Running a TrueNAS Scale server with Jellyfin and planning to add Nextcloud. How would I be able to access these services from outside my network? I have heard portforwarding is unsafe and a VPN seems inconvenient to me.

  • Im_old@lemmy.world
    link
    fedilink
    English
    arrow-up
    15
    ·
    1 year ago

    Port forwarding is unsafe, but even crossing the road is unsafe. Do you cross the road without watching? In the same way, you just don’t let a published server online without doing regular updates. You set up docker, run nextcloud (docker) behind nginx proxy manager, and have watchtower update them regularly. You can also setup 2fa in docker, and pair it with fail2ban.

    Every port open widens the attack surface, but those services are made to be published, so there are mitigations against the risks.

    • corroded@lemmy.world
      link
      fedilink
      English
      arrow-up
      3
      arrow-down
      1
      ·
      1 year ago

      I’ve said this many times before, but it seems relevant here, too. Using a reverse proxy is a good step for security, but you will still want to block certain incoming connections on your firewall. I block everything except for our cell phone provider, my partner’s employer, and my employer. We will never be accessing my network from any other source. At the very least, block everything and whitelist your own country; this will prevent a lot of illegitimate connections. If you’re using pfSense, the pfBlockerNG plugin makes this very easy to do.

      • Im_old@lemmy.world
        link
        fedilink
        English
        arrow-up
        2
        ·
        1 year ago

        Yeah, absolutely good point, it’s something that can be done in opnsense as well. Certainly blocking any bloc outside your country (or region maybe in Europe) makes sense. I block everything outside RIPE, and also China and Russia.

      • Im_old@lemmy.world
        link
        fedilink
        English
        arrow-up
        1
        ·
        1 year ago

        Now you make a good point, you also have to perform the update within the app in nextcloud. I use a custom image so I have to do it anyway, I haven’t realised that.

        But I guess npm is the one that needs to be updated automatically to avoid most of the attacks on the web

    • MaggiWuerze@feddit.de
      link
      fedilink
      English
      arrow-up
      1
      ·
      1 year ago

      How does watchtower work with compose stacks? Does it update the whole stack (docker compose pull && docker compose up) in one go or each container individually?

      • AES@lemmy.ronsmans.eu
        link
        fedilink
        English
        arrow-up
        3
        ·
        1 year ago

        Found out the hard way, it does not. Now I just run a script every week (pull and compose up)

      • Im_old@lemmy.world
        link
        fedilink
        English
        arrow-up
        1
        ·
        1 year ago

        AFAIK one container at a time. Since the different parts of a stack (e.g. app and db) have different release cycles it’s not a problem (or it hasn’t been for me).

        Also, the important bit (from a security perspective) it’s the front end (i.e. the web app).