Self-Hosted Apps Are Hard to Secure Without SaaS Help
Users are grappling with the complexities and anxieties of securing self-hosted applications and data. This involves managing authentication, encryption, backups, and dealing with evolving security requirements, often leading to frustration and a desire for simpler, more reliable solutions. The need for robust, self-managed security is paramount.
SOURCES (60)
“I’d separate the two problems: storing the credentials securely and making sure someone can access them if you’re unavailable. A password manager with shared/emergency access seems cleaner than keeping a master document of everyone’s logins. I’d also make sure each client owns their own accounts…”
“All your BW clients already have full encrypted copies of your vault. If one goes down you can just restore from one of the other hosts”
“One more thing I’ve found since, the desktop app and browser extension are completely isolated from eachother. In 1P when you unlocked the app the extension automatically unlocked, so you never had to think about unlocking the extension. It’s a loooot of little stuff like that that makes BW just a worse user experience”
“Bitwarden is not a FOSS project is it? It’s also commercial. The vaultwarden server I don’t really have problems with, it’s just the bitwarden clients. It’s fine if you don’t care about it, you just have different priorities than I do. 1password was just as functional and had a fantastic UI, it’s not an impossibility.”
“Another happy user here. KeePassXC on desktop, KeePassium on ios, sync via app folder in dropbox - the easiest setup”
“FYI use a wildcard cert otherwise bots can see the subdomains and hit those apps directly. You can see what's showing up in public logs here https://www.certkit.io/tools/ct-logs/”
“Paid Bitwarden is relatively inexpensive. If you're using it without any family sharing, you can go a long way with just a free account. I self host but the experience is basically the same.”
I use Bitwarden because I don’t want to host my own passwords
“I use it on both. No issues with either other once you turn off auto fill from browsers.”
“The different media types are a bit irrelevant now. With how cheap it is to cold tore it’s perfectly reasonable to store with two separate providers and have one copy on site. In my opinion anyway.”
You want 2fa enabled on your secret store (vaultwarden) in this case.
You want 2fa enabled on your secret store (vaultwarden) in this case.
“Well, good for you, some of us do care about others though and how to not put additional burden of being locked out of important information or services on them.”
“This came up earlier... I migrated from 1Password to Bitwarden in 2019 when AgileBites was abandoning perpetual licenses. It's been a while, and things likely have changed, but as I recall the primary feature I lost when migrating was a special item type in 1Password for bank accounts. Bitwarden has records for credit/debit cards, but not bank accounts. I just put this info in Secure Notes using custom fields. Bitwarden did offer what I liked most in 1Password - the option for it to generate”
“Yep. I use 1password personally and bitwarden at work. Bitwarden autocomplete doesn't work most of the time for me whereas 1password has been consistent. Most of the time I need to open the extension on bitwarden to fill in my username and then again for the password (and god forbid a third time if I need a otp). This has been my experience both on windows and android.”
“i use vaultwarden on macOS just fine? the UX isn't amazing but it does the job and leaves little clutter.”
“I Use Caddy, AdHome Guard (for dns entries). I've copied the caddy (root.cer) file to family members phone - then they simple visit: https://home.jelly - sometimes we get dns probe error, but turn then wifi on/off helps. for remote acces, we use tailscale - (same url, just tailscale beneath) oh and my underlying System is Proxmox”
“Are you sure you want to keep 2fa in the same place as your password? Doesn’t that defeat the security of it? Aren’t passkeys supposed to be device specific and use a hardware key? What does the password manager do here- sync the device part to multiple devices? Again, doesn’t that defeat the security of it?”
“What are your thoughts on setting up an admin account protected by 2FA where: (a) you'd give the client the email address and password; but (b) keep second authentication method within your control? For second authenticator it could be something like a YubiKey that you'd keep in your desk or somewhere else where it'd be easy enough for someone acting in your absence to get and give to the client.”
“I gave my wife the link to the Heimdall dashboard. I use Caddy and Pi-hole, so easy to remember addresses and automatic HTTPS. I installed Wireguard on her devices so she can access when away from home. In other words: make it as easy and automatic as using a commercial service on the internet.”
“As you said, the most foolproof way is that you have a lawyer for this. But, short of that, you need to have separate credentials for yourself and your business owners, and you need to provide those credentials to the business owner, and ultimately they are responsible for what happens with those credentials, unless they are paying you to manage their credentialed access. More so than even being hit by a bus, there's a good likelihood that one day one of your clients won't want to work w”
“(Originally posted (most of) this in r/webdev because I thought it would be a common situation). I'm looking for a workable solution or recommendations to provide a client's credentials to that client in the event of my untimely demise or absence. (E.g. hit by a bus - falling out and need to hand everything over, etc.) I also don't want to mix MY credentials with theirs. So my primary work isn't webdevelopment, but I do some for clients as part of my general services. Generally t”
“I'm looking for a workable solution or recommendations to provide a client's credentials to that client in the event of my untimely demise or absence. (E.g. hit by a bus - falling out and need to hand everything over, etc.) I also don't want to mix MY credentials with theirs. So my primary work isn't webdev, but I do some for clients as part of my general services. Generally this means me building everything from scratch and leaving the client(s) out of the day-to-day management”
Please allow us to register a 2FA onto a user for extra security.
