zlacker

[parent] [thread] 11 comments
1. j_bum+(OP)[view] [source] 2025-01-05 16:41:16
Ok - curious if anyone can provide some feedback for me on this.

I am running Immich on my home server and want to be able to access it remotely.

I’ve seen the options of using wireguard or using a reverse proxy (nginx) with Cloudflare CDN, on top of properly configured router firewalls, while also blocking most other countries. Lots of this understanding comes from a YouTube guide I watched [0].

From what I understand, people say reverse proxy/Cloudflare is faster for my use case, and if everything is configured correctly (which it seems like OP totally missed the mark on here), the threat of breaches into to my server should be minimal.

Am I misunderstanding the “minimal” nature of the risk when exposing the server via a reverse proxy/CDN? Should I just host a VPN instead even if it’s slower?

Obviously I don’t know much about this topic. So any help or pointing to resources would be greatly appreciated.

[0] https://youtu.be/Cs8yOmTJNYQ?si=Mwv8YlEf934Y3ZQk

replies(5): >>depaul+K >>RajT88+a4 >>vinay_+i6 >>dns_sn+Q7 >>63stac+XD
2. depaul+K[view] [source] 2025-01-05 16:46:32
>>j_bum+(OP)
Piggybacking on your request, I would also like feedback. I also run some services on my home computer. The setup I'm currently using is a VPN (Wireguard) redirecting a UDP port from my router to my PC. Although I am a Software Engineer, I don't know much about networks/infra, so I chose what seemed to me the most conservative approach.
replies(1): >>bennyt+D3
◧◩
3. bennyt+D3[view] [source] [discussion] 2025-01-05 17:09:32
>>depaul+K
To both of you, wireguard is the way to go.

So, parent poster: yes, you are doing it right.

Grandparent: Use a VPN, close everything else.

replies(1): >>j_bum+Z3
◧◩◪
4. j_bum+Z3[view] [source] [discussion] 2025-01-05 17:12:28
>>bennyt+D3
Thanks, Benny!
5. RajT88+a4[view] [source] 2025-01-05 17:14:52
>>j_bum+(OP)
Reverse proxy is pretty good - you've isolated the machine from direct access so that is something.

I'm in the same boat. I've got a few services exposed from a home service via NGINX with a LetsEncrypt cert. That removes direct network access to your machine.

Ways I would improve my security:

- Adding a WAF (ModSecurity) to NGINX - big time investment!

- Switching from public facing access to Tailscale only (Overlay network, not VPN, so ostensibly faster). Lots of guys on here do this - AFAIK, this is pretty secure.

Reverse proxy vs. Overlay network - the proxy itself can have exploitable vulnerabilities. You should invest some time in seeing how nmap can identify NGINX services, and see if those methods can be locked down. Good debate on it here:

https://security.stackexchange.com/questions/252480/blocking...

6. vinay_+i6[view] [source] 2025-01-05 17:30:31
>>j_bum+(OP)
Well, you are better off using Google Photos for securely accessing your photos over Internet. It is not a matter of securing it once, but one of keeping it secure all the time.
replies(1): >>j_bum+V6
◧◩
7. j_bum+V6[view] [source] [discussion] 2025-01-05 17:35:27
>>vinay_+i6
I suppose yes, it is more confident and “easy” to pay a cloud provider. But we have more data than I’m willing to flush away money for cloud storage.

As such, I’m hosting Immich and am figuring out remote access options. This kind of misses the point of my question.

replies(1): >>vinay_+7a
8. dns_sn+Q7[view] [source] 2025-01-05 17:43:48
>>j_bum+(OP)
If you care about privacy I wouldn't even consider using Cloudflare or any other CDN because they get to see your personal data in plain "text". Can you can forward a port from the internet to your home network, or are you stuck in some CG-NAT hell?

If you can, then you can just forward the port to your Immich instance, or put it behind a reverse proxy that performs some sort of authentication (password, certificate) before forwarding traffic to Immich. Alternatively you could host your own Wireguard VPN and just expose that to the internet - this would be my preferred option out of all of these.

