I would like to make some of my self-hosted services externally accessible. Currently I use a VPN to access stuff externally, however this doesn’t work on all use-cases. I also use Tailscale for some things.

I would love to use cloudflare tunnels and another auth solution (like keycloak) to replace Tailscale and the VPN.

Is this feasible?

My end goal would be to setup Immich for my family, and have them not have to worry about Tailscale, a VPN or anything other than some initial login to keycloak (for example)

  • just_another_person@lemmy.world
    link
    fedilink
    English
    arrow-up
    7
    ·
    1 month ago

    Tunnels are not authentication.

    Are you asking how to have each service challenge for authentication? That’s up to the software.

    • Dust0741@lemmy.worldOP
      link
      fedilink
      English
      arrow-up
      2
      ·
      1 month ago

      True. I would like to add another authentication.

      I guess my question is how trustworthy is built-in authentication? I’m not really talking about vulnerabilities, but that’s a part of this, but how much trust can I put into a small projects login page being secure?

      • just_another_person@lemmy.world
        link
        fedilink
        English
        arrow-up
        3
        arrow-down
        1
        ·
        1 month ago

        That’s really up to the software again. If you’re not technically inclined enough to run through the code, that’s fine, but you have to trust that other people are.

        Go and search GitHub issues or this project by name for what you’re concerned about.

        Authentication is also not security, btw. It’s just access. If you can be more specific about your concerns in your post, you may get more direct answers.

        • tofubl@discuss.tchncs.de
          link
          fedilink
          English
          arrow-up
          3
          ·
          1 month ago

          “authentication is not security,” can you elaborate on that?

          Your statement doesn’t really overlap with my understanding of security, as “just access” seems critically relevant to how secure user data is, for example. Am I missing something?

      • LainTrain@lemmy.dbzer0.com
        link
        fedilink
        English
        arrow-up
        1
        ·
        1 month ago

        None. Dashy’s authentication was famously literally security theatre even with Keycloak. You could just pause the load in browser and have full access to the config. Because it let you iframe whatever you could now do so with local services to enum. Somehow Jellyfin is unbustable though. So it’s a bit of a crapshoot. Look at past vulnerabilities. Stuff like XSS unless stored you don’t need to worry about, clickjacking, tab nabbing etc. On the other hand anything that’s arbitrary file read, SQLI, RCE, LFI, RFI, SSRF etc. I would look at seriously. E.g. don’t make your 13ft public because it can be used to literally enumerate your entire private network.

      • FierySpectre@lemmy.world
        link
        fedilink
        English
        arrow-up
        2
        arrow-down
        1
        ·
        1 month ago

        I’d like to do the same, but atm I use nginx to serve all the web interfaces… And keycloak support is either a plus subscription feature or made to work with hacky Lua scripts.

        So for now it’s security through obscurity, I got a wildcard cert and the pages are accessed based on subdomain. So afaik nobody has a clue unless they start iterating common subdomain names. (At some point™️ I’m adding proper auth though)

  • jws_shadotak@sh.itjust.works
    link
    fedilink
    English
    arrow-up
    5
    ·
    1 month ago

    I set up Authentik for some of my services and it works.

    The setup really threw me off but I powered through learning it. It’s a strange UI and process.

    Basically you set it up with Nginx or Caddy or whatever reverse proxy you use. Your reverse proxy points to Authentik and Authentik takes that link and checks for authorization first. If not authorized, prompt login. If authorized, pass on to the subdomain or whatever it is.

    To do all this, you’d need a domain.

    • Lem453@lemmy.ca
      link
      fedilink
      English
      arrow-up
      1
      ·
      1 month ago

      I use this for oauth, forward proxy and ldap authentication. All my apps are authenticated via authentik and its great

  • liliumstar@lemmy.dbzer0.com
    link
    fedilink
    English
    arrow-up
    1
    ·
    1 month ago

    It’s feasible as long as all the stuff you want to auth supports oauth, oidc, or saml. It might be a bit overkill for your use case, unless you have a bunch of services you didn’t mention. Keycloak has a bit of a learning curve, but works great once you get past that.

    • seang96A
      link
      fedilink
      English
      arrow-up
      1
      ·
      1 month ago

      Keycloak does, and seems more enterrisey than other solutions.