Zero Trust Hosting and Reverse Proxy via Cloudflare, Swag and Authelia | Hacker News Reader

Zero Trust Hosting and Reverse Proxy via Cloudflare, Swag and Authelia

linuxserver.io

52 pointsvmoore10 comments

While i‘m an absolut cloudflare fanboy, one wording sounds wired to me:

„Zero Trust Cloudflare Tunnel“

… at least you have to trust cloudflare, fully!

And, in turn, while I loathe Cloudflare, I would say that's perfectly reasonable; "Zero Trust" means that you distrust the network and possibly the clients, but you generally still have to trust, at the very minimum, something to provide identity verification, and usually some sort of network proxy in front of the actual application. So long as every connection is securely encrypted in flight, I'm pretty sure it still counts as Zero Trust.

"Zero Trust" is about as good a name as "Serverless". Yeah, it kind of makes sense if you understand it already, but at first look it's pretty dumb.

Zero trust is a whooly term which means different things to different people, it's more of a strategya and principles than a technology. Ultimately you will have to trust something and we want to make that as small trust relationship as possible. For me, the best way is to use open source and only have trust of central key infra (the control plane/PKI) while ensuring all connections and anything that wants to attach goes through its own process of bootstrapping trust. No connections should be made to the controller or on the data plane unless endpoints have bootstrapped trust.

I work for a company that has created exactly this and we open sourced the core tech. It allows anyone to put programmable, pirvate (outbound only) connectivity based on zt principles into any app (sdk), host (tunnler) or network (edge router). It can support any use case across access, multi-cloud, IoT, and more.

Check it out - https://openziti.github.io/

Cloudfare's gonna check out all your girlfriends for you Cloudfare won't let anyone dirty get through Cloudfare's gonna wait up until you get in Cloudfare will always find out where you've been

Oh hey, this article uses https://github.com/linuxserver/docker-mods/tree/universal-cl....

Pretty neato to see code I wrote pop up on HN.

The linuxsever.io community is great - but this is a good example of how intensely technical setting up a "home lab" is.

If you're interested in this set of features (home hosting with "zero-trust" reverse proxying, dynamic DNS, authentication for self-hosted apps, etc), you might be interested in what we're building over at https://kubesail.com - one day we might even be profitable and item #1 on that day will be a nice donation back to the linuxserver.io community <3

interesting. Whats the tech behind this? k8s?

Yep! We started as a way to learn Kubernetes, but as almost all of our users were building home-hosting setups, we pivoted into home-hosting hardware and software :)

"Zero Trust"

...

Proceeds to use docker images no user will verify.

Reply on news.ycombinator.com