Just exposed Immich via a remote and reverse proxy using Caddy and tailscale tunnel. I’m securing Immich using OAuth.
I don’t have very nerdy friends so not many people appreciate this.
Just exposed Immich via a remote and reverse proxy using Caddy and tailscale tunnel. I’m securing Immich using OAuth.
I don’t have very nerdy friends so not many people appreciate this.
Like, good for you, man.
But you should really keep your stuff inside the VPN and not expose things, it opens up a pile of potential risks that you don’t need to have. You can still use a reverse proxy inside the VPN and use your own DNS server that spits out that internal address to your devices for your various applications. If you absolutely, positively must have something exposed directly, put it on it’s own VLAN and with no access to anything you value.
@randombullet@programming.dev
Don’t listen to this guy. You don’t have to turtle all your stuff inside a VPN if you don’t want to. Hosting services on the internet is what the internet was created for. It’s up to you whether what you want to host is exposed to the internet or not, and as long as you’re aware of the risks do what you want man. I will mention that Immich specifically might not be the best idea to expose since it’s so unstable, but that depends on your level of comfortability. Worst case scenario is somebody gets into your Immich and can see all your photos. Would this be a dealbreaker for you? If so don’t expose it publicly. Otherwise you’re perfectly fine.
Nobody said they had to. I made him aware of the risks in case he wasn’t. You seem to have an axe to grind there.
I’m not a big fan of amateur know-nothings regurgitating the same nonsense regurgitated to them by previous know-nothings, attempting to further the cycle to people finding their footing with self hosting, telling everybody what they “should” do based on their own limited understabding. It was a big problem on the self hosted reddit and up to this point has been less of a problem here.
And yet here you are, making sure this guy knows he can expose anything he wants except the specific thing you decided is troublesome like immich. Maybe you’ll be here to help him put it all back together with your wealth of knowledge and experience.
Take a hard look at yourself, you’re doing all the stuff you accuse someone else of. Maybe you aren’t always the smartest person in the room. In any case, I’m done with your shit. Go ruin someone else’s day, you ray of sunshine.
Yeah maybe you should take notes on how to relay a little bit of relevant knowledge in the context of what it is they’re trying to do, and let them decide how it fits their use case, instead of repeating broad, inaccurate generalizations dictating what people should and shouldn’t do across the board.
If you’re not going to be helpful or informative, then don’t bother chiming in at all.
Absolutely that’s what the internet was made for!
But family photos keep a bit more secure, Particularly if it’s syncing directly from your phone, I take a lot of explicit photos of my wife, but also code that I’m writing on my computer, or the kids playing, etc.
I want to be able to upload/download/share my photos from anywhere in the world without using a VPN. Additionally, this satisfies the wife requirement. It works in the background without her needing her to turn on the VPN. I don’t want her to keep asking me how do I turn on the VPN? If it’s just me, then no issue, I’ll use a VPN.
Yeah, you always have to account for the wife factor. Same reason I’m using Plex instead of Jellyfin for my video hosting; I’d personally prefer Jellyfin, but the wife factor (really the mother-in-law factor, but whatever…) demands that it doesn’t require a ton of config on the user’s end. If the goal is to encourage use by your family, it can’t be fiddly or difficult to set up on their end.
To be fair, wireguard is pretty painless.
You set up the VPN and it’s always on. There’s no hassle.
Unless you’re on IOS that will shut your VPN off regularly. Or you want somebody else to be able to access what you’re hosting without having to walk theme through a VPN setup they won’t understand.
I’ve never had iOS shut my VPN off, and I use a kill switch so I would immediately know.
I have a couple dozen customers on ios that use their camera servers via Tailscale. Never had a peep about that sort of thing.
And the last is the typical sort of “convenience” that gets people popped.
You’re hearing about it now. It’s an issue with the way iOS handles background tasks and there isn’t any way to fix it. It’s just how the OS works.
Well, apparently a bunch of farmers are smart enough to press a button without even bothering me about it.
Why would farmers not be smart enough to press buttons?
Yah, imagine my surprise, it’s almost like people are smart enough to manage a VPN without you holding their hands.
I don’t even bother with the internal DNS server. I just set my A records in Cloudflare to point to the private IPs
I tired the same, but my router wants to be smart by filtering DNS responses that points to local IP. I guess whoever designed it considered it a security feature. It is a stock router from the ISP, its configuration interface is minimal, borderline to non existent.
Sounds like Cloudflare tunnels. I used that for a while, until I realized I didn’t want to be tied to Cloudflare.
Do the private IPs not change at all? Or can you handle that automatically?
I have next to no experience, but I’m pretty sure that wouldn’t work for me since my IP changes? Idk
Most routers have a feature to assign static IPs to a specific MAC address. You can also tell most devices to try to take a specific IP instead of using DHCP.
There are multiple ways to set it up, but it’s very possible to set a specific device to always have the same local IP, which is usually the first step to many self-hosting scenarios.
You can either set a DHCP reservation in your router, or manually set the IP on the device.
When I say private IP, I’m referring to the internal IP e.g 192.168.1.X
Means internally I just go to the domain without having to remember the IP I set.
Oooh. That makes more sense, thank you.
I somehow thought you’d meant your global IP addresses, lol
Edit: i see now they’re talking about private IP, but in case you want to learn about getting a static IP for other things…
Many ISPs will give you a dynamic (changing) IP rather than a static (unchanging) IP. Just check your IP once a week for a few weeks to see if it changes.
There are some services that get around this by checking your ip regularly and updating their records automatically. This is called a dynamic DNS provider (DDNS). I used to use “noip” but since then there are quite a few like cloudflare DDNS.
Beyond that you just would want to make sure your router or whatever device is assigning IPs on your network to give a static assignment to the server. Assigning IPs is handled by a DHCP server and it would usually be your router, but if you have a pihole you might be using that as a DHCP server instead.
Between DDNS and DHCP you can make sure both your external IP and internal IP are static.
Excuse me what? Here’s my dumb ass navigating to "[device name]:[port] over tailscale.
I’ve tried this a couple times and I’ve always failed. I could never figure out how to get a http://service.domain/ request to my Nginx install to be proxied in the first place. I tried putting pihole on tailscale and setting that as tailscale’s DNS. It blocked ads but I couldn’t navigate to custom domains. I put NPM on tailscale hoping that was the issue. I looked for LocalDNS/CNAMES in tailscale to see if I could do it that way. Do I have to set a local machine as an exit node and do split DNS shenanigans, service.domain goes through to my local and everything else the wider web? Do I set a router node?!
Not expecting you to troubleshoot, I don’t have time to see it through anyhow. Just annoyed at myself I couldn’t figure it out and driven to try again.
Opening it up lets you use it from devices that aren’t on tailscale, or for friends and family. I have the same idea with Nebula instead of Tailscale, if I can figure it out.
deleted by creator