I have everything I host and expose behind authelia (which requires 2fa) as middleware or as the only login method with oicd, thus far it seems to work well, of course I get a bunch of malicious traffic and spam but this gets to authelia and stops there, I don’t even see multiple tried login tries ever so I felt pretty safe. However it does seem that everyone uses either fail2ban or crowdsec in addition so I have been wondering if it would really add any security in my setup or if I’m missing something. I’m sure it wouldn’t hurt but crowdsec always seemed a little too complex for me and I don’t want something I don’t fully understand in my security layer and I never saw a nice way to setup fail2ban so never bothered. Afaik there’s no webui or such things and you have to manually make working regex for everything. I’d like to know if I’m missing something or if anyone has tipps to give
Please don’t expose your services to the internet directly. Use something like Tailscale/Headscale/whatever mesh VPN is relevant now. It’ll always be 100 times better than this and you wouldn’t worry about Authelia, f2b and CrowdSec (though updating your services and server(s) is always worth it).
It will not be a 100 times better than this, you’d need the vpn setup already on every client, how could others ever connect to it? Its also just cool to have a domain and expose it properly, I already use a vpn for admin only things
“Okay mom, you need to install this VPN, log in, and make sure it’s on whenever you’re using Immich. Can you install it for Dad too? Now I’m going to call grandma back and explain that it isn’t a Deen Peen Em and she’s never going to find that.”
There are times and places. The moment you want the non tech side of the family involved, a proper with server over the open internet is usually the better option.