King, all you must do is set up root ssh access with a short password and port forward port 22 to it. Super easy, super quick!
For extra spice, I’d recommend also hitting your hard drives with a hammer once or twice a day. They just don’t like vibrations; you’ve gotta weed out the weak ones. Only the strong data will survive.
The only thing that can get hacked is something that responds on the World Wide Web.
So you limit the scope of what talks to the WWW:
Wireguard VPN will not respond unless the magic keys are correct, it’s ideal security and obscurity. Put everything you can behind it.
For things I want on the WWW without a VPN, I split out two options otherwise.
Caddy checking mTLS certificates that basically allows a device access without extra steps - relying on Caddy to be strong and mTLS to be strong.
Authentik’s proxy check, I think Authelia has this too, but to access a site you hit an Authentik login first.
For both of those, you rely on those services not having 0-day hacks. More likely for these services to stay ahead of the game and/or fix quick than something that doesn’t exist just to do authentication. I run them in containers that are run by independent users and are read-only with capabilities limited, in a VM.
I’d say the Caddy route is more secure than Authentik, but it needs more effort to setup the certificate stuff. Authentik route needs a web browser to log in with. Obviously the WG VPN is primo.
Edit: also tailscale is just managed wireguard, so it has the same benefits as a wireguard vpn with the catch a company has access to your network also now. But really simplifies setup……
Gotchya, so at the reverse proxy stage you have a pathway for “if they have the mTLS certificate, allow in” to let you access your stuff from outside your local network?
If you feel up for answering, what is your use case for wanting to manage your own mTLS?
SSH lets you remotely control a computer It runs on port 22 If you forward port 22 to your computer, you will allow anyone on the internet to SSH to your computer
You can do that pretty safely by disabling root login and disabling password logins - only using keys to SSH in.
You can join the borg botnet by enabling root login, setting a simple password (maybe even password as recommended!), and waiting.