I'm new to web development and bought a Raspberry Pi Zero 2 W to host my portfolio. It's running a 32-bit Raspberry Pi OS installation. To make updating the website files easier, I set up Samba so I can access and edit them from other devices on my home network. Samba appears to have opened a couple of ports locally, but online port-checking tools report that they aren't reachable from the internet.
I want to make sure I understand the security implications before continuing. My plan is to expose only the website through NGINX or Pingora, possibly using Cloudflare, while keeping Samba available only to devices on my local network. I would not intentionally forward Samba ports through my router. Is this setup reasonably safe, and what precautions should I take?
3 Answers
I would avoid using SMB/CIFS for anything outside a trusted home network. For a small project, you could run the website in a container and put NGINX or another reverse proxy in front of it. The site can read static files from a local directory or an internal NFS share. Containers can add some isolation and make deployment easier, although they are not a complete security boundary and still need to be updated and configured properly.
For a portfolio site, external object storage and a CDN are another option. You could upload the public files to an object-storage service and let the CDN deliver them, avoiding the need to expose your home network at all. That may be more infrastructure than you need for a learning project, but it’s worth considering if reliability and minimizing home-server exposure are priorities.
Keeping Samba restricted to your trusted local network is generally fine. The important distinction is that Samba should only be used to transfer or edit the website files internally; it should not be exposed through your router to the public internet. Your web server can then serve a separate directory, such as /var/www/static, over HTTP and HTTPS. Make sure the directory permissions are sensible, keep the operating system and Samba updated, use strong passwords, and verify that your router is not forwarding ports 139 or 445. Only forward the web ports you actually need, typically 80 and 443.
That makes sense. I’ll keep Samba limited to local file transfers and expose only the website through the web server. I’ll also check the router and firewall rules rather than relying only on online port scanners.
A container can help separate the web service from the rest of the system, but it isn’t exactly the same as a full virtual machine. It’s useful defense in depth, not a substitute for firewall rules, updates, and careful permissions.