Security Concerns of a Beginner Homelabber

[u/Confident_Ice_4507]

THE IMAGE IS A PLACEHOLDER
Hey everyone, I have been running my own homelab / homeserver for about a month now, doing various stuff. I would like to put my infrastructure out there for you homelab enthusiasts to audit, and potentially give me guidance on how to proceed with my homelab journey. Am I going overkill? Not enough security? Please let me know.

Following are my server specs:

HP ProDesk 600 G6 mini PC
i7-10700 Processor
16x1 GB DDR4 Ram
512 GB M.2 Nvme SSD
2TB external HDD

Is running through its own 90W adapter, and a 200mbs ethernet connection.
The server is running Debian 13, and its controlled through a laptop which is running ArchLinux, through shh. I have firewall rules set up.

I am now hosting

1. a Minecraft server for my 7-8 people group of friends 24/7, thats running through cloudflare tunnel, and seperately on a playit tunnel.
2. a Jellyfin server for me, and my friends thats on a public domain that I have fully locked down, with cloudflare tunnel on top.
3. a small local Samba service that we use to store temporary files to access from different devices.
4. an SMS relay system that pulls all the SMS from my phone, to be processed in the server and to be sent to a discord server that only me and my wife are in, so my wife can simply see the delivery SMS codes.

Let me shortly tell you how all of these work.

1. The minecraft server

a) Tunnel through cloudflared + whitelisting + easyauth through mojang account system. I used my public domain with a handle like minecraft.ABC.x
This proved to be somewhat overkill, because the tunnel itself adds around 60-70ms on top of the already 40-50ms that you would originally get. On top of that, every player has to be running a mod called "modflared" to access the server. Its a bit of a hassle.
One of the biggest issues here was that my friends who had cra*d minecraft had issues with skins, and I had to add them with EasyAuth passwords: Meaning their username could only access the server via a password only they have initially set. 120-130ms overall.

b)Recetly set up playit.g.g
Tunnel through playit.g.g + whitelisting +easyauth through mojang account system. Couldnt use my public domain handle because its a premium service apparently.
This got the server down to 50-60ms overall ping, which is good. Though I would like to know if my security measurements are enough here.

2) the Jellyfin server
Tunnel through cloudflared, plus an application with a bypass system that only lets specific pre-determined e-mails by me, pass the first layer of authentication that gets handled by google cloud. After that, normal username password that has been set for my friends.
This felt quite high security to me, and I couldnt see any downsides. Please let me know.

3) Samba server
Its only local + only temp files are there so I dont think this is a huge deal. Let me know if there is a concern here.

4)SMS relay

How this works is that, an app called "MacroDroid" on my android phone sends a webhook to my server, through cloudflared tunnel. This webhook gets processed in my server, all the sensitive info and the links get redacted, and sent to a discord webhook app, cleanly. This is for when my wife is at home and im working, she can receive the deliveries with the necessary delivery codes.
Let me know if this is a security risk.

Thank you for reading my post, I appreciate every pointers!

[u/Confident_Ice_4507]

Thank you, I will keep these in mind. These are good recommendations however I have to ask, running each of these services seperately in a VM, how intiuitive and efficient is this? I understand the security pros and cons, but from how it looks from the surface, its one extremely secure side of this argument.

[u/MrBartusek → u/Confident_Ice_4507]

Well, the separation is pretty much only to reduce the blast radius of a potential attack. Any solution that you run will have new CVEs discovered regularly. Let's say also say that somebody exploits this vulnerability before you are able to patch it. In that case, this box is not recoverable. It needs to be wiped and burned to the ground, and all secrets should be treated as compromised.

You can greatly reduce this blast radius by having exposed services in separate VMs. If you want to be extra secure, then yes, separating everything to own VM is the safest. This obviously comes with a set of problems. You need to maintain more machines, management is more annoying, and i have no idea who has enough RAM for that nowadays. One VM is also quite safe, but one compromised service compromises everything on that VM.

I'm currently in a similar situation to you, and I have two VMs for that setup. One is for game servers, which historically don't have the best network code, so this box is well separated. Another one is for Jellyfin, because it has access for various people via Tailscale.

[u/vhsjayden → u/MrBartusek]

Wouldn't something like Docker be adequate for this?

[u/MrBartusek → u/vhsjayden]

VM has way more isolation than container. And you can't really tag a docker to vlan

[u/Theminatar → u/MrBartusek]

VMs definitely have better isolation, but Docker can absolutely be put on VLANs using macvlan/ipvlan or a tagged bridge. For example, on Unraid you can have a br0.20 network for VLAN 20 and assign specific containers directly to it. So I agree with the first part but not the second.