CalDAV Server Without Exposing Server?
from ClownsInSpace2@lemm.ee to selfhosted@lemmy.world on 06 Mar 17:38
https://lemm.ee/post/57469086

I self-host a couple of services, but I haven’t exposed anything outside my home network. I want to self-host my calendar, but not sure if I can do it without exposing it. Any recommendations on the best way to go about this? For those who do self-host a calendar service, how do you keep it secure?

#selfhosted

threaded - newest

wildbus8979@sh.itjust.works on 06 Mar 17:46 next collapse

Who do you want to have access to said calendar?

ClownsInSpace2@lemm.ee on 06 Mar 17:51 collapse

Just myself, but I would like to keep it synced between my phone and my laptop while also keeping a backup.

wildbus8979@sh.itjust.works on 06 Mar 19:17 collapse

Then you should really look into setting up a personal VPN. After that what you use to do calendar becomes irrelevant in terms of access.

Selfhoster1728@infosec.pub on 06 Mar 18:05 next collapse

mTLS with a reverse proxy!

ClownsInSpace2@lemm.ee on 06 Mar 18:09 next collapse

This is the first time I’ve heard of mTLS. Sounds interesting, any tutorial recs?

Selfhoster1728@infosec.pub on 06 Mar 23:44 collapse

Not any in particular but mTLS is essentially just a reverse proxy (like nginx) asking a client for a certificate to be able to access the service behind it.

There are quite a few guides out there, so choose one for your reverse proxy of choice!

suzune@ani.social on 07 Mar 06:20 collapse

So it’s the good old client certificate authentication?

Selfhoster1728@infosec.pub on 07 Mar 09:04 collapse

yep

In my opinion it’s the best solution because there’s a really low attack surface plus it makes it easy to control which device has access to which services.

cmg@infosec.pub on 06 Mar 19:02 collapse

What caldav clients supports that?

I’d recommend the Tailscale style approach. MTLS is a pain imo without infrastructure and especially on the app layers

Selfhoster1728@infosec.pub on 06 Mar 23:40 collapse

Tailscale is simpler but when you’re accessing from devices behind VPNs like I do mTLS is a lifesaver.

I use DAVx⁵ for caldav (supports mTLS)

I find mTLS cool too :P

In terms of being a pain it’s not that bad with nginx in my opinion. I can just build my own certificate for each service I expose or you use a common one, giving read only access to the key for my nginx containers and in two lines in the .conf it’s sorted.

tapdattl@lemmy.world on 06 Mar 18:08 next collapse

I think the general consensus for homelabbers is a mesh network – Tailscale and Netbird are the two most popular options

0x0@programming.dev on 06 Mar 18:40 collapse

Or headscale.

enemenemu@lemm.ee on 06 Mar 18:20 next collapse

I run nextcloud on my machine. If there’s a crack, there would be one in their hosted instance as well. There’s nothing really I can do about security of it.

higgsboson@dubvee.org on 06 Mar 18:44 collapse

I do not expose Nextcloud to the internet. I use dnsmasq to give LAN clients the private IP. If I need to access NC from elsewhere, there’s VPN for that.

enemenemu@lemm.ee on 06 Mar 18:46 collapse

Sounds like a good solution as well

tenebrisnox@feddit.uk on 06 Mar 19:13 next collapse

Could you set up a Cloudflare tunnel and make sure the security rules are tight enough to keep others out?

reboot6675@sopuli.xyz on 06 Mar 19:17 next collapse

Related question, what CalDAV server are you using? Been looking for something lightweight

hendrik@palaver.p3x.de on 07 Mar 07:05 collapse

I think Baikal or Radicale would be the usual contenders for that

ChillPill@lemmy.world on 06 Mar 20:08 next collapse

VPN is the way to go if you’re not sharing it with a bunch of people

tekeous@usenet.lol on 06 Mar 20:43 next collapse

Radicale is the GOAT and supports authentication. Or you can just run it on a LAN behind a firewall.

Nomad@infosec.pub on 07 Mar 07:44 next collapse

If you want sync to your phone, just set up a VPN. Now your phone and mobile computer can always access your services. I use SoGO, it has calendar hosting, authenticated sync which you can use with davx on android and the web interface is basic but usable. You can also enable mail, tasks and contact sync all in one.

oldfart@lemm.ee on 07 Mar 09:00 next collapse

Unless you live a very dynamic lifestyle that requires your calendar to be 24/7 synced, you can just use whatever server software you like, make it listen in LAN only, and have your devices sync when they’re at home.

DecSyncCC and Syncthing is another option.

dingdongitsabear@lemmy.ml on 07 Mar 15:19 next collapse

unless you really need it, set up sync to work only on your home network. you enter a new event when away and it stays on your device.

once you get home, it then syncs with radicale/syncthing/nextcloud/whatevers.

BackYardIncendiary@lemmy.sdf.org on 18 Mar 03:00 collapse

Late response. I used to host radicale, but switched to MyPhoneExplorer a few years ago. I just sync from the laptop to the phone over bluetooth. It does contacts and memos as well. Reminds me of the old Palm Desktop sync.