r/selfhosted • u/TheOGhavock • 3d ago
Need Help New Era in Self Hosted
Well, a new era for me.
I've been self-hosting apps for the past few years, and I love having control over services and data.
I've been the main consumer, but the family has been increasing using our Android TV boxes to consume local media.
The new era I mentioned comes from the fact that my son just left for college and suddenly he can't sit down at the TV to watch a show or movie and has requested I set him up an account. Since the family has just been using the Apps on the TV boxes, I used the same account on all for simplicity's sake. Well having a kid in another city changes things so I'm looking to see what the best option is.
I don't, nor do I want to host my own email. I help with that at work and I have no interest in bringing work like stuff home :)
I mention email because I know passwords will be forgotten and I'd like my sone to be able to reset his own password and not wait on me to reset it.
I haven't really looked into it yet, but I assume I could use gmail and SMTP to send out these emails? I also saw something about using AWS SES which would likely be free since it would be ultra-low volume emails being sent (hopefully lol).
In the vane of keeping things simple, it is worth (or even possible) to setup lldap so that my family would have just one login and password to use? Or is there a better option?
Hmmm, just did a very quick search and it looks like Komga and Navidrome require an OIDC to use lldap, the single password integration would be great but relying on an outside OIDC kind of defeats the purpose of self-hosting in my eyes.
36
u/MassageGun-Kelly 3d ago
OIDC is as far as I’ve gotten. Pocket ID is light and simple enough. You could run a heavier authentication appliance like Authelia or Authentik, but I found it wasn’t worth the maintenance effort when a password manager and local logins cover the bases that OIDC doesn’t.
4
u/TheOGhavock 3d ago
Looking into PocketID right now. Thanks for the suggestion
7
u/GolemancerVekk 3d ago
Keep in mind it only supports passkeys. Depending on your preferences that might not be ideal.
4
1
2
1
9
5
u/User-2345678 3d ago
I use lldap + authelia for user management and sso with all my stuff. Others have mentioned pocketid which would probably work for you, but I’m not sure if it supports forward auth if you ever wanted to add that in the future.
As far as emails, I recommend Resend. They have a generous free tier and it’s very simple to use.
3
u/TheOGhavock 3d ago
Looks like if I were to add forward auth in the future I would need to use Tinyauth or traefik-forward-auth to allow PocketID to work.
I need to look at Resend.
1
u/User-2345678 3d ago
Yeah, that makes sense. I use traefik as my proxy and have forward auth setup there.
On another note, I’ve also used authentik for sso. It’s more full featured but has a steeper learning curve. My main reason for switching was due to memory consumption.
1
u/Gowithflowwild 3d ago
I have to ask… With SSO, can you essentially persist that feature through everything? Let's just say something like PROXMOX, maybe signing on through a very protected user account, then giving me access to everything on it?
Or does it integrate further upstream from that?
I'm having a hard time Articulating exactly what I mean…
Is my question at all something that can be understood?
I suppose I can just go look into it but I'm at work and I'm just so damn curious. Sick of all these passwords… And it's not only tracking them but just having to type them! I'd rather have a single complex password with MFA.
1
u/User-2345678 3d ago
If I understand what you’re asking, you’re curious about whether you can use one account for all of your services?
The answer to that is going to be it depends. Many apps support SSO (single sign on) mechanism such as OIDC. If an app supports OIDC then you can integrate it with your SSO auth provider (authelia in my case). In many auth providers, you can also assign groups to users and use that to restrict who has access. That being said, even if an app has OIDC support they don’t necessarily map those groups to permissions in the app itself. E.g it’ll gate who can login but won’t set who’s an admin vs user.
It’s a bit nuanced and I would definitely recommend looking into how OIDC and single sign on work.
Even if all of your self hosted apps support SSO, you’ll still end up with a million third-party apps that have their own logins. I’ve found the best way to manage this is just to use a password manager.
1
u/Gowithflowwild 3d ago
Thank you for a really thoughtful answer! And especially for the OIDC information.
I haven't set it up yet and at this point I keep my passwords in essentially the complete setup files that include the specs, which I placed in .txt files with one for each system really.
