We install Debian, Docker, Immich, and even Nextcloud and run a tiny self-hosted virtual Homelab. 0:00 Intro 0:30 Virtual Machine Setup 5:11 First Boot 5:45 SSH Login 6:35 Docker without Sudo 8:06 ...
People who don’t care about security are the cancer of the selfhosting-world. Billions of devices are part of a botnet because lazy/stupid owners don’t care about even the most basic shit, like changing the stock password. It’s insane.
Essentially I have a server with wireguard connections between my home server and the external VM.
Proxy using proxy protocol with nginx so it preserves the ip.
DNS certificate management with cloudflare, and I’ve got Authelia in front of the majority of my websites, with some exclusion rules, say for a share link.
Authelia has mandatory 2FA, anything less is silly, with Grafana alloy scrapping caddy metrics.
Anywho most of my stuff runs in docker. The stuff I don’t want on the WAN but on tailscale/Lan has a filter to block the wireguard interface.
As long as you don’t directly connect it to the internet, it’s not hard.
When you do, it does become hard.
Only if you care about security, which you should ofc.
People who don’t care about security are the cancer of the selfhosting-world. Billions of devices are part of a botnet because lazy/stupid owners don’t care about even the most basic shit, like changing the stock password. It’s insane.
Still feels like I’m doing too little, but kinda hate 2fa.
And I kinda don’t want to know if complex passwords and low retries before an account gets locked out are enough.
I setup caddy and a proxy server for ingress.
Essentially I have a server with wireguard connections between my home server and the external VM.
Proxy using proxy protocol with nginx so it preserves the ip.
DNS certificate management with cloudflare, and I’ve got Authelia in front of the majority of my websites, with some exclusion rules, say for a share link.
Authelia has mandatory 2FA, anything less is silly, with Grafana alloy scrapping caddy metrics.
Anywho most of my stuff runs in docker. The stuff I don’t want on the WAN but on tailscale/Lan has a filter to block the wireguard interface.
Tell that to someone starting out and look at their deer in the headlight face. Then you’ll realize that the point went over your head.