Post by @neo2478@sh.itjust.works

@neo2478@sh.itjust.works

2026-10-30 12:28 UTC

Help an idiot protect his homelab and few services exposed to the internet. Hi all, I am running proxmox on a mini PC with a handful of services in my stack. I also run NPM in an LXC to reach my services through my domain name (service.domain.tld). For my Arr related stuff, I use Usenet, and everything runs through a VPN. I have three services which are public. Jellyfin, Seer and BookOrbit (for syncing Kobos). Currently I have no security besides the built in login managers from the services, but I am considering setting up Authentik. I know I’m asking for trouble with my current set up. I have elderly and extremely tech averse family members who live in two countries other than me, so tech support can be a challenge. A lot of people suggest running a VPN, but it would be difficult for my family and I don’t know how to make it work syncing our Kobos with BookOrbit. I’ve also seen some posts about tunneling to a VPS somewhere and users can connect to the VPS without a VPN. I feel this question has been asked several times, and I tried searching here and on the internet in general, but my knowledge is not good enough to use the right terms and to get something that is idiot proof. Any suggestions on best practices or links to guides you recommend would be much appreciated. Also, what EU based affordable VPS would you recommend?

Replies (5)

@possiblylinux127@lemmy.zip 2026-10-30 16:31

Don’t put them on the internet. Seriously, don’t put stuff on the internet. These days critical CVEs are coming out weekly and it is unlikely that you even detect the compromise. What is your use case? Maybe there is a better way

Open ##5497095
@heyeddi@lemmy.world 2026-10-30 17:23

Get Jellyfin off the open internet. For family who’ll never install a VPN app, the setup that holds up is WireGuard on their router, or Tailscale on whatever TV box they use, set up before it ever ships to them. They never see it. If something has to stay public, CrowdSec plus Pocket-ID is a lot lighter than Authentik for three users. I’m building a home box that ships locked down like this by default, so I’m curious: which broke first for your family, remote access or the logins?

Open ##5497825
@Treczoks@lemmy.world 2026-10-30 18:46

Ask yourself: is there any service that really, really needs to be public? Or is this only about availability for you or a very limited group (family, friends), which could be implemented via a VPN solution?

Open ##5499533
@MonkderVierte@lemmy.zip 2026-10-31 10:08

So the public services are purely for private use, to sync your mobile devices? You can install Wireguard on Android, send them over there. Though for e-reader, since they are Kobos (basically Android), you can trick it to install the app. Or even another launcher/book reader.

Open ##5501926
@peregus@lemmy.world 2026-11-01 07:03

Never call yourself an idiot. Not a good IT engineer? (Just saying, I don’t know you) That doesn’t make you stupid at all.

Open ##5503230