A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
For Example
We welcome posts that include suggestions for good self-hosted alternatives to popular online services, how they are better, or how they give back control of your data. Also include hints and tips for less technical readers.
Useful Lists
Everything in my LAN is TLS-protected. Primarily because of convenience (no 'unsafe' warnings), unification (all I do everywhere is TLS). Also for learning purposes (I like challenges). Security is on the last place here (but is still important to me).
Probably your main threat is not people, but malware. Especially since they are not tech-savy. Remember how $35M of crypto assets were recently stolen: in the beginning it was a LastPass engineer who did not update his Plex instance.
I use traefik as reverse proxy in front of my services and have it generate let‘s encrypt certificates with dns-challenge. Do Inexpect MIM attacks at my home. No not necessarily because they would be physical access to my infrastructure but yeah having it this way feels just better.
So wait, if you say you got LE certs for mydomain.com why not activate HTTPS in NPM? If you set up the NPM config for jellyfin.mydomain.com with "Force SSL" then you should always have an encrypted connection.
I do something similar:
Incoming traffic ---[https traffic]---> reverse proxy ---[https traffic]---> real services (emby, etc).
The traffic from my browser to the reverse proxy is encrypted with TLS certs from letsencrypt. Whenever possible (it usually is), I configure the real services to expose HTTPS endpoints even if they are just with self-signed certs. That way the proxy-to-service traffic is also encrypted.
maybe this a dumb point, but you can hide it behind reverse proxy all you want but you will also need to FW off the actual service from the rest of the network, as otherwise it's still accessible via 192.168.x.x
It's worth it. At some point you might enconter a service that requires SSL to work even on LAN. I treat them like pipes. The fewer pipes i need to pipe traffic through, the easier it is.
I use split DNS to access services locally, over the internet and via VPN. Everything is behind a Traefik proxy that uses wildcard certs. It enforces SSL for everything and I have just one pipe to think about.
You've got tech illiterate family and for some reason you're concerned that they're going to snoop packets on your LAN and find passwords...?
But uncle joe might have some spyware on his laptop which does it...
There are nicer ways to say that...
No lmfao, my concern that they’d be using a compromised device on the LAN, not snooping packets themselves.
That's a fair call. VLANs would help if you have the option to create a guest network within your environment. If you did want to set up encrypted traffic within the network, you're starting to bridge into zero trust. Which is a great technology to get to know in today's cyber security landscape.
The phone call is from the inside!