Selfhosted

39937 readers

347 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
No trolling.

Resources:

selfh.st Newsletter and index of selfhosted software and apps
awesome-selfhosted software
awesome-sysadmin resources
Self-Hosted Podcast from Jupiter Broadcasting

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 1 year ago

MODERATORS

[email protected]

Help and questions on my current setup (lemmy.world)

submitted 9 months ago by [email protected] to c/[email protected]

11 comments fedilink hide all child comments

Hi, my current setup is the following

Windows server pc with hyperV (it's a weird choice I know but I wanted to experiment with stuff I'm also using at work) hosting some VMs:

OPNSense (doing dhcp server)
owncloud (personal cloud)
pihole

Till yesterday I had a fix public IP to reach my owncloud via port forwarding from my work laptop and as well my two desktop (outside my network)

Can you suggest a more secure way of doing it? Any general other suggestion to make my setup better?

Thank you

PS: i have no budget constrain but I'm usually not prompt to waste money :D

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 2 points 9 months ago (1 children)

Tailscale would be the most "secure" as you have no ports open and only you can access it. Keep in mind your services will only be accessible by you along as all your devices connect to your tailscale instance. Sharing access is possible but will require some explanation.

Wireguard is another option, just as secure as the first option, it will need one port open but the port only responds if you are connecting with proper keys/authentication. Like tailscale you can only access your services if connected to your wireguard instance.

I disagree. Tailscale has a much higher attack surface since the network is controlled by a separate entity, tailscale. As on pure wireguard, you would need to first compromise one of your clients to get into the network.

Also tailscale is a much higher value target since you could compromise thousands of devices/networks/communication with 'just' compromising the vendors network.

[–] [email protected] 2 points 9 months ago

You have an excellent point, it seems like tailscale would have a larger attack surface.

I wonder if credentials are hashed in some way on tailscale servers, so even with an attacker gaining access to their servers it would essentially be useless to them.