• 1 Post
  • 166 Comments
Joined 3 years ago
cake
Cake day: June 30th, 2023

help-circle



  • for a homelab I don’t think it’s feasible to fully review the source code of everything you install

    Here’s what you can actually do:

    • Consider if you actually need the application and stop applications you don’t use
    • Don’t allow public access unless it is necessary, consider VPN/reverse proxies with client authentication (if supported)
    • isolate applications that don’t need to talk to each other
      • see also rootless podman, firewalls, virtual machines, etc
      • don’t forget network access, if everything runs on 127.0.0.1 and every service shares it then they can all talk to each other! (See also network namespaces or VMs)
    • Don’t reuse passwords
    • keep software up to date
    • actually evaluate the quality of the project if it needs access to sensitive information
      • see open issues, closed issues that stand out
      • check for audits or at least a history of good effort™

    Sure you wont always catch ai slop this way but you don’t need to read a line of code to at least be reasonably sure your arr stack won’t get to the family photos.











  • Here:

    server {
        listen 443 quic;
        listen [::]:443 quic;
        listen 443 ssl;
        listen [::]:443 ssl;
        server_name jellyfin.kitsuna.net;
        http2      on;
        http3      on;
        quic_gso   on;
        tcp_nodelay on;
        # You can increase the limit if your need to.
        error_log /var/log/nginx/jellyfin.access.log;
    #    ssl on;
    #    ssl_certificate /etc/nginx/certificate.crt;
    #    ssl_certificate_key /etc/nginx/certificate.key;
    #    ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # don’t use SSLv3 ref: POODLE
            ssl_certificate /etc/letsencrypt/live/kitsuna.net/fullchain.pem;
            ssl_certificate_key /etc/letsencrypt/live/kitsuna.net/privkey.pem;
    #        ssl_certificate_key /etc/letsencrypt/live/kitsuna.net/privkey.pem;
            ssl_protocols TLSv1.2 TLSv1.3;
            add_header Alt-Svc 'h3=":$server_port"; ma=86400';
            add_header x-quic 'h3';
            add_header Alt-Svc 'h3-29=":$server_port"';
        location / {
            proxy_pass http://10.159.4.12:8096/;
    #       proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forward-Proto http;
            proxy_set_header X-Nginx-Proxy true;
        }
    }