Files

T

git 43f25321d7 modified: core/authelia/docker-compose.yml

modified:   core/crowdsec/docker-compose.yml
	modified:   core/error-pages/docker-compose.yml
	modified:   monitoring/docker-exporter/docker-compose.yml
	modified:   monitoring/docker-socket-proxy/docker-compose.yml
	deleted:    monitoring/influxdb-service/docker-compose.yml
	modified:   monitoring/node-exporter/docker-compose.yml
	modified:   monitoring/pihole-exporter/docker-compose.yml
	modified:   monitoring/telegraf/docker-compose.yml
	new file:   service-access-policy.md

2026-04-13 11:51:45 +10:00

3.8 KiB

Raw Blame History

Service Access Policy and External Exposure Hardening

1) Service classification

Service/Host	Classification	Rationale
`auth.lan.ddnsgeek.com`	`authenticated-public`	Public identity/login entrypoint; internet-accessible but requires user authentication.
`nextcloud.lan.ddnsgeek.com`	`authenticated-public`	Internet-facing collaboration app that must remain reachable to authenticated users.
`passbolt.lan.ddnsgeek.com`	`authenticated-public`	Public password-management portal with strong authentication controls.
`gitea.lan.ddnsgeek.com`	`authenticated-public`	Public developer endpoint with account-based access.
`searxng.lan.ddnsgeek.com`	`public`	Intended anonymous/search access endpoint.
`familytree.lan.ddnsgeek.com`	`authenticated-public`	End-user app; externally reachable but login-protected.
`shifts.lan.ddnsgeek.com`	`authenticated-public`	End-user app; externally reachable but login-protected.
`stockfill.lan.ddnsgeek.com`	`authenticated-public`	End-user app; externally reachable but login-protected.
`gotify.lan.ddnsgeek.com`	`private-admin`	Admin/ops notification backend; should not be internet reachable.
`grafana.lan.ddnsgeek.com`	`private-admin`	Infrastructure admin/observability console.
`prometheus.lan.ddnsgeek.com`	`private-admin`	Monitoring datastore/query interface.
`node-red.lan.ddnsgeek.com`	`private-admin`	Automation runtime and flow editor.
`traefik.lan.ddnsgeek.com`	`private-admin`	Reverse-proxy admin/dashboard surface.
`portainer.lan.ddnsgeek.com`	`private-admin`	Container management plane.
`influxdb.lan.ddnsgeek.com`	`private-admin`	Metrics datastore admin/API surface.
`kuma.lan.ddnsgeek.com`	`private-admin`	Monitoring admin surface.
`monitor-kuma.lan.ddnsgeek.com`	`private-admin`	Monitoring admin surface.
`edge.lan.ddnsgeek.com`	`private-admin`	Edge/network administration plane.

2) Required controls for `private-admin`

Apply at least one trusted-path control (preferably layered):

Private network only (no public DNS / no internet route).
WireGuard/Tailscale/OpenVPN access gate.
mTLS client certificate requirement at reverse proxy.
Source IP allowlist at firewall and reverse proxy.

Minimum target state for all private-admin hosts:

Public internet: connection refused/timeout, or immediate 403 for untrusted source.
Trusted path (VPN/mTLS/allowlisted IP): normal authenticated access.

3) Gateway auth hardening

For all public and authenticated-public services:

Keep SSO and MFA enforcement at the identity gateway.
Enforce lockout/backoff on /login, /oauth/*, /auth/*, /api/auth/*.
Rate-limit by source IP + account identifier to deter credential stuffing.

Suggested baseline:

Soft limit: 10 req/min per IP for auth endpoints.
Burst: 20.
Temporary block: 15 min after repeated failures.
Account lockout: 5-10 consecutive failed attempts (with secure unlock flow).

4) WAF / reverse-proxy protections

Deploy one of:

WAF managed rules for bot/credential-stuffing signatures.
Reverse-proxy failed-auth throttling and tarpit/delay policy.

Implement logging + alerting thresholds:

High failed-auth rate from one IP/CIDR.
Password spray pattern across many usernames.
Geo/ASN anomalies for sensitive apps.

5) External re-test procedure

Re-test from a non-trusted external network and record outcomes.

Success criteria:

Every private-admin host is inaccessible without VPN/mTLS/allowlisted source.
public and authenticated-public hosts remain reachable.
Auth endpoints trigger rate-limit/lockout controls under failed-attempt simulation.

Use ./scripts/retest-external-access.sh for a repeatable external validation pass.

3.8 KiB Raw Blame History