Self-Hosted Apps Are Hard to Secure Without SaaS Help
167 posts across 21 communities in the last 30 days; 28% from r/selfhosted.
“The TCP trick is clever, holding the login open by replaying the client's own keepalive responses back to it. Way cleaner than hoping people just wait around. I've messed with mc-router before and that reload issue is a pain, switching routes one at a time through the API fixes…”
“without credentials they cant do much assuming your auth is solid and patched. but youre essentially putting all your eggs in one basket, if HA has a vuln you've handed over LAN access through that embedded browser. id at least make sure the services behind it still require…”
“Today you are add it to bitwarden, tomorrow they will force you to use only company software lol.This is the problem with passkeys....”
Users are grappling with the complexities and anxieties of securing self-hosted applications and data. This involves managing authentication, encryption, backups, and dealing with evolving security requirements, often leading to frustration and a desire for simpler, more reliable solutions. The need for robust, self-managed security is paramount.
SOURCES (60)
“I was recently hunting for a solution to replace icloud drive and came across Filestash. What I found is that sso and s3-backend is locked behind a very costly paywall. For anyone on the hunt, I would not recommend this project. [re: Setting up my…”
“What problem are you trying to solve? I'd like my friends and family members to be able to use Patzer without having to manage a new account/password when they already have SSO to other apps/services through my homelab IdP How might Patzer help? It would be great if Patzer had native OIDC support in addition to standard username/password, allowing users who already have a single identity stack to reuse it. I already grant my friends and family access to other services I host via SSO, which I kno”
“Problem statement The Psono provider (added in 1.0.54) can only read secrets that expose scalar fields (e.g. application password username / password ). Psono's native Environment Variables secret type ( type: "env vars" ), which stores many key / value pairs in one secret, is not supported — neither by bulk pull nor by inline references. This is the Psono entry type designed for exactly this use case (one secret = the whole .env of a stack), and Psono's own CI client supports it natively ( pson”
“Onboarding a node means pveum user token add on the node, copying the printed secret, and pasting it somewhere: shell history, scrollback, clipboard, or an AI agent's context. With six nodes this is the riskiest step of the setup and the one most likely to leak. Proposal: proxxx token bootstrap profile X ssh root@host [ role PVEAuditor] creates the token over SSH (or with a ticket from a one time password prompt), writes the secret straight to the configured store (0600 file or keychain), applie”
“External accounts are synced by Aster's server: it stores the IMAP password or OAuth token and receives each message readable before encrypting it. For a zero access service that's the one place where third party mail and credentials pass through Aster in the clear. Request: an optional "fetch on this device" mode where the desktop app (or Aster Bridge) connects to the external account, downloads new mail, and uploads it already encrypted, the same way the Bridge's IMAP APPEND import works today”
“The TCP trick is clever, holding the login open by replaying the client's own keepalive responses back to it. Way cleaner than hoping people just wait around. I've messed with mc-router before and that reload issue is a pain, switching routes one at a time through the API fixes it nicely. [re: Minecraft servers that sleep when empty and wake when someone joins. Holding a TCP login open for 45 seconds without the client giving up]”
“Hi everyone, i have setup my homelab with a reverse proxy and i would like to know what yall are using as an identity provider for authentication and why, especially when it comes to mobile apps like jellyfins mobile client? submitted by /u/-Arsna- [link] [comments]”
“That's absolutely the thing. I don't personally care about SCIM, custom log sinks, enterprise SSO, user impersonation, or any of these things. I do care about being able to point a standard library at it and have it work without needing all sorts of custom hacks. And that seems to be something that's sorely lacking in the market today... [re: How much would you pay for an IdP that doesn't suck?]”
“I used to know all the standard answers, but with the uptick in AI-driven hacking and vulnerability finding, my honest answer is... Just don't. Use tailscale or local VPNs as required. If you absolutely must, I'd use VMs on VLANs, with managed network and cloudflare tunnels, so that nothing can touch your home network. Ideally I'd run public-facing stuff on its own bare metal, which would be even better. imho, the critical point is the vlan isolation and managed networking. You need”
“Secrets are in env.local so it never echoes right? I did look at a bit, like a whole folder with individual tokens and secrets for services that have specific chmod that have no reason to be echoed, something like that? Tbh I do need to research it a bit more. But then again I've seen it go and try unit testing and spinning up emulators, I have to be very specific and say do ONLY xyz else it does a lot more unnecessary stuff. You're right about this pink elephant thing haha! [re: deepsee”
“Very self confident, but unjustifiably so, admin decided he wanted to restrict logins in an OU. Deployed his malformed GPO at the root and locked out everyone as they all started syncing well after he had gone home. [re: What's the dumbest outage you've had? I could use the company.]”
