if you’re accessing over the internet, always use TLS/HTTPS.
if you’re accessing over LAN, you should still use TLS/HTTPS.
just because you’re hosting the app locally doesn’t mean the JS embedded in the page is safe. HTTPS will ensure that all your traffic is encrypted so only you and the server knows what it contains.
please don’t. this might make the pedophiles happy.
Ubuntu is notoriously finicky as a server. multiple issues with how system configuration is different from other servers like Debian, redhat, etc. firewall used to be an absolute terror. also, as described, your patch levels are tailored to the whims of a corporate entity that historically has sided with desktop stability and experience over server stability and performance.
while we’re at it, canonical captures and sells system information like Microsoft does. by using Ubuntu, you become the product. IDK how much you know about companies that sell their consumers data, but typically they put profits over security.
I’ve worked for a handful of MSP/CSP vendors over the years and they only offer Ubuntu as a server option with one big caveat. you are responsible for the maintenance of the system. lo and behold, four years later they always come crying about how they’re about to fail an audit because it’s never been updated, or is misconfigured, or was hacked because they installed a bad library, ad nauseam.
from my own experience using it, though aged, it came with a service that was listening on port 3306. was it mysql? nope. what was it? dunno. I killed everything on that system that wasn’t required by the kernel. still listening. couldn’t install a database on it, so it was wiped and I never used it again.
simply put, Ubuntu is a desktop first OS. if you use it as a server you’re going to have a bad time because statistically speaking only amateurs use it that way.
if you run Ubuntu as a server nobody should take you seriously.
Debian literally exists as a server first while Ubuntu exists as desktop first.
the only valid excuse to using Ubuntu server is if your hardware is a RPI or rpi-clone and at that point you’re at a hobbyist level which makes more sense why you’d be using Ubuntu at all.
that’s the point. you’re supposed to be exhausted enough so that you just relent and let AI take over your duties.
second objective is to showcase your incompetence to leadership so they are scared enough to replace you with AI.
this is the plan.
it should as long as it’s got that 1gbps Ethernet. 100mbps just won’t be enough for video streaming with jellyfin.
having it separate also allows you to patch routinely with minimal downtime.
I have three services which are public. Jellyfin, Seer and BookOrbit (for syncing Kobos).
don’t expose services to the internet. expose a proxy.
Imagine if your house had doors to the outside for every room in your house. not very secure, right?
I’m going to hope when you mentioned NPM you were referring to nginx proxy manager.
also, use a separate host for your proxy that is firewalled off from everything else on your network other than the host with your services and only on those specific ports. it doesn’t have to be powerful, just has to have a fast network connection. I wouldn’t use anything less than 1gbps. you could vlan as well, but that would require advanced routing or a second NIC for your services host. don’t forget to firewall your services host off the rest of your network.
finally, monitor the shit out of that proxy host. use SIEM tools like graylog, wazuh, splunk, etc. you cannot make an impenetrable fortress, it’s only a matter of time before you experience a penetration. setting up proper logging and alerting is imperative to securing your network.
you can also run them in the same container with a multi-stage build and some finesse with S6.
simplex
at 13 years old it was about two or three times my height.
maybe it wasn’t a black rat snake.
I know it was long, black, and angry as fuck lol.
could have been the stick I tossed at it…
growing up I ran across a 20’ black rat snake.
it was as thick as my ankle and chased me for a good 200 feet.
exposure is unchanged. automated patching and upgrades are working. rollbacks, etc are working. minimal attack surface exposed and properly blocking traffic by geography. rotation of keys/passwords as well as short lived rotated TLS certs.
not one of those things alone is a solution, but together can make a solid dent in securing your infrastructure.
Should I take it down?
depends. do you want to deal with a simple patch in 24 hours or do you want to rebuild an entire legacy system from nothing (assuming you don’t take proper backups).
Removed by mod
here’s the neat thing. terraform won’t push anything if nothing has changed.
so no. no recurring unconditional pushes.
in my defense I bought the majority of that in 2024 for around $300.
I was surprised to see it’s currently listed at over $2000.
it also doubles as my media ripper. I initially built it specifically for that before AI was even a thing.
I run too many models to count really. everything through CLI because I’m dissatisfied with all the sloppy UIs.
I use a terraform script that pushes my IP up to route 53 every hour. been good enough for me for the last six years.
I’ve been at this since Napster was a thing, so imagine my surprise to hear that folks are paying to pirate.
Usenet I get, but private trackers? only real benefit would be a risk reduction of being caught by your ISP, but that’s easily overcome by using a VPN.
it would if it’s importing something else.
let’s say your site is on https://app.home.com/ and your js is locally sourced. then that JS was injected with an import from http://vuln.evil.com/.
I’m pretty sure your browser would block it based on the fact that the document domain is using HTTPS and HSTS would block it based on not using HTTPS.
I think. never really tried this out tbh.