家用NAS/Server/Homelab集中討論區(4)

其實要remote manage既話可以睇下pikvmunder 1000蚊可以搞到 之後可以買塊平d既板
不過你要4條ram既itx 咁冇得點揀等睇你砌機

但係佢又唔想外網access 到
再唔係用cloudflare tunnal 就唔洗開port
講多句要安全就唔好selfhost

佢behind vpn係ok既 我覺得

我見vaultwarden都有教你申請張免費letsencrypt cert 再加duckdns/synology ddns指個domain去internal IP（即佢reverse proxy個internal IP）就得
https://github.com/dani-garcia/vaultwarden/wiki/Running-a-private-vaultwarden-instance-with-Let%27s-Encrypt-certs

我理解係佢冇必要放443port出街 放vpn已夠

唔洗，免費嘅可以tunnel http嘢出街，會幫你加埋cert，當然你預咗佢可以access到你嘅data，信得過佢就用

btw真係長知識
原來lets encrypt仲可以派cert比private ip上面唔問我都唔會知

我記得以前呢度好似都有人講過唔放出街用vaultwarden

Router 唔開443 用唔到ddhs 個網域用唔到張ssl cert
Vaultwarden 一定要用https

仲以為self host 會安全d
咁都係考慮用返bitwarden 1password 果d算

其實兩睇，自己host一定安全冇人地做得咁好，但俾人睇中要搞你嘅機會唔大

放出面一般安全性就冇問題亦都好少出事，但一出事嘅話一定全世界都睇哂

唔計速度嘅話，理由同用nas定用cloud一樣

你係dns到將個domain指向internal reverse proxy ip得唔得？我理解係你唔洗開443 個flow大概係咁：
你駁住vpn -> 開bitwarden，vault ip指向你個domain -> 個domain指向你internal reverse proxy ip -> reverse proxy派張ssl cert比你手機app ->通到

因為你個domain dns A record指向既係internal ip
咁就冇必要開443 淨係開vpn port就得

又或者自己host個dns server 個dns server有條record係你個domain指向internal reverse proxy 再係個vpn到set dns server做你呢個新開既我未做過 但應該都work

我自己咁set...
traefik https proxy vaultwarden .
traefix 裝 cert self gen (or let's encrypt)
放街就 wireguard ...VPN 返去再access lan ip or domain name

wireguard 長開，淨係tunnel Adguard home 同個 reverse proxy ip.