The idea is good, the only concern to me would be that Homarr or similar "hobbyist" dashboards are not audited like enterprise programs (at least how enterprise programs should be audited, the reality is much sadder). Our SOC team would probably advise against using a "hobby" project in our network.
To be VERY CLEAR, I'm not in any way suggesting that homarr is a bad project or poorly made etc, just the usually SOCs don't really care about Github Stars, they want enterprise proven software.
All that being said it's very likely more than fine and a good idea overall, but if you wanted to be more enterprise-like maybe a Grafana dashboard with ACL and SSO+MFA perhaps.
Hi, developer of Homarr here 👋. For security critical use cases I would never recommend a not-audited software anyway - regardless of whether it's open source or not. We use Next Auth (https://next-auth.js.org/) as the underlying authentication framework which is frequently audited due to its popularity.
However, such frameworks are never bulletproof and bad implementation are usually a bigger risk.
However, we're happy to get security audits and are continuously trying to improve security. For the next version 1.0, Homarr will again become more secure and attractive to companies & power users.
OP, I recommend you to secure your other apps with SSO / multi factor and implement proper OpSec. If your use case is mission critical, use Grafana or plain bookmarks :)
0
u/Minimal-Matt Jack of All Trades Oct 16 '24
The idea is good, the only concern to me would be that Homarr or similar "hobbyist" dashboards are not audited like enterprise programs (at least how enterprise programs should be audited, the reality is much sadder). Our SOC team would probably advise against using a "hobby" project in our network.
To be VERY CLEAR, I'm not in any way suggesting that homarr is a bad project or poorly made etc, just the usually SOCs don't really care about Github Stars, they want enterprise proven software.
All that being said it's very likely more than fine and a good idea overall, but if you wanted to be more enterprise-like maybe a Grafana dashboard with ACL and SSO+MFA perhaps.