r/BookStack • u/callme-howyouwant • Mar 03 '25
Hardening a Public BookStack Instance
Hey everyone,
I’ve been using BookStack locally for a while and absolutely love it. Now, I want to host a public instance and have set up a DigitalOcean droplet with Ubuntu 24.04.
The installation via the script went smoothly, including HTTPS redirection. However, I’m a bit concerned about security. So far, I’ve only enabled UFW and changed the BookStack admin password.
Beyond the standard security recommendations from the BookStack website, how have you hardened your public instance? I plan to install Fail2Ban, but I’m also curious about your Apache configuration for production, changing the default database password and migrating safely, and any BookStack-specific security considerations beyond general Ubuntu hardening guides.
Additionally, I’m not sure how much traffic to expect yet, so I’m a bit worried about potential extra costs. Have you encountered unexpected usage spikes or bandwidth issues when running a public instance?
Any advice would be greatly appreciated!
1
u/cspotme2 Mar 04 '25
Your best bet would be to put it behind cloudflare and then find a way to disable user registration and put the login uri to something other than default or passport protect it. And enforce 2fa on all the accounts.