80
Ways to Expose Services Publicly (lemmy.dbzer0.com)
submitted 1 week ago by to c/selfhosted@lemmy.world
86 comments fedilink hide all child comments
 

I want to expose my services publicly on my own domain name, how would you guys do that?

I have seen people using Cloudflare, but I don't want to use Cloudflare out of principle. I have also seen stuff on caddy and frp that I've done some rough researching.

What do you guys do?

you are viewing a single comment's thread
view the rest of the comments
[–] 5 points 1 week ago (1 child)

I recently switched to Netbird on a VPS (on Vultr). Their reverse proxy is super easy to set up / self host. They also offer a free version that works pretty good too, I just wanted to make it difficult for myself (thats the whole point of self hosting, right? )

  • permalink
  • fedilink
  • source
  • hideshow 2 child comments
    •
  • [–] [S] 3 points 1 week ago (4 children)

    I have seen netbird pop around every now and again. I might try out their cloud free version first and if I like it I might try self hosting it.

    So you host netbird on a vps you rent and that is used for reverse proxy? So with that reverse proxy I can have my home server be publicly accessible and I can have friends log in to my jellyfin server without having to connect to my tailnet.

    My last concern is security. How is this set up good for making sure I don't just get constantly botted and exploited?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 8 child comments
    •
  • [–] 4 points 1 week ago

    Yup! They can either connect to your Netbird meshnet (ie, similar a tailnet) or you can reverse proxy it out to the internet (no tailnet needed)

    I saw a couple comments below concerned about security, one of the nice things about Netbird is that they have reverse proxy auth built in if you want. Some stuff (Navidrome or VoidAuth for instance) only has geolocation locked down (US only) but other things that I'm either more concerned about or don't necessarily trust being open (Paperless or Komodo for instance) have Netbird Auth and VoidAuth as sign in options before it will let me open the page. Its worked flawlessly so far, and has kept my sanity intact because I wanted some stuff publically accessible without it being OPEN.

    As far as being hammer fucked, it has CrowdSec and Geolocation lockdowns so you can set it to only accept traffic from ONE location and the Crowdsec also catches everything.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 2 points 1 week ago (1 child)

    Opening jellyfin up publicly is kind of asking for trouble if you ask me. I haven't done so myself, but seen enough on this community and elsewhere to know that it's probably not a good idea.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 1 week ago (1 child)

    By all means correct me if you know more, but what I tend to see is one or two people here saying that Jellyfin devs don't recommend exposing it publicly, only to be corrected by looking at the actual documentation. I suspect those cautioning against it are on outdated information and that Jellyfin carries much the same risk as exposing any other service.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 2 points 1 week ago (1 child)

    but what I tend to see is one or two people here saying that Jellyfin devs don’t recommend exposing it publicly

    I think what the devs are saying is 'don't expose Jellyfin to the public in an unsafe manner'. I don't run Jellyfin, but can confirm what you've read here. In that vein, don't expose anything to the public in an unsafe manner.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 1 week ago (1 child)

    There is no safe manner of exposing jellyfin.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 2 points 1 week ago (1 child)

    Again, I do not run Jellyfin, but what you're saying seems contradictory to what the devs are implying: here and here. Since I lack the hands on experience, I will leave the issue with the experts.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 0 points 1 week ago (1 child)

    That first page says exposing it to the Internet is "not recommended". Putting a reverse proxy in front of it does not meaningfully change the security posture. A malicious request to http://jellyfin.homelab.com/exploitable-page will be sent to jellyfin in effectively the same way, whether through a reverse proxy or not. You would need a WAF set up specifically to look for relevant exploit attempts.

    https://github.com/jellyfin/jellyfin/issues/5415

    Those are some outstanding known vulnerabilities, most of them unfixed. They are not particularly severe, but it shows that thorough security is not a priority for the jellyfin devs.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 1 week ago (1 child)

    It says exposing a port directly to the internet is not recommended; do you know of any project that would recommend directly exposing a port? What is meaningfully different here?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 0 points 1 week ago (1 child)

    Sure, any project designed to be exposed to the Internet. Web servers would be the most obvious.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 1 week ago (1 child)

    Probably the number one recommendation I see in self hosting communities is to not open ports directly (other than for a reverse proxy). It seems like a common recommendation no matter the service. To be clear: I am a beginner. I know very little about this, but I've spent months learning. I can't say you're wrong, but I don't think you've made a convincing argument for me to actually understand why Jellyfin is unsafe to expose to the internet compared to any other service.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 0 points 1 week ago (1 child)

    You are welcome to expose it at your own risk. Assess you own tolerance for compromise (personal data compromise, becoming part of a botnet, becoming a host for spam or CSAM) and proceed accordingly.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 1 week ago (1 child)

    Yes, that's exactly what I've done. You still haven't shown me why it's unsafe. If you can't, that's fine. At some threshold or another, nothing is secure. The one thing I know for sure is that that first page, that says it doesn't recommend exposing a port, does not say what you said it does.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 1 week ago (1 child)

    You're probably misunderstanding what netbird does (unless I'm the one misunderstanding things?).

    Netbird subnet is equivalent to a tailscale tailnet (for all practical purposes; they even both use wireguard and hole-punching underneath). Netbird is not a reverse proxy (which I feel is what you think based on your comment).

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 2 points 1 week ago (1 child)

    While Netbird is generally just one of the many alternatives to Tailscale, they also do have a Reverse Proxy feature that allows access without a Netbird client. Haven't tested it yet, seems to be in beta.

    https://docs.netbird.io/manage/reverse-proxy

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 1 week ago*

    I do this albeit with Tailscale. Netbird/Tailscale would act as a node of your VPN and you can configure reverse proxy routes (via tailscale serve or Netbird's equivalent) from the VPS edge to the homelab. You can even do SNI passthrough and have TLS terminated at your home, if you want, though this can be a bit slower

    Alternatively you can even expose stuff via their servers. Tailscale Inc calls this service Funnels, and Netbird should have similar offerings. It's kinda like Tunnels but you gotta use their domains, so a VPS acts greater as a dedicated entrypoint.

    Lastly yes you'd be exposing the service to the general public internet, so some basic security is needed. Netbird has a Crowdsec module integration, might wanna look at that one and set up rules/detections. Consider putting extra auth in front of Jellyfin, use Authelia or something with an auth screen. And only expose the stuff you need, not your internal dashboard or whatever admin UI.

  • permalink
  • fedilink
  • source
  • parent