Self-hosting on a NAS

Problem

I wanted to host my own apps myself: to know where the data lives and to understand what happens between a git push and a working site. If you host it yourself, you are also responsible for what is exposed to the internet.

What I did

• Apps run as Docker containers on a NAS.
• The code lives on my own Forgejo. Deploying is a git pull on the NAS and rebuilding the container.
• A reverse proxy (Nginx Proxy Manager) handles the domains and the Let's Encrypt certificates.
• I also have some experience with Kubernetes and ArgoCD. TODO: describe where and what for in one or two sentences.

This site runs the same way.

The security mistake

One of my own sites was served by an nginx container with the default configuration, with the whole repository as the web root. That made the .git folder, the README and the compose file downloadable by anyone. I found it myself while looking into a report about a redirect error.

The fix: my own nginx configuration outside the web root, which returns a 404 for dotfiles and other non-site files. The redirect error came from the same default configuration and was fixed in the same change.

What I measured

After the change I checked from the outside: a request for /.git/config returns a 404 and a redirect stays on https. This site goes one step further: the container only holds the build output, so the repository is not even in the place that gets served.

What I learned

• A default configuration is made to work, not to be safe.
• Serve the build, not the repository.
• Check from the outside what is reachable. From the inside everything looks fine.