From d5f402180335530e08e793b31327e0df2c86d6ae Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 4 Nov 2026 11:59:23 +0000 Subject: [PATCH] Docs: no port forwarding to the apps, keep the tailnet private Say to forward only 443 to a reverse proxy, never an app's own port, and to turn off UPnP. On a Synology, keep DSM's ports and QuickConnect off the internet. For Tailscale, turn on two-factor sign-in, remove lost devices, and share the machine instead of inviting people into the tailnet. --- phones.md | 15 +++++++++++++++ synology.md | 5 +++++ 2 files changed, 20 insertions(+) diff --git a/phones.md b/phones.md index 491ae9a..e8db841 100644 --- a/phones.md +++ b/phones.md @@ -52,6 +52,16 @@ their `docs/deploy.md`. Everyone who uses the apps needs to be on your tailnet. That suits a household; to share a should-we decision with friends, use a public address instead. +**Keep your tailnet private.** Whoever gets into your Tailscale account can reach every app, +so: + +- Turn on two-factor sign-in for the account you sign in to Tailscale with (Google, GitHub, + Microsoft or Apple). +- Remove phones and computers you no longer use from the + [machines page](https://login.tailscale.com/admin/machines), straight away for a lost one. +- Share the `selfhostit` machine with someone else's account (**Share** on the machines page) + instead of inviting them into your tailnet, so they reach the apps and nothing else of yours. + ## Your own domain with a reverse proxy For public addresses such as `https://splitwiz.example.com`: @@ -76,6 +86,11 @@ For public addresses such as `https://splitwiz.example.com`: - **Without opening your router:** a Cloudflare Tunnel does the same from the inside. +Forward only port 443, and only to the reverse proxy. Never forward an app's own port (8090 +to 8093) in your router: that serves the app over plain `http://`, so passwords cross the +internet unencrypted, and it skips the proxy. Turn off **UPnP** in the router too, so no +device on your network can open a port by itself. + ## Install the app on the phone Open the app's `https://` address on the phone and sign in. Then: diff --git a/synology.md b/synology.md index a67719f..6ec09ec 100644 --- a/synology.md +++ b/synology.md @@ -58,6 +58,11 @@ Two ways, both described in [phones](phones.md): walks through it step by step; repeat the reverse proxy step for each app with its own name, such as `flowy..synology.me` to port 8092. +Either way, don't forward the apps' ports (8090 to 8093) or DSM's own ports (5000, 5001) in +your router, and leave DSM's **QuickConnect** off unless you use it: they put the apps or +DSM's sign-in page on the internet, where bots try passwords all day. With a public address, +forward only 443 to DSM's reverse proxy. + ## Updating and backups With SSH on, `selfhostit update splitwiz` (or `flowy`, or `all`) pulls and restarts an app in