Yeah, will not work for everything. Things with actual phone/TV apps generally dont like it. That being said, it still helps for a large swath of my setup

I’ve had good success spinning up an authentik instance, and having my reverse proxy hit it first before it routes to the actual app. Puts another security layer in front in case sonarr itself has an issue, for ex.

Caddy snippet

handle {$host} {
		route {
			# always forward outpost path to actual outpost
			reverse_proxy /outpost.goauthentik.io/* authentik-server-1:9000

			# forward authentication to outpost
			forward_auth authentik-server-1:9000 {
				uri /outpost.goauthentik.io/auth/caddy

				# capitalization of the headers is important, otherwise they will be empty
				copy_headers X-Authentik-Username X-Authentik-Groups X-Authentik-Entitlements X-Authentik-Email X-Authentik-Name X-Authentik-Uid X-Authentik-Jwt X-Authentik-Meta-Jwks X-Authentik-Meta-Outpost X-Authentik-Meta-Provider X-Authentik-Meta-App X-Authentik-Meta-Version
			}
			
			reverse_proxy {this_host_or_ip}:{this_port}
		}
}

Not gonna solve all your problems. Works for 70% of apps. Nice to slap on when you can.

Niri is crazy good. I get itchy without it now

I use pangolin as the front, which checks in with Authentik as the SSO before it lets anyone through to the actual apps. Pangolin itself acts a bit like my reverse proxy so my caddy takes a back seat and isnt used for too much. Pangolin comes with crowdsec as well.

Yup, its a good game as well. It’s a bit too zippy fast paced for my tastes. Everyone jumping and ziplining everywhere ruins a lot of the cool positional tactics that can manifest in games that keep the movement abilities modest. By the time someone calls out a position its already moot information. But finals makes up for it in other ways like the destruction, etc. Definitely a good game

The hook for me is the lack of respawn numbness. Something about insta respawn shooters just turns my brain off and lulls me into boring mental stagnation as I throw myself on the gears. It’s the high longer term stakes that are the interesting part. Failing in the heat of the short moment, and thinking back on what you mightve done better. But you’ll never experience that exact situation again, so you just try to carry your lessons forward. It’s a different pacing that keeps things novel and memorable

To each their own, but i enjoyed every second of my several years playing PUBG. It’s the same hook as Ironman style high paranoia solo games like Project Zomboid or many others. High stakes, ambient stress, and extremely quick and sudden failures that hone your instinct for next time. I enjoy single player games and many other genres as well for different reasons/goals. I dont think the royale/extraction genres are just fundamentally faulted like you suggest

Sounds great in theory, but I always feel bad transforming my data too much so I can no longer seed, hah. Maybe someday

Posted in a similar thread

My baseline is a public VPS with Pangolin/Crowdsec installed. I have authentik as a login system. Pangolin let’s me put authentik in front of any service so they have to log into it before it gets to the service in question whatsoever. This is different than the app itself just using Authentik as the OIDC provider. Helps give a bit of peace of mind with the services which themselves might not be security focused. Also, these pangolin routes are able to block anything outside my country by rules, so that trims a good portion of attacks as well.

Some things don’t like that authentik layer in front though. Audiobookshelf’s phone app for example cant handle it. For that, I route those domains through cloudflare tunnels. Their tunnels do a good job blocking lots of attacks, so not having authentik in front is more acceptable.

But then there’s jellyfin that doesnt want to be on cloudflare tunnels and doesnt want authentik in front. For that, I just have it on my pangolin side with only crowdsec helping. Not ideal, but best I can do without making my grandma install a VPN on a raspberry pi in so her TV can connect or some shit.

And lastly, I have some private services like forgejo that don’t like authentik in front and only I myself care about. I tailscale to those rather than exposing sometimes.

What youre talking about is having an app refer to authentik to find out who a user is.

Internet -> audiobookshelf -> asks authentik who it is

In addition to that, you can set pangolin up so that it doesnt even hit that app in the first place at all unless the user is already signed into authentik.

Internet -> pangolin makes user log into authentik before forwarding along -> audiobookshelf -> asks authentik who it is

So if the app in question has a security vulnerability, its not a problem because no one even gets to the app at all to begin to try to exploit it unless they’ve logged into authentik first.

My baseline is a public VPS with Pangolin/Crowdsec installed. I have authentik as a login system. Pangolin let’s me put authentik in front of any service so they have to log in hit before the service in question. Helps give a bit of peace of mind with the services which themselves might not be security focused. Also, these pangolin routes are able to block anything outside my country by rules, so that trims a good portion of attacks as well.

Some things don’t like that authentik layer in front though. Audiobookshelf’s phone app for example cant handle it. For that, I route those domains through cloudflare tunnels. Their tunnels do a good job blocking lots of attacks, so not having authentik in front is more acceptable.

But then there’s jellyfin that doesnt want to be on cloudflare tunnels and doesnt want authentik in front. For that, I just have it on my pangolin side with only crowdsec helping. Not ideal, but best I can do without making my grandma install a VPN on a raspberry pi in so her TV can connect or some shit.

And lastly, I have some private services like forgejo that don’t like authentik in front and only I myself care about. I tailscale to those rather than exposing sometimes.

Only other thing I think I need to add sometime is some VLAN separations?

Best I’ve done so far is crowdsec + pangolin geoblocking to just my country. I cant install tailscale subnet routers at all my friends to get their TVs to work. Non starter.