73 lines
1.9 KiB
Markdown
73 lines
1.9 KiB
Markdown
# Security TODO
|
|
|
|
## Future Improvements
|
|
|
|
### Investigate Cloudflare Tunnel as Alternative to Port Forwarding
|
|
|
|
**Why:**
|
|
- No ports opened on router (better security)
|
|
- Cloudflare DDoS protection
|
|
- Hides home IP address
|
|
- Works with existing Traefik setup
|
|
|
|
**Resources:**
|
|
- [Cloudflare Tunnel Documentation](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/)
|
|
- Can work alongside or replace current port forwarding setup
|
|
|
|
**Status:** To investigate
|
|
|
|
---
|
|
|
|
### Look into Pangolin
|
|
|
|
**Note:** Research what Pangolin is in context of homelab/self-hosting security
|
|
|
|
**Status:** To investigate
|
|
|
|
---
|
|
|
|
## Current Security Measures
|
|
|
|
### Active:
|
|
- ✅ SSH key-based authentication (password auth disabled)
|
|
- ✅ Traefik SSL/TLS via Let's Encrypt
|
|
- ✅ Basic auth on Traefik dashboard
|
|
- ✅ VPN routing for Servarr stack (via Gluetun)
|
|
- ✅ Watchtower for automatic container updates
|
|
|
|
### Planned:
|
|
- [ ] Investigate Cloudflare Tunnel
|
|
- [ ] Research Pangolin
|
|
- [x] ~~Add Fail2ban for brute force protection~~ → Replaced by CrowdSec (see [[CrowdSec Setup]])
|
|
- [x] Close port 2222, disable Gitea SSH, use HTTPS git (see [[CrowdSec Setup#Step 1]])
|
|
- [ ] Implement Traefik rate limiting middleware
|
|
- [ ] Set up IP whitelisting for admin interfaces
|
|
- [ ] Regular security audits of exposed services
|
|
- [ ] Configure automated backups with encryption
|
|
|
|
---
|
|
|
|
## Port Forwarding Currently Active
|
|
|
|
| Port | Service | Notes |
|
|
|------|---------|-------|
|
|
| 80 | Traefik HTTP | Auto-redirects to HTTPS |
|
|
| 443 | Traefik HTTPS | SSL/TLS encrypted |
|
|
| 2222 | Gitea SSH | For git operations |
|
|
|
|
**Risk Level:** Medium
|
|
- Publicly exposed services
|
|
- Mitigated by: SSL, authentication, regular updates
|
|
|
|
**Action Items:**
|
|
- Monitor logs regularly
|
|
- Keep services updated
|
|
- Consider Cloudflare Tunnel migration
|
|
|
|
---
|
|
|
|
## References
|
|
|
|
- [[Traefik Multi-Stack Setup]] - Current setup documentation
|
|
- [[Integrating Servarr Stack with Traefik]] - VPN-routed services
|