• 2 Posts
  • 18 Comments
Joined 1 year ago
cake
Cake day: June 16th, 2023

help-circle


  • GreenDot 💚@le.fduck.nettoLinux@lemmy.mlLix - a new fork of Nix
    link
    fedilink
    English
    arrow-up
    3
    arrow-down
    1
    ·
    2 months ago

    At least, for me, Nix was never attractive, and it should be by all means, the features it provides. I still see this as an alternative, where I’m more than satisfied with my bash scripts and git repos, syncthing backups to rebuild the whole system.

    And, on the second part, this schism that happened in Nix is the same recipie that happened in other projects. I just find it funny.

















  • In that case, you’re better off just using the VPS machine as port forwarding port 443 to your home machine’s wireguard IP address and handle the SSL/TLS termination on the home machine.

    This way all HTTPS traffic will be passing trough the VPS and being decrypted on your home machine, and encrypted data will be sent from your home machine back to the client. Anyone gets in or sniffs traffic will see encrypted traffic. Plus it’s already sent over encrypted VPN network. To really see what’s happening, they need to get into the machine and technically could use the wireguard private keys to decrypt the traffic, but they will still see the encrypted HTTPS traffic. So you’re good, technically.


  • You can set up nginx to do reverse proxy to your home IP, and then limit the traffic on your home IP to the VPS IP.

    You can also setup a wireguard VPN between VPS and your home machine, so the traffic between VPS and your home machine is encrypted.

    For DNS you just point to the VPS, and manage connections there, and on home network allow only VPS IP to connect. Then manage your security on the VPS.

    If you put a wireguad VPN between the VPS and your home machine, you don’t have to open any ingress ports. I’m using a similar setup, where the public VM is handling the incoming connections and reverse proxying it to a small private server in my home.

    Communication is done via wireguard VPN. I’ve used Netmaker to create a VPN connections and the mesh, and have VPN profile created on the phone, so I can reach any of the services I don’t want exposed on the public internet via private VPN ( example: listening to music via Navidrome, or home Emby server so I can watch stuff when I’m on the move and it is not exposed publicly).