“Yeah I thought I could do it all with linux. But yeah seems like I wasted my time. The only sane option is to use windows AD. Does AD do oidc too the same way as keycloak? [re: Need help with authentication design]”
“ad and sssd really is the path of least resistance here. set it up once and you're basically done, adding servers is just joining them to the domain. keycloak is decent for web app sso but trying to make it handle ssh access too is just forcing a square peg. you'd still need something underneath to map identities to local accounts, hence the ldap creeping in. if you're already 2 servers deep and staring down 2 more just to avoid buying a windows license, you might be overthinking the”
“I have created smallstep + keycloak. So i thought I could create keycloak for handling SSO to our users through oidc and that I could use smallstep to generate shortlived certs for users so they can ssh to any server without having to create an user account. I have realised thats not the case with smallstep I need to create an ldap directory but the thing is I have introduced 2 servers already that needs to be maintained and now I need to add an openldap server + ldapaccount manager server + sss”
“No matter how you encrypt the data, transmitting it unavoidably leaks the fact that you're running software that transmits that data. There's no way to mathematically prove this is harmless, because there's no way to know how that information could be used against in the future in ways you didn't predict.No software should ever make network requests without your consent.”
“I got the: The add-on uses secrets which are detected as not secure, see https://www.home-assistant.io/more-info/pwned-passwords for more information. So the latest version of Home Assistant forces me to send my (appar…”
“without credentials they cant do much assuming your auth is solid and patched. but youre essentially putting all your eggs in one basket, if HA has a vuln you've handed over LAN access through that embedded browser. id at least make sure the services behind it still require their own separate auth [re: Is this a bad idea? Home assistant Nabu linked on a personal subdomain, with local network access through home assistant' Firefox integration?]”
“Hey team! Have you ever consider making the SSH Key Information hidden by default and only showing after re confirm using biometrics or password? It act like a secondary security layer to prevent unwanted glance at your phone or laptop screen.”
“not looking for sharing but appreciated thank you. [re: How are you tracking expiring app secrets / SAML certs across tenants?]”
“Username, password and keys are all optional ( routes/provision.js:95 107 ) and the blank username placeholder says "operator". Fix : require a password or key (or warn clearly) and show which default user the image uses. Found by persona code review (end user), 2026 10 16.”
“First time I get this warning. How do I find the account that has this issue? Do I check all my integrations?”
“Hello all I not a tech person and today i received from HA. Pwned passwords and secrets Althogh this message does not lead suggest a path to resolve this or where this happened.. The main issue i have is that organis…”
“I just got two messages saying App Advanced SSH & Web Terminal App Samba share uses secrets/passwords in its configuration which are detected as not secure now I looked into my integrations [/config/integrations/dash…”
“When I rebooted Home Assistant today I noticed it connected to api.pwnedpasswords.com. I understand what pwnedpasswords.com and why some people would want to use that but not everyone does. To be really clear I dont thi…”
“Hi Im using pangolin reverse proxy to access my home network services. None of the auth for Redde available works with Pangolin. I was trying to use Basic Header Auth, but evidently that is not the same thing as custom headers in Hermed Redde. Could you please provide a way to use any of the Pangolin authentication methods. Easies is probably Basic Header Auth, or Pincode/passcode, which just means the sign in with browser has to show the pangolin sign in page before hermes sign in page. This wo”
“There's seemingly no password manager that lets me export the passkey as plaintext, at least not on a Mac. At best I can hand off to another app, which only works from Keychain and nothing else, and can only go to a preset approved list of apps like 1password. iPhone situation is a bit better, at least I can transfer from 1password to other things, but again it seems like a whitelist and there's no way to just get a csv.Besides all that, the standard supposedly supports types of passkeys 1. boun”
“And all apps use SSO so it's this one password [re: Average password reset experience]”
“What happened First off, the demo of balancia looks great and exactly, what I'm looking for. So I wanted to give it a spin and deployed it locally, using the provided compose.yml as the base template. However, when trying to register the first account, I don't have an option to enter a password, only to create a passkey. If I do create the passkey, account registration can continue. When trying to set a password afterwards, I get redirected to the dashboard. The same seems to be true when trying”
