General Security concerns. what to do next?

[francislavoie]

@Smalltalkjava

I am just trying to figure out what i need to do to enhance my security.

I see no problems with security for your current setup, frankly.

Some reading materials on using Caddy in a home network:

Using Caddy as a reverse proxy in a home network

If you want to run a service inside a Local Area Network (LAN) such as your home or office – and especially if you want to be able to access it from outside that network – Caddy can help you accomplish this quite easily. This guide will show you how. It assumes you’ve never done this before, but that you have some technical proficiency and are somewhat knowledgable about your own network. Do this at your own risk. There are several ways to make private services accessible from other n…

@Smalltalkjava

Is there a way to send an error or something back if the client goes to my site directly without using the /eggplantview baseURL.

Yep, just handle the requests with a request matcher.

Request matchers (Caddyfile) - Caddy Documentation

A common pattern is to do something like this:

example.com {
	redir /foo /foo/
	handle /foo/* {
		reverse_proxy localhost:8096
	}

	handle {
		# Any other requests are caught by this
	}
}

I recommend making use of subdomains instead of subpaths though, like jellyfin.melbatoast.hopto.org or whatever. It’s a cleaner solution, and avoid potential issues with apps that don’t behave well when proxied in a subpath. See this article for an explanation:

The "subfolder problem", OR, "why can't I reverse proxy my app into a subfolder?"

Have you ever tried to reverse proxy an app into its own little subfolder of your domain name? Makes things neat, doesn’t it? Using example.com/foo/ for one app, example.com/bar/ for another. If you’re coming here from one of the selfhosted communities, you might be thinking along the lines of example.com/sonarr/, example.com/radarr/ etc. Chances are, you’ve tried some configuration along these lines: example.com { redir /sonarr /sonarr/ handle_path /sonarr/* { reverse_proxy localhost…

@Smalltalkjava

Also, on a related note, am I using the log system in an efficient manner?

There’s not really much to do for “efficiency”, the defaults should already be good enough (i.e. you probably don’t need to override the roll options at all)

@Smalltalkjava

Do I need the “encode gzip”?

It’s not required, but it does compress responses and therefore takes up less bandwidth, and is usually faster due to lowered data transfer times.

@Smalltalkjava

I have the baseURL that i can configure in JellyFin so I can make it more robust and non-standard. that way hitting my DNS doesn’t just get access to my Jellyfin server

Security by obscurity is not really that useful. If you have authentication on your Jellyfin server, it’s good enough.

@Smalltalkjava

does anyone know of a way to block IP’s that abuse my login?

There’s not really much tooling out there yet to handle Caddy’s style of logs unfortunately.

I don’t use any IP blocking tool for my home networking setup, and I have no problems. It’s not usually that common to get hit with lots of traffic. You probably won’t need to worry about it.