rasmus-kirk
55 lines
2.1 KiB
Markdown
55 lines
2.1 KiB
Markdown
---
|
|
title: Exposing Services Safely
|
|
---
|
|
|
|
The concept of "exposing" will in this context mean to access your services
|
|
outside your home network. The simplest and safest way to access your services
|
|
is from inside your home network, please consider if this covers your
|
|
needs. If not, keep reading.
|
|
|
|
## VPN
|
|
|
|
The safest way to expose your services is through
|
|
a VPN. I suggest you use [tailscale](https://tailscale.com/) or to setup
|
|
your own VPN [manually with wireguard](https://nixos.wiki/wiki/WireGuard).
|
|
|
|
## SSH Tunneling
|
|
|
|
A practically equally safe way to expose your services is with SSH tunneling.
|
|
You will either need to port forward on your router, or [run the openssh
|
|
service through a VPN](/options.html#nixarr.openssh.expose.vpn.enable),
|
|
and port forward through your VPN-provider. Then you can access your services
|
|
from a remote machine using the following command:
|
|
|
|
```sh
|
|
ssh -N user@ip \
|
|
-L 6001:localhost:9091 \
|
|
-L 6002:localhost:9696 \
|
|
-L 6003:localhost:8989 \
|
|
-L 6004:localhost:7878 \
|
|
-L 6005:localhost:8686 \
|
|
-L 6006:localhost:8787 \
|
|
-L 6007:localhost:6767
|
|
```
|
|
|
|
Replace `user` with your user and `ip` with the public ip, or domain if set
|
|
up, of your server. This lets you access the services on `localhost:6001`
|
|
through `localhost:6007`. [Example 2](/wiki/examples/example-2) has an
|
|
example configuration for this.
|
|
|
|
> **Warning:** Disable password authentication if you use SSH, it's insecure!
|
|
|
|
## Without Authentication
|
|
|
|
The most unsafe way, is to expose your services to the internet without SSH
|
|
tunneling or VPN. This lets anyone on the internet connect to your services,
|
|
and you rely solely on the security of said services, not the much more
|
|
robust public key cryptogaphy of the solutions above! While it is not
|
|
recommended, it may be necessary depending on your setup.
|
|
|
|
The Jellyfin module, helpfully, has options for this, the
|
|
[`nixarr.jellyfin.expose.https.enable`](/options.html#nixarr.jellyfin.expose.https.enable)
|
|
and the
|
|
[`nixarr.jellyfin.expose.vpn.enable`](/options.html#nixarr.jellyfin.expose.vpn.enable)
|
|
options. Read the related documentation for more information.
|