quaff

Yep! Definitely don’t add any of your internally used domains used on public DNS services. Be careful requesting SSL certs for the child subdomains too. They will show up on transparency logs like on shodan.io. Use internal DNS, and wild card certs for these things. And obviously, do not expose your ports publically.

Always use HTTPS. Especially if you’re using your services on mobile.

Imagine you’re on your friend’s WiFi, and you disconnect from your net bird/tailscale/wireguard connection to your self hosted network… Any and all mobile apps that require that secure connection, is going to be making calls to your internal services and trying to pass auth/session token details to them.

A bad actor on your friend’s WiFi network, could, in theory, capture these requests and now you’re at the mercy of how well those services are written.

It’s a bit paranoid, but this is what we are trying to mitigate here.

I have been selfhosting miniflux, and using Capy Reader on Android. Been using this for almost two years now. It’s been great.

Mostly use it for news and blogs. But I follow some lemmy community and mastodon feeds with this as well. Anything with an RSS feed can be followed.