Hello,

Some time ago, I started self-hosting applications, but only on my local network. So far, it’s working fine, but I can’t access them as soon as I go outside (which is completely normal).

For the past few days I’ve been looking for a relatively secure way of accessing my applications from outside.

I don’t need anyone but myself to have access to my applications, so from what I’ve understood, it’s not necessarily useful to set up a reverse-proxy in that case and it would be simpler to set up a VPN.

From what I’ve seen, Wireguard seems to be a good option. At first glance, I’d have to install it on the machine containing my applications, port-forward the Wireguard listening port and configure my other devices to access this machine through Wireguard

However, I don’t have enough hindsight to know whether this is a sufficient layer of security to at least prevent bots from accessing my data or compromising my machine.

I’ve also seen Wireguard-based solutions like Tailscale or Netbird that seem to make configuration easier, but I have a hard time knowing if it would really be useful in my case (and I don’t really get what else they are doing despite simplifying the setup).

Do you have any opinions on this? Are there any obvious security holes in what I’ve said? Is setting up a VPN really the solution in my case?

Thanks in advance for your answers!

  • Vanilla_PuddinFudge@infosec.pubEnglish
    1·
    13 hours ago

    Double-pro. Running wireguard on docker assures that a native wireguard install won’t conflict with docker. Keep those tables in the same place.

    • phase@lemmy.8th.worldEnglish
      1·
      11 hours ago

      I thought I would be the only one to try this. Would you share more details on your setup? I am interested because to me Wireguard is in the kernel so how could it be in a container.

      • Vanilla_PuddinFudge@infosec.pubEnglish
        1·
        6 hours ago

        Oh yeah. https://hub.docker.com/r/linuxserver/wireguard

        Basically, docker can and does create network devices. It’s as easy for it to create wg0’s as it is to create networks for your other docker containers. If you’re going to run wireguard and docker, you’re better off to let docker handle the network routing and just run one of the various containers out there to stop them from fighting. That particular container is more general. You can run it client or server. Wg-easy, I believe is server-only, or even hide it inside other containers like docker-qbittorrent-wireguard, where it just hangs out and connects to whatever .conf you give it.

        I did the whole thing in my early days selfhosting where I installed wireguard, docker, some apps, rebooted, everything breaks.

        Install a wireguard container, configure it as you would, your apps, reboot… it still works, because docker isn’t conflicting with native wg-quick. It’s either this, or untangle and make an iptables setup permanent so when you reboot, it doesn’t break again.