2.2 KiB
2.2 KiB
The principle to build around Fail closed. A new service should be protected by default, not by remembering. Right now .lab is open-by-default — that's what made the console bypass matter. Tier 1 — do these first (highest value, least work)
- Move admin UIs to Tailscale, keep .lab for public sites only. You already have Tailscale on .13 , .27 , .51 and the phone. Admin dashboards (console, Portainer, Gitea, Paperclip) don't need the public internet — you get remote access anyway, with no exposure. Zero new software. This alone removes most of your attack surface.
- Put one auth layer in front of the whole wildcard. Caddy forward-auth → Authelia (or Authentik). Every *.lab host goes through one policy: SSO, 2FA, default-deny, with an explicit allowlist for genuinely public sites. Then "I forgot to add auth" can't happen.
- Add CrowdSec. It tails your Caddy and sshd logs, detects scans like the one you just saw, and auto-bans via a Caddy bouncer. You already accept scanning — this turns it from noise into blocked traffic, and gives you a dashboard of who's probing. Tier 2 — stop the two failure modes you've already hit
- gitleaks + trufflehog. You had a key leak on Gitea. gitleaks as a pre-commit hook stops new leaks; trufflehog scans existing repos and history for what's already there. Cheapest possible fix for a problem that already cost you once.
- semgrep. SAST for your own code — exactly the class of bug found today. It runs in seconds, has auth/security rulesets, and fits a pre-commit or CI step.
- trivy. Scans your container images and filesystems for known CVEs. With ~50 containers you're running a lot of images you never inspect. Tier 3 — worth doing, not urgent
- nuclei — run your own scans against .lab so you find the issues before the bots do. Also tells you what's actually exposed.
- A correct-by-default auth helper + one test. For your FastAPI apps: a shared dependency that verifies the password, and a test that asserts valid username + wrong password → 401. That exact test would have caught today's bug on the first run. What you already have • npq, sfw, vet — npm supply-chain (on .13 ). • Tailscale — underused; see Tier 1 item 1. • Caddy — the natural place for forward-auth and the CrowdSec bouncer.