Ask HN: How to secure personal web apps? | Hacker News Reader

Ask HN: How to secure personal web apps?

5 pointsschemescape11 comments

Let’s say I have a web app that runs in the browser and can be served over HTTP from a VPS.

What’s the easiest way to secure that app so that only I can access it from my computer and phone, even when away from home?

This sounds like a use case for a VPN, but how does that work in practice, with minimal hassle? Would WireGuard work in the case I want to access the web app over the internet, with my phone’s browser (without any extensions, ideally)? Are phone VPNs smart enough to only send traffic through the VPN for certain domains?

I’m sure there’s a guide written about this topic somewhere, but I’ve spent quite a bit of time searching and everything I’ve found either doesn’t mention phones, doesn’t mention web apps, or assumes you want all your traffic routes through the VPN (or is incomprehensible SEO nonsense).

Edit: I didn’t discuss serving the site over HTTPS and having an actual login flow because that seems like it would be annoying to setup, but feel free to convince me I’m wrong!

Setting up A VPN is more complicated than a single webapp necessitates. I'd recommend using Cloudflare, with Cloudflare Access, and expose your VPS via a Cloudflare Tunnel. (You can use all of this for free.)

If you really want to go down the VPN route, you can use something like Tailscale (which uses Wireguard under the surface).

> Setting up A VPN is more complicated than a single webapp necessitates. I'd recommend using Cloudflare, with Cloudflare Access, and expose your VPS via a Cloudflare Tunnel. (You can use all of this for free.)

I would argue that setting up Tailscale is much less complicated than Cloudflare Access and Cloudflare Tunnel.

Last I checked, I think I had to opt into Cloudflare’s infrastructure to use any of their features. I think it was just changing my domain’s name servers, but I don’t recall.

Not opposed to doing that, but if I don’t have to, all the better!

Thanks for all the replies!

After playing around with this, it is as I feared with respect to VPNs--it seems like you have to tweak a lot of obscure settings (and possibly run your own DNS server) to get the VPN to only be used for, say, a single domain. I'm surprised I haven't found a simple self-hosted solution to this yet. Edit: actually, this discussion on Reddit looks like what I'm looking for: https://www.reddit.com/r/WireGuard/comments/lqcmqn/use_wireg...

Tailscale looks promising, although I'm trying to see if I can get things working without signing up for an account there yet.

Cloudflare also requires an account and changing DNS settings (something I'm not sure I want to do yet).

Edit: I'm not opposed to having accounts and using free services--I'd just prefer not to, if I can easily avoid it. I assume all "free" services are actually "free until the company gets acquired" :)

I run an application on my home computer that is no accessible through the router but I have Tailscale on both my tablet and my home computer so i can access my application on it. It took about 10 minutes to set up.

Tailscale sounds a lot like what I’m looking for, thanks!

Interesting. Tailscale requires me to sign up with a Google, Microsoft, GitHub, or Apple account. No email option.

I think a WAF is cleaner than a VPN, although all the ones I know of are enterprisey and total overkill.

Note: I should have added “free” to my wish list.

Edit: and open source, if possible.

A long url can help.

For what I have in mind at the moment, that probably would be fine, but I’d like an option with at least some actual security, just in case :)

Reply on news.ycombinator.com