I run a remote home server with Proxmox. It has Tailscale for emergency access and a VM running Docker, where I host services such as Immich and Vaultwarden. WireGuard is also available for remote access, with its UDP port forwarded through the router.
I would like to access some services directly from my devices without keeping the VPN connected all the time, especially because they work better with HTTPS. I currently use Caddy with DuckDNS to manage HTTPS automatically. Is opening ports 80 and 443 for Caddy an unreasonable security risk, or is this a normal approach? Would using Authelia or another identity provider with two-factor authentication provide worthwhile additional protection?
I would appreciate advice on safely exposing these services, securing the server and local network, and reducing the risk to the personal data stored on the machine.
4 Answers
If you do not need public access, keeping Tailscale as the primary method is simpler and reduces your attack surface. It also avoids needing a static public IP. WireGuard and Tailscale overlap quite a bit, so you may want to choose one as the normal VPN and keep the other only as an emergency path. SSH can also be useful as a fallback when restricted to certificate or key authentication, with passwords disabled and access limited where practical.
Opening 80 and 443 for a reverse proxy is a common setup, but anything behind those ports should be treated as internet-facing. Keep Caddy, the operating system, containers, and applications patched; expose only the reverse proxy; use separate hostnames; and make sure the services themselves are configured securely. Port 80 can usually just redirect to HTTPS, while Caddy handles certificate renewal automatically.
Another option is using a tunnel or proxy service instead of forwarding ports directly. That can hide your home IP and add access policies, but it introduces dependence on a third party and does not remove the need to secure the applications. If you expose services directly, host-level firewalls, container isolation, intrusion protection such as fail2ban, and regular offline backups are all worthwhile.
Two-factor authentication is a strong addition, especially for administrative services. An authentication gateway such as Authelia can protect applications that do not have good built-in authentication, but it should not be considered a replacement for updates, strong unique passwords, backups, and proper network isolation. Be particularly careful with services containing sensitive data, such as password managers and photo libraries.
Related Questions
Can't Load PhpMyadmin On After Server Update
Redirect www to non-www in Apache Conf
How To Check If Your SSL Cert Is SHA 1
Windows TrackPad Gestures