Selfhosted
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
-
No spam posting.
-
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
-
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
-
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
-
No trolling.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
view the rest of the comments
The simplest way is to add a Basic auth to the
lemmy-ui, say via the reverse proxy.Wouldn't this do basically nothing to prevent a 3rd party client from browsing your instance without authentication? I don't know that there's much that can really be done about this because you need open APIs for other instances to be able to access the content of your instance in order to make federation possible. That said, it's an important consideration that anybody running a single person instance should consider. If you run a single person instance, people can learn a lot about you just by seeing which communities are available on your instance. The only way to obfuscate your actual interests is to have a dummy account subscribe to all the top communities on the biggest instances. (Which, honestly, this isn't a bad strategy to employ anyway if you're wanting a fresh All feed).
Yes the basic auth way I suggested only protects the
lemmy-uifrom being accessed which is the lowest hanging fruit in the equation. That's also why I call it the "simplest way". "Interested parties" can still access your instance via API if they know their way.the federation API is independent of the front-end client API. You can run headless, without lemmy-ui, and federation still works. The API structure for federation is standardized, the front-end client API is unique to Lemmy.
You can run headless or do what the person I was responding to recommended and put it behind an authenticated portal, but that's not really going to stop other instances and clients from accessing the same resources that op is hoping to limit access to except in the most basic case of people casually browsing op's Lemmy instance through op's own lemmy-ui.
Edit, but to be clear, what I was responding to and my response didn't directly address op's specific concern (which I kind of misunderstood myself before just now rereading) that outside/guest users shouldn't be able to search for communities from other instances and I think it's a fair concern because just searching for a community from another instance brings in posts and could be a vector for spam/abuse.
Not OP, but I do feel dumb for not thinking of that assuming it would defederate me. Oh well, got a cool domain out of it
It would not affect federation as the endpoints are still open. But a word of caution. This only protects the
lemmy-uifrom being accessed without the basic auth credentials. If someone tries to access your instance via API, it will still work.You could also route any calls to /api through authentication. However I am not sure if that can cause any problems. Is there a list of endpoints that need to be reachable for federation to work?
It might. Some mods/instance admins might see your comments, decided to check your instance, and found it suspicious because it's protected behind basic auth and decided to block your instance. You can see in the modlog that people sometimes bans private instance (instance that don't let you see anything unless you're logged in) out of suspicion that they are a source of bots traffics.
A better way is probably to only protect your search page behind basic auth so no one can hook in new communities in your instance.