self hosting risks

I want to self host the backend of one of my webshit projects, but I can't have a separate machine for it on a vlan as I only have one pc currently. So how risky is it to host it on my main pc and what can I do to reduce the risks?

you can use cloudflare to protect your IP and protect against DDoS

>>23304 run it in a VM with NAT and a strict firewall

You don't need a VM, that's way to intense. You just need to explore containerization tools like podman: https://podman.io/ Run whatever you want in there, open up public ports bound only to container ports, and you're safe. If someone "hacks in" to anything (already doubtful) you just reset the container. Also, keep backups, but that goes without saying. If you're just looking to host simple things, SDF offers a free UNIX box. http://sdf.org/

Make it internal only, access your network with wireguard or vpn

>>23305 Cloudflare can snoop what are you doing because works like a PROXY, not use it. Put your server with a high number port and not put it public except for your friends. With that must be enough for not get any DDOS, they simply not know you exist. You can even configure nginx for require a installed cert in the client browser. >>23312 Nice, or even a Hidden service under Tor if you don't care about clearnet.

>>23666 > Put your server with a high number port and not put it public except for your friends. It doesn't matter what port you use. It takes very little time to scan every port on your system. Only utter script kiddies would expect services to be using their standard ports. And no matter whether you advertise your servers publicly or not, they're going to get scanned constantly every day by people randomly trying to find vulnerable systems. I'd much rather let clodflare (sic) have the capability to snoop my systems' traffic, which they probably don't give a fuarrrk about anyway, than be vulnerable to anybody and his brother that wants to DDoS my servers.

If you use IPv6, it's unlikely that you'll get scanned by someone randomly trying. With IPv4 yeah, you'd better not count on security through obscurity.

>>23668 I never had a proper DDOS attack taking me down from the year of the release of the rpi1 ( When I started to host by myself ) > they're going to get scanned There is indeed a wild west with the email hosting. The scanning is real, and there is machines sending spam like they doing ping everywhere. It's true is possible scan every computer of the net, but under some ISP that can get you in trouble and scan consumer IP will not be so successful . I think they look for meaningful hosting. > I'd much rather let clodflare (sic) have the capability to snoop my systems' traffic Clownfare can limit your use of image or video at wish and without a clear rate in TOS, Expect to pay if you want to do something meaningful unless you use your own cdn. Apart they are godlike now, I will not collaborate. I think I been lucky. Anyway I want to open ports and

>>23670 Anyway I want to open a range of ports, and check if there is a port scan and ban REJECT ip before they reach the meaningful ports. Yeah, again obscurity, but it could work for a while...

I pay for one of the cheapest VPS I could find and use that solely as a reverse proxy, I've access to my hosted services at home via a wireguard VPN tunnel. It's a bit hacky but it works.

>>23671 If you want to host a service that anyone can access from the public internet, but isolated from the rest of your stuff on the same machine, then what you need is containers or jails. Implementation depends on OS; if you happen to be running FreeBSD then jail management with ezjail is very ez. Some other concepts you're dancing around include "port knocking" and "key-based authentication" but these are not so great for your scenario.

>>23669 What makes ipv6 different aside from being newer?

>>23680 people think you can't be found in ipv6 address space because there are 340,282,366,920,938,000,000,000,000,000,000,000,000 possible addresses (or 18,446,744,073,709,551,616 in a /64) but you can use common OUIs, 0xFFFE in the middle of every SLAAC address, other such features to narrow the search space a lot, so this will end up as useful as every security by obscurity -- maybe a worthwhile extra layer, not reliable by itself

I run a web server from home, but it's only accessible over an Nginx reverse proxy, that is hosted on a VPS. The reverse proxy and the actual web server are connected over Wireguard. One can type in my domain and it redirects to my server running at home. This is the guide, I used: https://blog.fuzzymistborn.com/vps-reverse-proxy-tunnel/ It's the same, except I don't use Caddy, but also Nginx at home. Nginx mainly redirects HTTP, but I think one could also use it to redirect anything else with a few tweaks (although I'm unsure how well that works, might as well be total soykaf).

If you don't want to expose your home ip to the public, there's... Tor hidden service, easy peasy to set up, pagekite.net or similar, set up a vpn or wireguard to it, as someone already said If you want to protect against exploits in your server software, set it up in a vm or at least a container, as already suggested.

>>23304 Tailscale or Head scale as backend get a cheap as chips VPS use it as a reverse proxy host all within Podman. (Podman is unprivileged unlike docker for a 'layer of security'. I don't host anything public. But I do use my VPS as a whole network traffic endpoint via wireguard all wan traffic goes via Wireguard. At some point I'll actually learn how to send stuff to the VPS for it to be accessed via the VPS IP. Yet I'm still learning Tailscale subnet fuarrrkery.

what you guys think about https://www.freedombox.org/ was thinking of giving it a try

>>25015 What about Bunkerweb? It says it is based on Nginx and supports https and Let's Encrypt and has automated blocking of site visitors doing certain behaviors. https://docs.bunkerweb.io/latest/?utm_campaign=self&utm_source=bunkerwebio

>>25027 This kinda glows. How trustworthy is it?

>>25795 Its literally just Debian with preconfigured stuff like qbittorrent

>>25795 FreedomBox is recommended by prism-break, so it's probably trustworthy. https://prism-break.org/en/projects/freedombox/

>>23304 Use podman/docker (both in rootless mode), harden your webserver (drop permissions, chroot), harden your backend, and use common sense.