quaff

Yep! Definitely don’t add any of your internally used domains used on public DNS services. Be careful requesting SSL certs for the child subdomains too. They will show up on transparency logs like on shodan.io. Use internal DNS, and wild card certs for these things. And obviously, do not expose your ports publically.

Always use HTTPS. Especially if you’re using your services on mobile.

Imagine you’re on your friend’s WiFi, and you disconnect from your net bird/tailscale/wireguard connection to your self hosted network… Any and all mobile apps that require that secure connection, is going to attempt requests to your internal services and sending auth/session token details along the requests.

A bad actor on your friend’s WiFi network, could, in theory, capture these requests and now you’re at the mercy of how well those services are written.

This all may sound a bit paranoid, but it is what we are trying to mitigate here.

I have been selfhosting miniflux, and using Capy Reader on Android. Been using this for almost two years now. It’s been great.

Mostly use it for news and blogs. But I follow some lemmy community and mastodon feeds with this as well. Anything with an RSS feed can be followed.