Hi all,

I am running proxmox on a mini PC with a handful of services in my stack. I also run NPM in an LXC to reach my services through my domain name (service.domain.tld).

For my Arr related stuff, I use Usenet, and everything runs through a VPN.

I have three services which are public. Jellyfin, Seer and BookOrbit (for syncing Kobos).

Currently I have no security besides the built in login managers from the services, but I am considering setting up Authentik. I know I’m asking for trouble with my current set up.

I have elderly and extremely tech averse family members who live in two countries other than me, so tech support can be a challenge.

A lot of people suggest running a VPN, but it would be difficult for my family and I don’t know how to make it work syncing our Kobos with BookOrbit.

I’ve also seen some posts about tunneling to a VPS somewhere and users can connect to the VPS without a VPN.

I feel this question has been asked several times, and I tried searching here and on the internet in general, but my knowledge is not good enough to use the right terms and to get something that is idiot proof.

Any suggestions on best practices or links to guides you recommend would be much appreciated. Also, what EU based affordable VPS would you recommend?

    • Seldon@discuss.tchncs.deEnglish
      3·
      6 hours ago

      Awesome, good to hear. Just a reminder that I forgot when I sent that link: double-check the Tutorial, it might have slightly outdated information. But a few lessons I learned when setting it up:

      Pangolin uses its own auth. You can use a OIDC provider if you like, but you have to set it up. I use TinyAuth in conjunction because I have so few users.

      To bypass auth on Pangolin, you must disable it and it will appear “Unprotected”. This helps with mobile apps, which don’t know how to deal with third-party login screens, but it leaves the login screen of whatever server you’re running (like Jellyfin) accessible by everyone. So something more hardened as your OIDC provider at the frontend help. Although lots of apps, again like Jellyfin, don’t have native OIDC login.

      The solution would be to route it with Private Resources, which are zero-trust connections. Great for a few people on your network, but it requires you setting up the Client app to access the Pangolin network. I’ve had issues with DNS on Android before, but your problems may vary.

      If you have any more questions, let me know. I’ve been using Pangolin for only about a year, but I think I learned enough to help.