Hi all,

I am running proxmox on a mini PC with a handful of services in my stack. I also run NPM in an LXC to reach my services through my domain name (service.domain.tld).

For my Arr related stuff, I use Usenet, and everything runs through a VPN.

I have three services which are public. Jellyfin, Seer and BookOrbit (for syncing Kobos).

Currently I have no security besides the built in login managers from the services, but I am considering setting up Authentik. I know I’m asking for trouble with my current set up.

I have elderly and extremely tech averse family members who live in two countries other than me, so tech support can be a challenge.

A lot of people suggest running a VPN, but it would be difficult for my family and I don’t know how to make it work syncing our Kobos with BookOrbit.

I’ve also seen some posts about tunneling to a VPS somewhere and users can connect to the VPS without a VPN.

I feel this question has been asked several times, and I tried searching here and on the internet in general, but my knowledge is not good enough to use the right terms and to get something that is idiot proof.

Any suggestions on best practices or links to guides you recommend would be much appreciated. Also, what EU based affordable VPS would you recommend?

    • Blip6338@lemmy.caEnglish
      13·
      12 hours ago

      Crowdsec is excellent. Also add per country block for inbound connections. If you expose the services to a few friends and family members limit inbound access to their country. Just remember to change the list when travelling abroad and coming back.

      • mjr@infosec.pubEnglish
        6·
        12 hours ago

        Hard to say. Set up countermeasures and intrusion detection (tripwires, fail2ban, and more) or you’ll probably never know.

      • femtek@lemmy.blahaj.zoneEnglish
        4·
        11 hours ago

        The big thing is what you are guardian against. Scammers and port scanners you would be good but if your a corporation or someone a government goes after they can do so much more and use an unreleased vulnerability on you.

        I run crowdsec thru Zoraxy and also set an allow list for countries that can connect, a very short list since it’s just 5 people. Also fail2ban and I run the paid security thru unify to try it out.

    • BuckFutter@timeyak.comEnglish
      1·
      12 hours ago

      Is this better than CSF (Configserver)? The scope seems to be the same here unless I’m missing something.