Another option if you need public access without something like tailscale would be to use ddns and a AAAA record. Something like https://github.com/ddclient/ddclient would help do that.

That way if the IP changes, you’d pick up on the change for your vanity url within a few minutes… and can get https certs for that url as well.

Edit: I reread the OP. This doesn’t help if clients need direct ipv4. Sorry about that.

The UI goes in circles. I wish we stopped changing things when they aren’t broken.

Bad eh security advice: use an alternative ssh port. Lots of actors try port 22 and other common alternatives. Much fewer will do a full port scan looking for an ssh server then try brute forcing.

I have both but just use pihole as a local DNS server/forwarder. I bump into too many random times where sites or redirects don’t work properly since they get blocked.

Consider using containers. I used to think this way, though now my goal is to get down to almost all containers since it’s nice to be able to spin up and down just what the one ‘thing’ needs.

If this is your fear, why not just have a will or something that specifically describes what to do and where to go?

I’d be down for a smart watch with like a week of battery life, with a backlight on lift, and I guess NFC for paying.

I know I won’t get that combo, but I can dream.

How does a doddle compare to a jiffie?

Exactly the same boat. But man Cloudflare is better in every way. Having an API to update/fetch records for a zone does wonders.

deleted by creator

In theory you could generate a wildcard to a domain then use it.

Self hosted. Though hey someone may wind up here via all and scroll and wonder what else there is.

If you have Prime and aren’t insisting on self hosting: Amazon Photos gives you unlimited full quality photo backups.

Terrible idea of the day: You could use something like NFS and map the drive on all clients. On that drive you can have the latest keys then use symlinking to update, etc.

Something like puppet, chef, ansible are likely better choices.

I’ll put a recommendation out for if you’re going to open ports: use abnormal ports. Someone is likely to try to hit your port 22 for ssh, but not your port 49231.

Edit: It’s definitely some security by obscurity. Still use a strong password or keys.

For people who don’t mind it not being self hosted: Authy is good for this. You can also set a backup password (to encrypt your tokens on their servers) and optionally use it cross device.

You can allow multi device temporarily to setup, then disable to not allow new devices, etc.

(I get you didn’t ask this specifically, but figure it could be useful to someone else).

Yeah… but I think its overkill. The root cert would be on the same box somewhere nearby. Compromising the host has the same issue as plaintext.

This is likely a too late, but reasonable moment to say this server happens to be Windows based.

… for backup reasons.

(The tool used for online backup only allows home versions of Windows and local drives)

One day if I build a new one, I might start with a Linux base, though that kind of requires this one to be on its last leg before I get to that point. It’s running a processor/mobo that are 14ish years old… so maybe I should think more about it.

I think you hit the nail on the head with the true security being black box. The moment I need access, I’m making a hole.

I guess at the end of the day there is also a root of trust. In an enterprise setting a system giving out certs could be compromised and give out certs to the wrong people/machines. In a home setting, the machine being compromised has a similar affect.

Funny enough, I thought of using a USB stick or something as a physical security key, using that for a vault, then having secrets in the vault… but then realized I’d have to leave it plugged into the server, making it so anyone with server access would get the password anyways.

Makes me think that everything is security by obscurity at some level. The more obscure: the more ‘secure’.

It’s kind of like how an SSH key is generally considered more secure, but if I used password authentication and had a file with a 512 character random password, it would be more/less the same thing. Either way, we have the key in a file.