If you can't forward ports, then the easiest solution will probably be a VPN like Tailscale that will try to punch holes in NAT (to establish a fast direct connection, might not work) or fall back to communicating via a relay server (slow). Alternatively you could set up your own proxy server/VPN on some cheap VPS but that can quickly get more complex than you want it to be.

replies(1): >>j_bum+M8
◧◩
9. j_bum+M8[view] [source] [discussion] 2025-01-05 17:51:39
>>dns_sn+Q7
Yikes… I had no idea about CDN being able to see raw data.

> forward a port

From what I understand, my Eero router system will let me forward ports from my NAS. I haven’t tested this to see if it works, but I have the setting available in my Eero app.

> forward port to Immich instance

Can you expand on this further? Wouldn’t this just expose me to the same vulnerabilities as OP? If I use nginx as a reverse proxy, would I be mitigating the risk?

Based on other advice, it seems like the self hosted VPN (wireguard) is the safest option, but slower.

The path of least resistance for daily use sounds ideal (RP), but I wonder if the risk minimization from VPN is worth potential headaches.

Thanks so much for responding and giving some insight.

replies(1): >>dns_sn+pc
◧◩◪
10. vinay_+7a[view] [source] [discussion] 2025-01-05 18:01:24
>>j_bum+V6
If cheap is what you are looking for, then yes, a wireguard running on your home server is the way to go. Instead of exposing your home-server directly to Internet, I would put it behind a cloudflare zero trust network access product (costs free).
◧◩◪
11. dns_sn+pc[view] [source] [discussion] 2025-01-05 18:16:59
>>j_bum+M8
> Can you expand on this further? Wouldn’t this just be exposing myself to the same vulnerabilities as OP?

Yeah I wouldn't do this personally, I just mentioned it as the simplest option. Unless it's meant to be a public service, I always try to at least hide it from automated scanners.

> If I use nginx as a reverse proxy, would I be mitigating the risk?

If the reverse proxy performs additional authentication before allowing traffic to pass onto the service it's protecting, then yes, it would.

One of my more elegant solutions has been to forward a port to nginx and configure it to require TLS client certificate verification. I generated and installed a certificate on each of my devices. It's seamless for me in day to day usage, but any uninvited visitors would be denied entry by the reverse proxy.

However support for client certificates is spotty outside of browsers, across platforms, which is unfortunate. For example HomeAssistant on Android supports it [1] (after years of pleading), but the iOS version doesn't. [2] NextCloud for iOS however supports it [3].

In summary, I think any kind of authentication added at the proxy would be great for both usability and security, but it has very spotty support.

> Based on other advice, it seems like the self hosted VPN (wireguard) is the safest option, but slower.

I think so. It shouldn't be slow per se, but it's probably going to affect battery life somewhat and it's annoying to find it disconnected when you try to access Immich or other services.

[1] https://github.com/home-assistant/android/pull/2526

[2] https://community.home-assistant.io/t/secure-communication-c...

[3] https://github.com/nextcloud/ios/pull/2908

12. 63stac+XD[view] [source] 2025-01-05 22:01:50
>>j_bum+(OP)
You don't need any of this, and the article is completely bogus, having a port forwarded to a database in a container is not a security vulnerability, unless the database has a vulnerability. The article fails to explain how they actually got remote code execution, and blames it on some docker container vulnerability, and links to a random article as a source that has nothing to do with what he is claiming in the article.

What you have to understand is that having an immich instance on the internet is only a security vulnerability if immich itself has a vulnerability in it. Obviously, this is a big if, so if you want to protect against this scenario, you need to make sure only you can access this instance, and you have a few options here that don't involve 3rd parties like cloudflare. You can make it listen only on the local network, and then use ssh port tunneling, or you can set up a vpn.

Cloudflare has been spamming the internet with "burglars are burgling in the neighbourhood, do you have burglar alarms" articles, youtube is also full of this.

[go to top]