This comment is suggesting doing many things extremely vulnerable to supply chain attacks. Please don’t upvote or do this.
Comment on Beginner looking for advice on open-source NAS hardware and OS for self-hosting
hperrin@lemmy.ca 2 weeks ago
It sounds like you just wants Nextcloud and maybe Immich. So here’s my suggestion:
If you don’t have a domain yet, buy a domain. Preferably through Cloudflare because their API is good, and you’ll need that. Point an apex A record at your public IP address.
Set up something like Kubuntu on the box itself. Make sure it has a static IP address (you can also do DHCP reserved through your router, which is safer), and forward ports 80 (TCP), 443 (TCP), and 51820 (UDP) to that box.
Now comes the magic. Install docker through the official installation docs for Ubuntu (don’t use Ubuntu’s packages). Create a folder in your home directory called “services”. Inside this folder, you’re going to set up a folder for each service you need. The first one you should set up is “nginx-proxy-manager”. Inside each folder you’ll have a “docker-compose.yml” file. Inside that file, set up your docker compose stack. Nginx Proxy Manager’s is pretty simple. Just one service. But change the network mode to “host”, and remove the ports section.
Now, from a terminal, in that folder, run docker compose up -d. Get used to that command, you’ll run it a lot. Then go to localhost:81, and create an account for NPM. Use a real email address, because that’ll be your contact email for Let’s Encrypy ssl. Go into the ssl settings and create a certificate. You’ll need an api key from Cloudflare, or whatever other place you bought your domain from. It needs access to change the dns settings for your domain. Use this format to create your certificate:
example.com, *.example.com
And use the dns challenge option where you’ll put your api key.
[continuing in next post]
moldy_rice@piefed.keyboardvagabond.com 2 weeks ago
Seralth@piefed.seralth.com 2 weeks ago
Literally everything is vulnerable to supply chain attacks…
Your comment is basically saying don’t go in the sun you will get sunburned so you should always avoid the sun forever.
You HAVE to accept some level of risk if your using literally any software that you don’t make, host, and maintain yourself.
So unless you have actually decent suggestions on ways to prevent issues, improve security or some tips for a new user for best practices.
All your doing is fear mongering and being extremely unhelpful.
moldy_rice@piefed.keyboardvagabond.com 2 weeks ago
Apt and most package managers have cryptographic verifications on all packaged by default since the 1990s.
Docker pull does not, so it will happily download a maliciously modified image, without checking.
You can go in the sun, but wear sunscreen. You can have sex with a stranger, but wear a condom. You can download software, but check the cryptographic signature.
Bane_Killgrind@lemmy.dbzer0.com 2 weeks ago
He’s describing literal best practices.
hperrin@lemmy.ca 2 weeks ago
Why do you say that? Docker Hub is, of course, susceptible to supply chain attacks, as are the official containers of each of these projects, but how is that all that different from installing these projects on bare metal? And how are any of them “extremely” vulnerable?
I didn’t suggest anything that isn’t either an official build from the project maintainers, or a very well supported community build from a reputable source.
moldy_rice@piefed.keyboardvagabond.com 2 weeks ago
Apt and most package managers have cryptographic verifications on all packaged by default since the 1990s.
Docker pull does not, so it will happily download a maliciously modified image, without checking.
hperrin@lemmy.ca 2 weeks ago
That’s because package managers are designed to use mirrors. You have to verify a digital signature because the package isn’t necessarily coming from the package maintainer’s repo.
Docker pulls come from the registry, not a mirror. There is no such thing as a mirror in docker. The registry is something you decide on, and if you don’t trust it, you shouldn’t use it. If the registry itself is compromised, that’s essentially like the private key of a package manager getting compromised. Same risk.
The two biggest registries are Docker Hub and GitHub. If either of them were compromised, it wouldn’t take very long for them to mitigate it. The damage would likely be very small.
hperrin@lemmy.ca 2 weeks ago
From now on, whenever you set up a service, you’ll use a subdomain, and you’ll point it in dns as a CNAME record at your apex domain (usually just an @ symbol in the input box). You’ll then (if it’s a web service) create a proxy in NPM pointed at whatever port you give it.
So now you wanna create a WireGuard vpn, so you can securely access your own stuff from your own devices outside your house. (I’d recommend not opening every service up to the internet.)
github.com/linuxserver/docker-wireguard
That one can be tricky, but ultimately you should have a file (or QR code) that you can put on your phone in the WireGuard app that will give you vpn access. Remember to set up a CNAME for your subdomain (something like vpn.example.com). Although, for this, it would be fine to use the apex domain.
So now you can set up a Nextcloud and an Immich stack. Put them on an unused port, then point a proxy for their subdomain at that port (127.0.0.1:2201 or whatever), add your SSL cert, and you’re good.
[continued…]
hperrin@lemmy.ca 2 weeks ago
In NPM, set up an access list like this:
Image
Last one should be your public IP address, with “/32” on the end.
Use this access list for all services you don’t want the wider internet to see (probably all of them for you). With this setup, you can still open a service, if you want, but normally you’ll need to be on your VPN to see it from outside your house.
hperrin@lemmy.ca 2 weeks ago
Every once in a while, you should run these commands in each services folder:
You should also back up your services folder regularly. That’s beyond the scope of this Lemmy comment, though.
843247@lemmy.dbzer0.com 2 weeks ago
Just to be super clear for any beginners reading,
docker system prune - aisn’t a command that will check if everything is still working. You have to manually check your services are ok and, if they’re working, then you can run the prune command.
prune is a command that removes any unused container images.