This is a continuation of my other post

I now have homeassistant, immich, and authentik docker containers exposed to the open internet. Homeassistant has built in 2FA and authentik is being used as the authentication for immich which supports 2FA. I went ahead and blocked connections from every country except for my own via cloudlfare (I’m aware this does almost nothing but I feel better about it).

At the moment, if my machine became compromised, I wouldn’t know. How do I monitor these docker containers? What’s a good way to block IPs based on failed login attempts? Is there a tool that could alert me if my machine was compromised? Any recommendations?

EDIT: Oh, and if you have any recommendations for settings I should change in the cloudflare dashboard, that would be great too; there’s a ton of options in there and a lot of them are defaulted to “off”

  • Jeena@piefed.jeena.netEnglish
    2·
    17 days ago

    So there is https://en.wikipedia.org/wiki/Fail2ban which helps already to some degree.

    But what are you trying to prevent? You have your services in a docker container, hopefully not running as root, which already makes it difficult to break out even if through a bug someone would be able to get access to the docker container.

    I mean its not like your stuff is very important for someone to break in like the pentagon, you probably just have some photos from your phone on it, some lights can be switched on and off and some temperatures read.

    I’m not trying to say that you should not care about it but I’m trying to figure out what your threat model is.

  • Xanza@lemm.eeEnglish
    1·
    17 days ago

    By not making them publicly accessible. With Wireguard there’s really no reason.

    Setup service to be active on a subnet, enable Wireguard to VPN into the subnet and use the services.

    • peregus@lemmy.worldEnglish
      1·
      17 days ago

      With Wireguard there’s really no reason.

      Well, that’s kinda of a personal choice. If somebody needs to have services accessible by someone else besides him, that service can’t be behind a VPN (let’s face the truth: we know that we can’t ask all out relatives and friends to use a VPN).

      • KairuByte@lemmy.dbzer0.comEnglish
        1·
        17 days ago

        There’s also something to be said about some services being cordoned off in a VPN while leaving some public with security. I don’t necessarily want everyone within my full network if all I want is to share one service with them.