Thanks for bringing it up.

Before I dove into that project, I was checking logs on npm and the service I am already exposing. It seems to me, both only get http GET requests which on npm all get a 404 response.
I don’t remember what the service does with those, but I will investigate later. As I didn’t panicked, I guess it wasn’t that bad.

There are basically no brute force attacks on the service yet and the admin account is only allowed to login from internal IPs.

One initial aspect to further harden the exposed systems were the logs in the UDM which show frequent blocked attempts of varying severity.
This may be security theater and I am not able to assess whether the UDM is a “good enough” protection of the most common attacks.

As I see it, at the moment the UDM already blocks most of the (more sophisticated) attacks and leaves only common requests for the services to handle.

Long story short, as I see it, the UDM has the role of ingress server in my setup.

Thank you very much for your input. I will look into the third option.
Thought of it, but did forget it over tinkering the last few days. :)

Hi, could you tell me why? I mean, I think I understand the basics of the risk of brute force attacks. My mitigation for the admin account is, not to allow login outside the local network. Users are allowed from anywhere, as my family uses the library. Also my service (there are others) are routed through NGINX.

Do you have tips for external users using, for example, a VPN only for specific addresses / IPs? At least that was an idea I had, but didn’t got got around to dig for solutions.

Thanks in advance.