Securing Shinobi Server with Cloudflare and Considering Removal of HTTP Basic Ac

Hello everyone,

I need your help with a security question regarding my setup. I have a diverse network infrastructure that includes a Shinobi server, a media server, a general website, an audiobook server, and a CCTV camera interface.

So far, I've only set up my Shinobi server for local network access and connected through a VPN. This setup was primarily to avoid easy indexing by search engines and maintain a basic level of security. I've implemented HTTP Basic Access Authentication, which, while effective, comes with its drawbacks. Specifically, it prevents the use of the Shinobi app, as the app can't bypass this layer of authentication to connect to the server.

In an attempt to improve accessibility and security, I've established a reverse proxy (nginx) in my network, linking a subdomain to my Shinobi server. However, due to this new setup, I had to make some changes to my domain's Cloudflare settings.

Currently, I'm using the free version of Cloudflare, which provides a basic level of protection. I had to disable Cloudflare's proxying feature (the feature that hides the original IP) for my main domain to ensure that my game servers remain accessible through it. This decision was necessary but has left me contemplating the security implications, especially for my Shinobi server.

Given this situation, I'm considering removing the HTTP Basic Access Authentication to allow for the Shinobi app's seamless use. I've preemptively switched my DNS provider from my domain host to Cloudflare for better control and security. I've activated Cloudflare proxying for the subdomain linked to my Shinobi server, hoping it would provide sufficient protection against brute force attacks and other common threats.

My main concern now revolves around the overall security of my network, especially with the diverse range of services I'm running. How secure would my Shinobi server be without the HTTP Basic Access Authentication, relying solely on Cloudflare's protection? Also, are there any additional measures I should consider for my other services like the media server, audiobook server, and CCTV interface, given my current Cloudflare setup?

I'd greatly appreciate any insights, tips, or experiences you can share, especially from those who have navigated similar challenges.

Thanks in advance for your help!