Hello most excellent Selfhosted community,
I’m very new to this and am confused about how vulnerable my server and/or home network is with my current setup.
I just got a basic server up and running on a machine with proxmox and a DAS for 10tb of storage. I’ve got two LXCs running for a docker deployed arr stack and jellyfin+jellyseer stack. The proxmox server is connected to a router attached to a fiber ONT. Everything is accessed over the home LAN network and that’s it.
Everything is working correctly and my containers are all talking to each other correctly via ip addresses (gluetun network on the arr stack container). I’ve been reading up on reverse proxies and tailscale to connect to the server from outside my LAN network, and it’s mostly gone over my head, but it did make me concerned about my network security.
Is my current set up secure, assuming strong passwords were used for everything? I think it is for my current uses - but I could use a sanity check, I’m tired. I’m open to any suggestions or advice.
I own a domain that I don’t use for anything, so it would be cool to get reverse proxy working, but my attempts so far have failed and I learned I’m behind a double NAT (ONT and router) - and attempts to bypass that by setting the ONT into bridge mode have also failed. I don’t really need to access anything from outside my home network right now - but I would like to in the future.
You can run nginx in a docker container and define reverse proxies there. That will only require your to open up 443 in your router if you use SSL (which I highly recommend and is simple with Let’s Encrypt)
Then I’d recommend connecting to your arrs and torrent client in Nzb360 paid edition to manage everything in there.
As far as safety, well nothing is bulletproof. If they want to get in, they will. Best thing I can recommend is to run your arrs / indexers through a different IP address than your torrent client. But if they want to find you, they’ll find you. Thing is they probably won’t come after you if your ISP doesn’t report you uploading terabytes a day. SSL helps and keeping your arrs behind complex passwords (use a password manager) will keep the server itself relatively safe.
Unless of course, ISPs in your country suddenly start to crack down on illegal downloading hard.
Why open a port when you can do tailscale/vpn or tunnel.
Not to mention that some providers offer APIs to provide certificates without opening port(s) 80/443. This allows using nice host names on your personal domain with valid SSL over the internal network too. Want to migrate a server or service? Just change the IP associated with the domain on the internal DNS. Makes migrating and upgrading a lot easier.