Selfhosted
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
-
No spam posting.
-
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
-
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
-
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
-
No trolling.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
view the rest of the comments
@operator
Cloudflared tunnels are great. No firewall ports to open.
I installed the Cloudflared docker, which is headless, and fed it my API key. Then Cloudflared creates a VPN between your system and theirs. Then, think of Cloudflare as the reverse proxy, you just configure it on the CF site instead of locally. No need for a reverse proxy on your side.
I've not done anything with auth on it as what I run I don't mind being public. If you still want to run a local auth, you can set it to hit your local reverse proxy instead and do it that way.
The benefits are you don't need to open firewall ports and your local IP is irrelevant so no need for dynamic DNS.
Just a side note that “not opening firewall ports” is not inherently a security benefit if you’re exposing the same service on the same port on the same host anyway via your reverse proxy setup.
If you were to measure your level of “security” on having ports open or not alone, then using Cloudflare tunnels could be considered worse, since an outbound VPN connection to Cloudflare is essentially circumventing your firewall’s protection entirely, meaning you’re effectively opening all 65,535 TCP and UDP ports instead of one, albeit only to Cloudflare.
There are benefits to using Cloudflare tunnels but “not opening firewall ports” is not one of them. And you could just as easily accomplish the same thing without Cloudflare by using a VPS and Tailscale with the selfhosted Headscale coordinator.
Meh, it's sorta 6 of one and half-dozen of another. The benefit of not opening ports on a firewall isn't necessarily a security one so much of a convenience one for people who don't know how their routers work or no access to open those ports. The only security value is it prevents any exploits on your router and a port scan against your network won't show those ports open. That makes it easier to hide the fact that your hosting something. I'd agree, it's not a huge security vector to worry about, but can help people not see your real IP which has tangible value.
Really, your offloading security to CF and putting trust in them to do a better job than you, but as you said, in doing so they can sort of get the keys to your kingdom. I think it's just worth it with their other tools to block bots and other common exploits that a Netgear home router isn't looking for.
The problem with a vps and tailscale is its one more thing to manage and a vps costs money and cf is free.