• CompactFlax@discuss.tchncs.de
    link
    fedilink
    English
    arrow-up
    0
    ·
    edit-2
    1 month ago

    That’s never made sense to me; why build an authn frontend instead of just clicking your user if the security is just an illusion anyways. “Use a VPN” is fine for a mainframe, but an active project in 2026 should aspire to be better.

    Edit: or make note of that on their several pages with reverse proxy configuration.

    Examples dating back over six years https://github.com/jellyfin/jellyfin/issues/5415

        • sanzky@lemmy.world
          link
          fedilink
          English
          arrow-up
          0
          ·
          1 month ago

          and then you are giving access to your lan to people whose computer you don’t control and might be full of malware.

          • FauxLiving@lemmy.world
            link
            fedilink
            English
            arrow-up
            0
            ·
            1 month ago

            You only have to give them access to a specific port on a specific machine, not your entire LAN.

            My VPN has a ‘media’ usergroup who can only access the, read-only, NFS exports of my media library.

            If you’re just installing Wireguard and enabling IP forwarding, yeah it would not be secure. But using a mesh VPN, like Tailscale/Headscale, gives you A LOT more tools to control access.

            • WhyJiffie@sh.itjust.works
              link
              fedilink
              English
              arrow-up
              0
              ·
              1 month ago

              yeah but even with plain wireguard the peers can be limited. you just have to figure out the firewall rules, or use opnsense as your wireguard server because it figures the harder part out for you.

              • sanzky@lemmy.world
                link
                fedilink
                English
                arrow-up
                0
                ·
                1 month ago

                it’s not that it cannot be done. the issue is that something as simple as acceding a service should not require to configure wire guard and routing rules. plenty of FOSS projects are safe to expose through a simple reverse proxy

                • WhyJiffie@sh.itjust.works
                  link
                  fedilink
                  English
                  arrow-up
                  1
                  ·
                  1 month ago

                  plenty of FOSS projects are safe to expose through a simple reverse proxy

                  I have my doubts about that. Personally I would never do that.