Should I use DMZ for a public NextCloud server hosted on a home network?

Question

I would like to set up a small NextCloud installation on a Raspberry Pi 1 Model B+, or something like that, on my home network.
I would like it to be accessible from the outside with a DNS of some sort. The idea is to create my private Dropbox.

Now regarding security... should I place the NextCloud server in DMZ and forbid everything except port 80 for nginx or Apache to serve the required HTML, or is there a better, more secure way to achieve my goal?

Answer 1

I'd be remiss to put anything behind a home router in a dmz. Maybe a pi and/or nextcloud aren't particularly susceptible to exploits, but if they are, that device potentially has access to the rest of your network.

If you have another router sitting around, I'd do something like this:

Internet---Router1---Router2====rest of your network
              |DMZ
              +---Raspberry Pi

This way, at least the Pi has no access to your other devices, and your other devices have access to the Pi.

As far as DNS, is concerned, there are many options, such as dyndns.net.

This seems to be a good tutorial for what you have in mind: https://pimylifeup.com/raspberry-pi-nextcloud-server/

Another option would be to have one of your computers run NextCloud, accessible to you via vpn, and have one of the folders within this structure sync with dropbox or another cloud storage provider.

You would have access to all the folders while connected to your vpn (as well as all your devices, depending on how you set up), and if you want to share something with the world, you can provide others with a link to your dropbox.

Alex