your quick reply! Cloudflared is currently in a docker container but I'll look into only allowing it to access the things its meant to! I would rather be overkill than making my next post being "I've been hacked and don't know how". I'm not fully versed in the space of Nginx, I ran into [this](https://www.plexopedia.com/plex-media-server/general/plex- nginx-reverse-proxy/) guide which I was going to follow. It seems to cover what you mentioned? ---------------------------------------------------------------------- zfa · 2023-12-22 02:19 Plex link seems good, yes. As I said just make sure your plex site is not the default site (ie that which is seen if no host is passed or that doesn't match your defined sites), and use a wildcard SSL cert so you don't inadvertently publish the name. GL.