This is a continuation of my other post
I now have homeassistant, immich, and authentik docker containers exposed to the open internet. Homeassistant has built in 2FA and authentik is being used as the authentication for immich which supports 2FA. I went ahead and blocked connections from every country except for my own via cloudlfare (I’m aware this does almost nothing but I feel better about it).
At the moment, if my machine became compromised, I wouldn’t know. How do I monitor these docker containers? What’s a good way to block IPs based on failed login attempts? Is there a tool that could alert me if my machine was compromised? Any recommendations?
EDIT: Oh, and if you have any recommendations for settings I should change in the cloudflare dashboard, that would be great too; there’s a ton of options in there and a lot of them are defaulted to “off”
Beside the fact that you would like to understand if you’ve done everything properly (that’s good, but I can’t help you here), a VPN on a smartphone can be always active. Mine is always on and I’ve never noticed any battery problem. If you prefer something simpler there’s Tailscale.
If it were only me using the apps, I’d be using a VPN. Over the years, I’ve used OpenVPN, Wireguard, and now Tailscale. In my experience, they work like 99% of the time. That last 1% though is weird connection issues; usually when switching between WiFi and cellular (or vice versa) but sometimes it’s my server or ISP and I have to turn the VPN off and back on to troubleshoot. During those rare times, my partner will either turn off the VPN and forget to turn it back on or they will forget about the VPN completely and not be able to use their phone. Ideally, I’d like to set something up that doesn’t require any potential troubleshooting on their part so I can avoid hearing “why can’t we just use Google photos?” or “what’s wrong with Google home?” 😓
Yes this is the main reason for me. If you’re alone then you don’t care that things occasionally don’t work. Once you have at least one more person or potentially the extended family it’s a whole different story. And then in my opinion a potentially not 100% secured publicly accessible immich instance at home is magnitudes better than having the family just use google photos.
Because like you say, every little hick up from your site is met with “why can’t we just use $bigtech instead, it always works”.