Here is my setup:

I have multiple DuckDNS domains (and subdomains) pointing to my home IP. My home router has port 80 and port 443 forwarded to Nginx Proxy Manager on my home server. Nginx Proxy Manager points to the appropriate docker container and each one is encrypted with Let’s Encrypt.

Am I missing anything here or is this how I’m supposed to be doing it? Every app that has a DuckDNS url has a password in some shape or form.

  • redlemace@lemmy.worldEnglish
    11·
    7 hours ago

    My usual additions:

    1. Have the router to block portscanners
    2. fail2ban on internet facing services.
    • Jediwan@lemy.lolOPEnglish
      4·
      7 hours ago

      Thanks I’ll look into these. Quick question: how does fail2ban use port 80 if that’s already used by nginx?

      • redlemace@lemmy.worldEnglish
        7·
        7 hours ago

        It does not. It does not uses ports at all. Fail2ban monitors your logfiles and activates the firewall to block IP’s that matched your rules.

        t.ex. You can block an IP that tried to access https://<url>/admin. You can block an IP that used wrong credentials x times to login on an ssh port. Or block one that tried to relay via your mailserver. The duration is configurable and alternative duration can be configured for recidivists.

        And yes, you can whitelist IP’s to avoid locking yourself out. The possibilities are endless.