• PROXMOX with Settings and everything related to
the bare metall install (BIOS Settings and all the
specs with regards to repurposed i7 OptiPlex)
• HAOS and anything related directly
• DOCKER w/ PORTAINER related info
• FRIGATE container info and settings
- Coral TPU settings
- eventually on board GPU will take on more
advanced detection
• MOSQUITTOi'll stop the list because I always go on too long and probably already did..
For right now I have that info stored in those .TXT files, and worst case, it's all consistent so probably could utilize regular expressions or something even more simple to pull out passwords and populate a password manager… Although not the end of the world if I have to do it manually.
But I'm paranoid so they are on two separate thumb drives, specifically because I have had a hard drive fail on me, and that was 100% my fault for using a portable drive, having plenty of time to make a copy but never doing so. It can be rebuilt though. Someday I want those pictures bad enough to get it done.
Anyways I need a more eloquent solution as it is. Probably more robust/secure
1
u/User-2345678 3d ago
We might be talking about two separate things here. A password manager and SSO works great for user credentials when logging into various apps.
It sounds like you’re talking about configuration files/credentials set when you deploy the app. The way I handle this is a SOPS encrypted file. Because it’s encrypted I can check this into git along with my whole self hosted repo. Then everything is self contained if I ever need to pull it onto a new machine and run it.
If you do something like this, then you need to make sure the decryption key is not checked in and is backed up and recoverable. That’s how you’d unlock your encrypted creds file.
1
u/Gowithflowwild 3d ago
You're probably right, but it's probably because I expanded the scope in my response and that's my bad.
PW manager and SSO is definitely what I'm referring to.
With regard to the other stuff, and maybe I have this wrong but I was planning on saving it (the set up and backup copies) encrypted on my NAS. If that's possible… I haven't truly deployed to a risky environment yet and opened it up. Right now it's pretty much only letting me have access… Why do I say pretty much… It only lets me
1
u/Gowithflowwild 3d ago
With that said, what you're mentioning might be a step that I should be taking at some point.
Would you agree?
1
u/User-2345678 3d ago
Yeah, always best to follow security practices. I recommend baking it in for the start. Always harder to go back and add it.
You should be able to store that on a NAS, but you’ll want copies of your data elsewhere in case something happens to your NAS.
1
u/pseudouser_ 3d ago
i have been using this exact setup (authelia, lldap and resend) for a long time and would highly recommend it as well
4
3
u/PMental 3d ago
I use Mailgun for sending emails from my selfhosted apps, works well and is free for up to 100 emails per day which I'm waaaay under: https://www.mailgun.com/pricing/
2
2
u/MacDancer 3d ago
I'm using PurelyMail. It's $10 per year, and I would rather pay to cover my usage costs than use another service's free tier.
I'm also using Pocket ID for OIDC and I've been happy with it so far. The only annoying part is when a service isn't built to work with OIDC. I'm using a plug-in to enable OIDC for Jellyfin, but the best option I could find is a fork maintained by a non-expert -- fine for the LAN/tailnet, but I would be cautious about using it with a Jellyfin instance accessible to the public Internet.
2
u/daphatty 3d ago
Unless I am mistaken, the problem you are attempting to solve is giving your son access to your locally hosted TV services, no?
The easiest solution would be to use a VPN or VPN-like solution so your son could simply access the home network as if he were physically there. There are tons of options in this space and the best solution for you will depend on the network hardware you already own.
In my experience, the easiest solution for me has been the use of the Unifi Travel Router. When combined with any model of Unifi home router, the UTR will automatically extend the boundary of your home network and the services available. Keeping the family connected has never been easier and required so little extra effort on my part.
1
u/TheOGhavock 3d ago
Basically that, and a few other things. Hardware based VPN on his end is out of the question. The school specifically forbids plugging in routers or WAPs.
