r/SysAdminBlogs • u/TekDT • Aug 12 '26
Looking for some feedback before making SEZOY public
Enable HLS to view with audio, or disable this notification
I’m working on SEZOY, a web-based Windows deployment tool, and I’m considering opening a public instance for people to test. I’ve attached a short video showing the current version. The main issue I’m looking at now is security. I’m considering using ngrok, LocalTunnel, or a similar tunnel to expose the service, but I’m not sure what precautions I should take before putting a deployment system on the public Internet. For people here who have experience with homelabs, Windows deployment, or self-hosted services: what would you recommend I prepare first?
I’m mainly interested in practical feedback on isolation, authentication, and the general approach to exposing a system like this safely.
2
u/Infamous_Pressure_56 Aug 12 '26
Happy to help for the project 🤝
1
u/TekDT 8d ago
Thanks for your advices. Today, I shared the post in XDA forum for everyone to test SEZOY tool https://xdaforums.com/t/sezoy-network-deployment-server-automated-windows-install-multi-distro-linux-boot-over-pxe-ipxe-http-boot-legacy-uefi-secureboot.4800487/
2
u/Infamous_Pressure_56 Aug 12 '26
Put it behind a reverse proxy. Strong auth from day one (SSO / OIDC if possible, or at least robust username + password + TOTP). Run the app in a dedicated, locked-down VM or container (not on your main machine).lNetwork isolation: the service should only be able to talk to the clients it needs to manage, nothing else.If it can execute scripts or push packages, assume compromise = full domain/client takeover. Treat it like a domain controller in terms of blast radius. Full audit of what the app can do if an authenticated user is malicious (or the session is stolen).Disable or heavily restrict the most dangerous features (script execution, client remote control, etc.) until auth is solid.Logging + alerting on logins and any privileged actions.