[{"data":1,"prerenderedAt":110},["ShallowReactive",2],{"werk-self-hosting-en":3},{"id":4,"title":5,"body":6,"date":99,"description":100,"draft":101,"extension":102,"image":99,"imageAlt":99,"meta":103,"metric":99,"metricLabel":99,"navigation":104,"order":105,"path":106,"seo":107,"stem":108,"__hash__":109},"en\u002Fwerk\u002Fself-hosting.md","Self-hosting on a NAS",{"type":7,"value":8,"toc":90},"minimark",[9,14,23,27,47,50,54,61,64,68,75,79],[10,11,13],"h2",{"id":12},"problem","Problem",[15,16,17,18,22],"p",{},"I wanted to host my own apps myself: to know where the data lives and to understand what happens between a ",[19,20,21],"code",{},"git push"," and a working site. If you host it yourself, you are also responsible for what is exposed to the internet.",[10,24,26],{"id":25},"what-i-did","What I did",[28,29,30,34,41,44],"ul",{},[31,32,33],"li",{},"Apps run as Docker containers on a NAS.",[31,35,36,37,40],{},"The code lives on my own Forgejo. Deploying is a ",[19,38,39],{},"git pull"," on the NAS and rebuilding the container.",[31,42,43],{},"A reverse proxy (Nginx Proxy Manager) handles the domains and the Let's Encrypt certificates.",[31,45,46],{},"I also have some experience with Kubernetes and ArgoCD.",[15,48,49],{},"This site runs the same way.",[10,51,53],{"id":52},"the-security-mistake","The security mistake",[15,55,56,57,60],{},"One of my own sites was served by an nginx container with the default configuration, with the whole repository as the web root. That made the ",[19,58,59],{},".git"," folder, the README and the compose file downloadable by anyone. I found it myself while looking into a report about a redirect error.",[15,62,63],{},"The fix: my own nginx configuration outside the web root, which returns a 404 for dotfiles and other non-site files. The redirect error came from the same default configuration and was fixed in the same change.",[10,65,67],{"id":66},"what-i-measured","What I measured",[15,69,70,71,74],{},"After the change I checked from the outside: a request for ",[19,72,73],{},"\u002F.git\u002Fconfig"," returns a 404 and a redirect stays on https. This site goes one step further: the container only holds the build output, so the repository is not even in the place that gets served.",[10,76,78],{"id":77},"what-i-learned","What I learned",[28,80,81,84,87],{},[31,82,83],{},"A default configuration is made to work, not to be safe.",[31,85,86],{},"Serve the build, not the repository.",[31,88,89],{},"Check from the outside what is reachable. From the inside everything looks fine.",{"title":91,"searchDepth":92,"depth":92,"links":93},"",2,[94,95,96,97,98],{"id":12,"depth":92,"text":13},{"id":25,"depth":92,"text":26},{"id":52,"depth":92,"text":53},{"id":66,"depth":92,"text":67},{"id":77,"depth":92,"text":78},null,"My own apps live with Docker, Forgejo and a reverse proxy, plus a security mistake I found and closed myself.",false,"md",{},true,3,"\u002Fwerk\u002Fself-hosting",{"title":5,"description":100},"werk\u002Fself-hosting","P_LCi3DqS23ZqMg6-W2_qxzE0U-3k5H2Kw4468Qzjn8",1794308981353]