Just exposed Immich via a remote and reverse proxy using Caddy and tailscale tunnel. I’m securing Immich using OAuth.

I don’t have very nerdy friends so not many people appreciate this.

  • ikidd@lemmy.worldEnglish
    0·
    2 days ago

    The attack surface might be an entire API, not just your login screen. You have no idea what that first page implements that could be used to gain access.

    You can improve this by putting a basic auth challenge at least in front of the applications webpage. That would drastically reduce the potential endpoints.

    • Noggog@programming.devEnglish
      0·
      2 days ago

      Thanks for the insight! Does running this in a docker container help limit the damage at all? Seems like they’d only be able to access the few folders I have the container access to?

      • ikidd@lemmy.worldEnglish
        0·
        2 days ago

        Maybe a bit, but if you’re not running rootless docker if they get out of that container they’ll have the run of your docker host. It is a lot of layers to crack, but sometimes they’ve got nothing but time, or it’s been so long since the containers been updated that its trivial. That’s why rootless docker or podman, and Watchtower are your friends.

        Also, vlan off your exposed surface and build firewall rules for the VPN and LAN inbound to it, and specific outbound rules if you need those servers to reach into those networks themselves.