“Hi all, I used Nabu-casa for a while but it seemed to get a bit clunky and I started getting a lot of “unauthorised access attempt” logs so although I still support the cause, i stopped using the cloud service. My medi…”
“neat, the tailscale node being built in is something more apps should do. having to juggle two VPN clients just to reach a box gets old fast the secure element key gen is a good call too, private keys on a phone filesystem always felt sketchy as hell [re: I built an Android SSH client for reaching my homelab without opening a port — Tailscale/Headscale, jump hosts, hardware-backed keys]”
“As a broad statement, this is not correct. By default, Kerberos uses user/machine secrets to authenticate and obtain Kerb Tickets. Kerberos standards evolved and added PKINIT where secrets got replaced by certificates as a means to authenticate and obtain Tickets, but this is optional. [re: BlockNtlmv1SSO and 802.1x PEAP WiFi]”
“Today you are add it to bitwarden, tomorrow they will force you to use only company software lol.This is the problem with passkeys....”
“Right, so now you need an additional device on hand (your phone) to parse the QR code into a string. Or I guess you could activate your hot laptop's webcam, pick up your cold laptop, crank the brightness up, point it towards your webcam, and capture the QR like that.Sounds kinda clunky.”
“I use the saved passwords feature to log into my servers. It works perfectly, except for one group of them, all similar. I don't know why, it fails and it asks for password in a modal window. I put the password there and it works. Is there a log somewhere that can help to know the reason of that? I don't know the steps that take submarine to use the saved password, maybe it needs some delay or something? If yes, an option to configure it will be great. Using MobaXterm works without problem, so i”
“love to see the secure erase becoming mainline!! i use ShredOS at work and i ended up building my own nwipe and adding it as a filesystem overlay which could be loaded using a GRUB entry, because it was that useful lol. keep up the awesome work! [re: PSA: ShredOS fake malware website]”
“I hadn't thought much about privacy (I'm using GLM-5.3-flash so my thoughts and idea are already exposed to thirdparty). But as attack surface goes it's down to sftp / ssh / tailscale from my phone to laptop. If any of those are fundamentally flawed then 🤷🏻♂️ [re: Rambling into obsidian daily note is the best habit I've built these 2 months]”
“I like this idea but I’m concerned about privacy. I understand using a local model to help with that, but you reference obsidian, the security of which is limited to logging into your desktop. Do you have a more secure approach? [re: Rambling into obsidian daily note is the best habit I've built these 2 months]”
“1.) you don’t have to trust the OS ( BitKey) since it’s never connected to the internet 2.) exception: bug or purposeful back door that does not create enough entropy when creating the private key. Residual risk 3.) wallet of choice: the exposure time there is minimal because you only use it to spend your transaction EDIT: before you come back with “it’s no different “: it is because it removes additional layers and dependencies. But clearly it’s not fool proof. But at this point, there could be”
“I run coding agents on my Mac, a GPU server at school and a server at home. That used to mean SSH into each one, attach tmux, remember the prefix keys and which layer I was in, then guess which agent was still working and which had been waiting on me. Even over Tailscale with my own DERP server, SSH and Mosh still felt laggy. So I built ThinkTerm , a terminal with a built-in multiplexer, on top of WezTerm. Think tmux, but with a real UI and nothing to memorize. All your machines sit in one sideb”
“So I was selfhosting vaultwarden for a while but I kept it on the local network, didn't want to open no ports on my network for security reasons and I tried vpn and IDK why but I found it unreliable maybe I did something wrong with my setup. BUT lately I found myself needing access to it from outside my local network, so I was looking for alternatives and only recently have I learned that bitwarden has a free plan, and a pretty generous one, you get all the features you really need. My quest”
“Disclosure up front: I work on Demon Route, so this is a request to support our own service, not a report of third party demand. Please weigh it on its merits. Is your feature request related to a problem? Please describe. 新功能是否与解决某个问题相关, 请描述 Since 930 landed, ChatGPTBox has a nice provider layer: built in OpenAI compatible entries in src/services/apis/provider registry.mjs (OpenAI, DeepSeek, Moonshot, Mistral, NVIDIA NIM, OpenRouter, AI/ML, ChatGLM, Ollama, xAI…) plus Custom Provider under API”
“> Because passkeys usually sync and backupAnd when they don't? What then?One of the biggest issues with the implementation of passkeys that I've encountered is that I'm not offered the choice of where a passkey will be stored. It's just a fight between my password manager, my browser and my OS which all try to be "first" to intercept the passkey request, and if the "wrong one" gets it there's no way to say "actually no, I didn't want you to handle this passkey request".”
