1.7 KiB
Notes
9/9/2026
Ok so I started doing some research about hosting Gitea but went down quite the rabbit hole about network security. Before setting up Gitea and all that, I want to make sure I have a secure network that I really understand well. Some notions to check out: [x] port forwarding [] security risks [] VPN (tailscale) [] network-level firewall (opnsense/pfSense/UDM ??) [x] external/internal reverse proxies (cloudflare/traefik/nginx) [] IDS & IPS (Intrusion Detection/Prevention System) [] VLANs [] auth proxy? [] managed switch [] pfSense router [] SSL certs? (certbot) [] SSH
10/9/2026
After some research and to the best of my understanding, a good secure (free) setup for our Docker containers to run would need the following Docker networks:
edgeto host 2 containers :cloudflaredand a reverse proxy (most likely nginx but still needs research).frontend: this network would host the reverse proxy as well and all other frontend components e.g.gitea, portfolio, blog, etc.backend: hosts backend components e.g.gitea-dband the relatedgitea.
The reason I decided to separate cloudflared from the frontend is that it could get compromised. In that case, I don't want all my frontend components to be potentially exposed and the reverse proxy to be bypassed.
The setup involves another component here that may be the only one that will not be hosted locally that is Cloudflare. Since Cloudflare allows some neat features for free like caching, DDoS absorption, WAF in conjunction with the tunnel through cloudflared (0 port forwarding needed), handling all SSL leaving just clean inbound HTTP traffic reducing latency and overhead on our system.