“You have seen Pangolin (https://github.com/fosrl/pangolin) on here before for our open-source zero-trust network access suite of tools. We are launching a new AI gateway that takes a different approach to auth. Rather than authenticating requests to AI providers with API keys, it authenticates the network connection itself via a desktop app.Each user gets a WireGuard tunnel back to the gateway, established after they log in through their existing identity provider (Okta, Azure, Google, etc) via”
“Request Please add optional password authentication support for configured SSH hosts, for example a password or passwd field in ssh.json / SSH host configuration. Current SSH host configuration is centered around keyPath / SSH agent authentication. That is a good default for production and Internet facing systems, but it is inconvenient for LAN environments with many temporary or embedded devices. Use case I often work with multiple devices on a trusted internal network, such as development serv”
“Easiest path on Vercel: password-protect production (middleware or Vercel Protection) until you are ready, or use a separate staging project on a different domain. That keeps bots and random visitors out while you still get real HTTPS and third-party callbacks. Do not rely on an obscure URL. Crawlers find things. Promote to the public project only after checks pass.”
“Hi, GMX.net (together with WEB.de, GMX.com and mail.com) now supports application specific passwords and will start to require them beginning 2026 09 24. Now the problem is that you need a different password for each service. So one for IMAP/SMTP, one for CalDAV, one for CardDAV and one for WebDAV. The UI doesn't allow for several WebDAV entries with the same username, but different passwords. I had to manually create the entries in .config/goa 1.0/accounts.conf and in libsecret .”
“Something like a bearer token so that user's can only access files that have been assigned to that token”
Self managed openbao as external secrets provider usage
“I just found out that 1Password is donating $300,000 to a project founded by a very controversial person, and I'm looking to move to a different password manager.Has anyone migrated from 1Password recently to another tool/platform? Have you had a good experience with any tools in particular? Any advice, tips? I'm also interested in the corporate-use context; if I can convince my company to switch to an alternative with business controls, I'll surely try.”
“OpenAI, we need to talk about the UX around the Trusted Access hardware-key requirement”
“Found while implementing 2476 (HMAC binding). Not stated by 2476 or 2233, and it changes what both of them mean. The two sides of this hop disagree about the auth scheme The launch app sends an HMAC — app/app/api/oracle keeper/register/route.ts:136 142 : The keeper requires a plaintext shared secret — percolator keeper/src/index.ts:375 : x shared secret is never sent by the launch app — grep rn "x shared secret" app returns nothing outside generated output. The keeper never reads x keeper signat”
“I run Claude Code / Codex / Grok in tmux on a Linux box and SSH in from an iPad. The stack is boring and solved (Tailscale, tmux, a terminal app). The part that kept breaking the vibe was not knowing if the agent was still working or sitting on a permission prompt. I'd attach, scroll, detach, repeat. So I built SSHaven. Native iPhone / iPad SSH client with an agent board on top of those tmux sessions. It labels Claude / Codex / Grok / Aider / OpenCode and shows Running / Needs you / Finished”
“A fresh VPS starts receiving SSH brute-force attempts within minutes of going public. Most of us find out about a breach after the damage - a spike in outbound traffic, a suspended hosting account, a client asking why their site is serving spam. What if you just... knew? The second someone authenticates? Here's a complete, working setup that sends a Telegram message to your phone every time a user successfully logs in over SSH - key or password, interactive or automated. It's about 30 li”
“I'm always up to date with maintaining Caddy. Also, I am far far more confident in exposing Caddy over some random web apps in Docker. Caddy is built with security first in mind and is constantly audited. It's a web server run by millions. I have been running this setup for nearly 5 years, I am pretty confident in it. Security is always about trade offs between security and convenience. You have to figure out for yourself your level of risk tolerance. I am quite comfortable with my curre”
“In the WireGuard mobile client config, you just adjust the `AllowedIPs` line under `[Peer]` to only route your internal subnet (e.g. `192.168.1.0/24` and your WireGuard tunnel range) instead of `0.0.0.0/0`. That enables split tunneling: only traffic destined for your homelab services goes through the tunnel, while all standard mobile internet/streaming stays on your native cellular/Wi-Fi connection without adding latency.”
“Not a VPN, but I use Cloudflare Access + Tunnel and it works really well while still being more convinient than a VPN. They handle authentication and you can set policy rules as complex as you want them to be.”
“You do not need to open ports in order for adguard home to work and you absolutely shouldn’t. I’m not familiar with nas so I don’t know if you can set it up there”
“Rocket.Chat starting to make LDAP and SAML a premium feature: https://github.com/RocketChat/Rocket.Chat/pull/41642”
No reverse proxy required, automate DNS verification. I just did this.
“No I agree, OIDC is very easy to implement and also supporting it does not seem too difficult either.”
“When you start running multiple services and devices, it becomes more than 2 clicks You need to do it on every device… for every service… and hope that any tool that connects to another one has an “ignore SSL verification” box… and then you have to do it for your family’s devices..”
“The architecture, core workflow, and Bitwarden integration (session management, SSH_ASKPASS fallback, and secure ephemeral key handling via traps) were designed and developed by me. I used an AI assistant for pair programming: helping draft and translate the English documentation (README_en.md), refining regex parsing for various URI formats, and polishing shell script edge cases.”
“Expand the replies to this comment to learn how AI was used in this post/project.”
“Problem Every path into QuoteTree data assumes a human with a browser. Authentication is a Supabase cookie session, and lib/supabase/middleware.ts:48 62 redirects any sessionless request to /auth/signin , so a script calling app/api/ receives a 302 to an HTML login page rather than a credential challenge. Authorization compounds this: every RLS policy resolves the caller's organization through auth.uid() ( supabase/migrations/20250208000000 org centric rls.sql:19 24 ), so a caller without a Supa”
“Is your feature request related to a problem? Please describe. Infrastructure monitors currently provide a single Authorization secret field. When configured, Checkmate always sends this value as a Bearer token: Authorization: Bearer <secret This limits infrastructure monitoring to endpoints that accept Bearer authentication. Capture compatible endpoints may be deployed behind reverse proxies, gateways, or other security layers that use authentication methods such as HTTP Basic Authentication or”