Served in the Krogan uprisings. Now I run a podcast

https://bdsmovement.net/get-involved/what-to-boycott

  • 1 Post
  • 51 Comments
Joined 3 years ago
cake
Cake day: June 12th, 2023

help-circle

  • If you want a quick and easy way to share the odd file you could set up a syncthing shared folder and COPY things in to it that you want to share. When the other side MOVES them out of the shared folder they will be removed from the shared folder on your side.

    The advantage of this is security. No access is given to your system. If your friends box is compromised you dont have an nfs mount or ssh key on their machine. The worst that can be done to you is copies in the shared folder are removed or malicious files are placed in the shared folder but they wont be able to execute.

    You also dont need to open any ports for syncthing , it will use relays if it cant make a direct connection.













  • JoeKrogan@lemmy.worldtoSelfhosted@lemmy.worldTwo VPNs?
    link
    fedilink
    English
    arrow-up
    1
    ·
    4 months ago

    Well i have the rp as i only want one port exposed. I have separate networks per service too to isolate things. Only the things that need to talk to each other can.

    My stuff is only accessible on the lan and via the vpn and even then only certain ips have access to certain things.

    In your case it might be different , but generally a reverse proxy is better as you can have a single point of access to secure and you are not exposing all of your ports to the host or the internet.




  • JoeKrogan@lemmy.worldtoSelfhosted@lemmy.worldTwo VPNs?
    link
    fedilink
    English
    arrow-up
    4
    ·
    edit-2
    4 months ago

    I have the arr stack connected to gluetun doing its thing and then wireguard on the host. I only expose my reverse proxy to the host and can connect to the services through that.

    Note the networks below, vpn_net allows it to talk to the gluetun network which has the other stuff. The gluetun and arr stuff are in a separate compose file that defines the network. Then the non vpn stuff connects to that network when it comes up

    nginx: 
        image: nginx:1.25.4-alpine-slim
        container_name: nginx
        restart: always
        volumes:
           - /etc/letsencrypt/:/etc/letsencrypt/
           - ./nginx/nginx.conf:/etc/nginx/nginx
           - ./nginx/conf/:/etc/nginx/conf.d/:ro
           - ./nginx/htpasswd:/etc/apache2/.htpasswd:ro
           -  /var/log/nginx:/var/log/nginx/
           - ./www/html/:/var/www/html/:ro
           - ./content/Movies:/var/www/media/Movies:ro
           - ./content/Shows:/var/www/media/Shows:ro
        ports:
           - 443:443
        security_opt:
          - no-new-privileges
        networks:
          - reverse-proxy_service1
          - reverse-proxy_serviceN
          - vpn-stack_vpn-net
        depends_on:
          - service1
          - serviceN