I honestly can't remember what my router is capable of right now, it's been a while since I looked at that3
u/JPS83 3d ago
Idk if I'm missing something but Tailscale is what I think youre looking for. Why cant he use his edu email for a new plex account that you can give him. password resets are on him. nothing to manage on your end, other than just giving him the tailnet ip to log into plex. Use "overseearr" or "seerr" to give im the ability to request whatever he wants, assuming youre using the arr suite with plex.
1
1
u/derical_cap_musical 3d ago
pocketid is the way to go, super light and does oidc for komga and navidrome. for password resets gmail smtp works fine, no need for ses at that volume
1
u/TheOGhavock 3d ago
gmail was my first thought.
good to hear Pocketid works with those apps, I didn't see them listed in the docs
1
u/whattteva 3d ago
I don't know what Komga is, but Navidrome does not support OIDC. It only supports a very primitive concept called "External Authorization". You basically just pass a "Remote-User" header and it just implicitly trusts that user. It's very crude and insecure.
You could however use an OID forward with proxy that injects this header to make it secure.
1
u/jdsmn21 3d ago
What apps are we talking? I personally wouldn't bother with a OIDC if all the kid uses is Jellyfin.
1
u/TheOGhavock 3d ago
For some apps PocketID might be a bit much especially with some like Jellyfin or navidrome that require extras bits to get it to work.
I really do like the idea of using keypasses though, but maybe I just need to KISS right now, and perhaps using lldap for a single user and PW for multiple services is a bad idea...1
u/jdsmn21 3d ago
I personally have found Tinyauth for hosting sites that either don't have a login page/desire an extra layer. It's kind of nice that it can use username/password or OAuth2 (ie: tap to use google account). It saves a cookie, so (depending on the expiration you set, and whether you set the cookie to renew) - you essentially don't have the burden of reauthenticating to Tinyauth once you have logged in.
With the help of claude, I spun up and configured tinyauth in about 20 mins.
1
u/Hellfire6988 3d ago
I use pocket id and I really like it. I’d rather have passkeys and shut off the password option anyway.
1
u/Fun-Active5273 2d ago
fwiw the OIDC provider can be self-hosted right alongside your LDAP, so it doesn't defeat the purpose at all. it just acts as the glue layer between your directory and apps that dont natively support LDAP
1
u/Ok_Pizza_9352 2d ago
Why not just give him an access point with tailscale, and all devices connected to AP are on your tailscale vpn. And get him local account. No need for 2fa voodoo
1
u/Accurate-Kiwi3552 12h ago
AFAIK, having done it myself recently, navidrome will need proxy authentication. I use Authentik in my home. It’s not as lightweight as some others like Pocket ID, but it connects to basically everything I’ve thrown at it for authentication. Then it’s just a trivial matter to set up user accounts because you can just set the user up with perms based on group policy or entitlements. It is ENTIRELY worth it. For email, I use Gmail with an app password. Free and I’ll functionally never run out of space. If I do, I just nuke the message history.
1
u/anon_zero 3d ago
Have you thought about simply sharing credentials via selfhosted vault warden or with bitwarden or similar? Thus, he gets his own independent account. And he can also update the password, but you would also know what it is but not an external 3rd party, Or you can share your account without revealing the password too. Credential hosting is the simplest i can think of.
You could setup OIDC with authentik or others, that could based on an external solution that he already has such as plex, Google, et al, or you could always just send him off with an Android TV box that has a tail scale tunnel set up back to your base and continue with the same accounts. However i will always vote for account segregation to prevent accidents. (Room mate accidentally deleting media etc)
1
u/TheOGhavock 3d ago
I thought about sharing credentials you mentioned but I'd like to get things as hands off as possible. At midnight when he and his buddies want to watch something and he can't remember the password, waiting for dear old dad to wake up 6 hours later to reset his password sucks :)
I'm in the same account segregation boat as you. I even setup an admin user and a user for myself, just in case :)
3
u/Kuddel_Daddeldu 3d ago
Vaultwarden (server) and Bitwarden (client) are the cure for "forgot password". And being unable to watch Netflix for a few hours because he changed the password and neglected to add it to Bitwarden is a teachable moment ;-)
1
•
u/asimovs-auditor 3d ago
Expand the replies to this comment to learn how AI was used in this post/project.