“I have had DNSSEC verification enabled for a couple of months in systemd-resolved. Not that I am particular paranoid or do any nuclear-sensitive stuff on my machine. Don't even own any Bitcoin. But mostly out of technical curiosity.Until yesterday I had only noticed 2 broken sites (or sites affected by buggy systemd-resolved implementation as some voices claim). Some Jira Plugin and Swedish Railways SJ.Yesterday basically the Internet stopped working for me. After a while I remembered good old o”
Thanks, you made a good point. The API key setup was initially just for myself, and I'm planning a premium version where users won't need their own key. nd I see it…
“Honestly, this isn’t paranoia, it’s a well-designed setup. VPN for internal stuff, minimal exposure, reverse proxy with rate limiting, CrowdSec, and SSO in front is exactly what most people here would recommend. Many self-hosters expose way more with way less protection. You’re already in the top tier. [re: CyberSecurity Paranoia]”
“So true.And every critic always attacks this same thing. TOTP isn’t so bad, my password manager can do it. 2FA is fine it’s automatically pulled from my phone.It’s still phishable. The password is still sent. You haven’t solved anything, you just piled more complexity on top to make it harder. People can still use the same password at 12 websites.Passkeys never get transmitted. If you hack into a server and steal my credentials, all you get is a public key. You can’t use it at another website. A”
“I have a simple home setup with a VPS running Caddy (and fail2ban), so that https://appXYZ.domain.com reverse proxies to apps running on my homeservers. I've managed to get by for years with just basic_auth for authentication. fail2ban swats down any brute force attacks. There's just 2 users, me and a friend. Unfortunately I now need to use two webapps that seem to be using Bearer tokens internally for some operations. This replaces the basic_auth in the Authorization header, resulting i”
“Ill ask Claude to make it secure /s [re: Building my own AWS platform. With Claude]”
“May have already been mentioned, but why not use tailscale to SSH into your computer and use vi or nano? [re: Sending notes from work to personal vault?]”
“Если я правильно понял, то это собираемый бинарник sing box для AWG Manager. Если это так, то прошу добавить ключ при следующей сборке with embedded tor, что позволит добавить его в цепочки маршрутизации, подключив через конфиг (добавлять в Web не обязательно, т.к. такое не для всех :) ).”
“Problem statement please add password manager Psono as Secret store Proposed solution Psono is capeable over API to store secrets. Alternatives considered No response Additional context No response”
“Already a solid setup - requiring a client cert at the TLS layer means a scanner hits a dead end rather than a login form. Two things worth verifying that haven't come up yet. First, test the negative path: request the service with curl from a machine that doesn't have the client cert installed. You want a TLS handshake failure - if you get any HTTP response at all, even a 401, then mTLS isn't actually being enforced on that vhost and basic auth is doing all the work. Second, since y”
“Yes and no.The problem with the compromised platform is that it had no MFA. If they had just had something like OAuth via google workspace or something, this most likely could have been avoided. But it seems like they just had completely vanilla email/password auth with zero additional security measures.”
“Problem Config.password is unexported and only LoadConfig sets it. Apps that read settings from a config file, flags, Vault or AWS Secrets Manager, or that use different env var names, can't authenticate unless they write env vars or a temp file first. This is probably the biggest barrier for adopters who don't follow the {PREFIX}SMTP convention. Proposal Add func (c Config) WithPassword(pw string) Config , like the existing WithRootCAs . Document a "configure in code" example in the README. Dep”