So far, my self-hosting has been limited to Pi-Hole, and a static website. I now want to try out something new, an Immich server.

I have a static IP from my ISP, so I don’t need to rent out a VPS. However, given that this IS a home internet, I want to be extra sure that it is going to be secure.

In my existing website, I use Fail2Ban + BadBotBlocker + Anubis + Nginx rate limits to protect it from scrapers, bots and malicious users, and it works well. With photos (especially family photos) at stake, I just want to know more on how to protect my server.

Add: thanks for the helpful replies. I will be sharing the photos with family, many of whom live abroad.

    • q7mJI7tk1@lemmy.worldEnglish
      4·
      14 days ago

      I use a Pangolin reverse proxy with OIDC (PocketID) for family access to services, along with CrowdSec. For the Immich app access which needs to bypass auth login through the reverse proxy, I use ‘link share’ in Pangolin that gives me header tokens that can be entered in to the Immich app under Advanced settings.

      I’ve been an Immich user for over 2 years now, so it’s been a journey for me to implement it to this standard.

      Or as someone else suggests, try CloudFlare with something like Google Auth login. Just be aware that you are then exposing all your traffic to Cloudflare. I take that as a small sacrifice for simplicity.

    • Jayb151@lemmy.worldEnglish
      1·
      14 days ago

      Literally just heard of pangolin for the first time in today’s self host email. I checked it and signed up to get started. But am I correct in assuming I can only have 5 endpoints for free? Or was I not looking at the self hosted edition?

  • androidul@lemmy.worldEnglish
    4·
    14 days ago

    assuming that you’re to expose that to the Internet, my recommendation is to deploy only

    complicate the setup too much and it’s going to rather be more painful to maintain and also much easier to misconfigure.

    The WAF covers OWASP Top 10 so that should give you around 70% protection which is still better than nothing

  • dimjim@sh.itjust.worksEnglish
    3·
    13 days ago

    I just use a WireGuard VPN. Makes it so much more simpler. At this point I don’t think I’ll ever expose anything to the public internet, seems like too much of a headache.

    • Branny@sh.itjust.worksEnglish
      2·
      13 days ago

      This is the way. And if you need to give someone outside of your home access, generate a VPN token for them to access your intranet and you’re golden. (And if you fall out, you revoke the token)

  • Inventaser@lemmy.worldEnglish
    2·
    13 days ago

    The others already have a lot of material you can go through that will help protect your immuch instance. Some things I would further recommend looking into:

    • Keep Immich up to date. But also wait at least a bit before upgrading. Both old and very new versions can contain vulnerabilities. With immich and it’s release process I wait at least a .week before upgrading a minor version (2.X.n)
    • Exposing publicly makes you at least as vulnerable as the exposed app. So always try to get a feeling for how aware the devs are about security. Immich already has a good stance.
    • Try to build some form of monitoring. I have Caddy as reverse proxy that exports metrics about the served domain where I can track and alert myself, when there is unusual activity on my immich domain.
  • irmadlad@lemmy.worldEnglish
    2·
    14 days ago

    Despite what some may think, I’m not a representative of Cloudflare, nor do I receive any benefit from recommending them. I just recommend what works for me. There are many avenues at your disposal. That said, Cloudflare Tunnels/Zero Trust is a winner in my book. You will need a cheap domain name that you can change the nameservers to the ones Cloudflare assigns you. After that, you install Cloudflare Tunnels/Zero Trust on your server, and connect to Cloudflare, Jacks a doughnut, Bob’s your uncle. No need to fiddle with NAT, or opening ports. Cloudflare takes care of all of that. Of course you will need port 22 (ssh) to directly admin your server.

  • ohshit604@sh.itjust.worksEnglish
    1·
    12 days ago

    I suggest having your setup as a deny-first approach. Meaning denying every IP and whitelist the known few, Traefik offers a middleware for this.

    Alternatively you can blacklist by country of origin however VPN’s are a thing, I would only recommend this on low-risk applications such as Invidious instances, dashboards and such.