Yes, hosting the site seems much safer (at least in theory) since I am proxying it through cloudflare and I am planning on putting ngynx too on top of that this afternoon
(And signup is disabled, so hopefully only trusted users can access it)
I'd rather not say which router I have since it would reveal quite a bit of information about me. However, I do know that the connections that my router allows are tcp and udp
I see, only allowing established traffic to connect sounds like something that could work. But I don't know how I can do this, do you have some pointers :)?
Blocking outgoing traffic and having to whitelist forgejo seems a bit extreme though
The reason why I am asking this question is because I think that the ssh port I am opening only has access to my repos (which means that even if I somehow get hacked the damage is minimal) and it doesn't accept any keys aside from mine and my friend's, which we set up through the web interface :).
I have wireguard setup and I'd also thought about sharing a tunnel with my friend, but it seemed much more hasslesome than simply opening the port, not to mention the fact that if anyone wanted to join too I'd have to do that again.
It is exactly because I am afraid of getting fucked that I am asking this and being careful. For now, my idea is to only open the port when someone is about to use it, since I am not absolutely sure that it won't somehow accept a request from a person with less than noble intentions. (either that, either simply use tokens)
Reverse proxying was also my intention at first, but I just couldn't get it to work with cloudflare for some reason!