Would it instead be possible/easier to throw it on a VPN and make the VPN accessible from anywhere?
The reason I ask is that I want to be able to access personal web apps securely and I’m trying to figure out the easiest approach. Every time I look at authentication, it’s a labyrinth of concepts, protocols, and libraries. I don’t want to maintain that!
I really cannot recommend tailscale enough for how easy it is to set up a secure network of your own devices.
Edit: any pointers on how to set this up would be appreciated! Maybe I’m using the wrong search engine, but I haven’t found this scenario laid out clearly, yet.
In practice though - you don't have to worry about any of this! These are the steps:
* Create a tailscale account (there's a good free plan)
* Set up server. Give it a hostname (I'll use "mypi" in this example)
* Set up your web service on server - check you can get to it locally (e.g. connected by wire or just on http://localhost on that computer)
* Install tailscale on your server, and log in to your tailscale account (tailscale login and follow prompts)
* Install tailscale on your phone/laptop. Log into to tailscale
* On your phone/laptop go to http://mypi and it should Just Work!
When the VPN is on, the phone directs any traffic for 10.200.200.0/24 through the VPN and the rest of the traffic through the normal network stack. This is often called split vpn or split tunnel.
The other end of the VPN needs to be running wireguard and accessible from the internet. I have a VPS for this because my desktop is behind a firewall. But I can connect from my desktop to the VPS over wireguard (same setup) with keepalive, and they can all talk to each other over that private network.
I don't usually have this on, but occasionally if I want to ssh back home from my kid's soccer practice, I'll use it. I ssh to the 10-net address for my laptop after bringing up the split vpn.
For "securing" my application which hosts text snippets I've clipped from other websites and nothing else, it is sufficient.
version: "3.7"
x-common-variables: &common-variables
PGID: 1000
PUID: 1000
TZ: America/New_York
services:
caddy:
container_name: caddy
image: caddy:2.6.4
restart: unless-stopped
environment:
<<: *common-variables
HOST: "redacted"
LOCAL_IP: 192.168.1.2
ports:
- "80:80"
- "443:443"
- "443:443/udp"
volumes:
- ./appdata/caddy/Caddyfile:/etc/caddy/Caddyfile
- ./appdata/caddy/site:/srv
- ./appdata/caddy/data:/data
- ./appdata/caddy/config:/config
wireguard:
image: lscr.io/linuxserver/wireguard:latest
container_name: wireguard
cap_add:
- NET_ADMIN
- SYS_MODULE #optional
environment:
<<: *common-variables
PEERS: myPhone,myLaptop
ALLOWEDIPS: 0.0.0.0/0,::/0
volumes:
- ./appdata/wireguard:/config
- /lib/modules:/lib/modules #optional
ports:
- 51820:51820/udp
sysctls:
- net.ipv4.conf.all.src_valid_mark=1
restart: unless-stopped
(config) {
@internal {
remote_ip 192.168.1.0/24
}
handle @internal {
reverse_proxy {args.0}
}
respond 404
}
mySecretService.{$HOST} {
import config "{$LOCAL_IP}:5678"
}
- You may want a VLAN or separate guest network depending on if you allow guests on your network, what type of services you're running, etc.
- Many of the things I run at home have password authentication and I use them in addition to the VPN restriction.
- This was the first thing I thought of and may be insecure for reasons outside of my expertise.
- The nice thing about this is that I run pihole in the same compose file so when my phone is on my VPN I get remote ad-blocking "for free".
- Tailscale is easier and nicer (UI-wise) to set up, but I stopped using it because it's a battery hog on iOS. The "trusting someone else's server" thing is also an issue, but if not for the battery issue, I would probably still be trading the added risk for the convenience. This was not too bad to set up, though, and I'm happy with it for my simple needs. The Tailscale app also doesn't have a convenience feature that the Wireguard app does: I can tell Wireguard specific networks that I don't want it to run on (i.e. when I'm home) so that it enables automatically when I leave and turns off when I'm home.