• 1 Post
  • 9 Comments
Joined 2 years ago
cake
Cake day: August 10th, 2023

help-circle


  • How i do it:

    • Wireguard for VPN endpoint on the pi and device that I have root on, secure, fast to setup and doesn’t add a lot of overhead

    • For access outside of VPN:

    You might have to pay for a domain name if you dont have a static IP, which is relatively cheap.

    You can manually allow trusted IP to access the service in your firewall which nullify surface of attack if done perfectly but is really an hassle to setup and maintain. I’m looking to setup Keycloack for a strong pre-auth that I can share between services and that is also lightweight (Authentik is not lightweight, Authelia seems to be i’d like to try it aswell) This coupled with firewall rules and/or fail2ban like service should be more than enough for a private server I think.




  • I just went done this road and i’d say it is worth it even only for the learning part. I’ve set counter per application in nftable, and via a python script send them in SVG graph format to Glance dashboard. The result is I can monitor my whole network per application and the best part it all add up very well so I know there is no ‘unknown’ outgoing or ingoing traffic on my machine.