Selfhosted

62,413 readers

6,055 active

157 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Detailed Rules Post

Be civil.
No spam.
Posts are to be related to self-hosting.
Don't duplicate the full text of your blog or readme if you're providing a link.
Submission headline should match the article title.
No trolling.
Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details. Tags [CBH] or [AIP] are required, see the links in Rule 8 for details.
AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post, and find example disclosures here.

Resources:

selfh.st Newsletter and index of selfhosted software and apps
awesome-selfhosted software
awesome-sysadmin resources
Self-Hosted Podcast from Jupiter Broadcasting

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 3 years ago

moderators

curbstickle@anarchist.nexus

curbstickle_lw@lemmy.world

Is Authelia enough without fail2ban or crowdsec? (piefed.social)

submitted 2 weeks ago by Arda@piefed.social to c/selfhosted@lemmy.world

24 comments fedilink hide all child comments

I have everything I host and expose behind authelia (which requires 2fa) as middleware or as the only login method with oicd, thus far it seems to work well, of course I get a bunch of malicious traffic and spam but this gets to authelia and stops there, I don't even see multiple tried login tries ever so I felt pretty safe. However it does seem that everyone uses either fail2ban or crowdsec in addition so I have been wondering if it would really add any security in my setup or if I'm missing something. I'm sure it wouldn't hurt but crowdsec always seemed a little too complex for me and I don't want something I don't fully understand in my security layer and I never saw a nice way to setup fail2ban so never bothered. Afaik there's no webui or such things and you have to manually make working regex for everything. I'd like to know if I'm missing something or if anyone has tipps to give

you are viewing a single comment's thread
view the rest of the comments

[–] DieserTypMatthias@lemmy.ml -3 points 2 weeks ago (5 children)

Please don't expose your services to the internet directly. Use something like Tailscale/Headscale/whatever mesh VPN is relevant now. It'll always be 100 times better than this and you wouldn't worry about Authelia, f2b and CrowdSec (though updating your services and server(s) is always worth it).

permalink

fedilink

source

hideshow 5 child comments

[–] village604@adultswim.fan 1 point 2 weeks ago (1 child)

But I run a VPN on my phone by default, so I'd have to disconnect from that to access stuff on my home network (and remember to turn it back on after).

That's why I'm planning on using mTLS until I get my router configured to direct my BTH VPN through the gateway I have running on my phone.

I just need to figure out how to get VLANs properly set up in Mikrotik without having to nuke everything and start from scratch.

permalink

fedilink

source

parent

hideshow 1 child comment

[–] ten8tp@reddthat.com 1 point 2 weeks ago

I, too, run an always on VPN from my mobile devices. I can still access my home network with pihole and DNS entries to my services. It's not that difficult. I agree though, mTLS is a good option.