Disclosure: I'm the developer of OpsHome NOC, an iOS app and service for monitoring homelabs and small self-hosted environments.
Most monitoring tools ask for something uncomfortable: a port-forward, a VPN, or a publicly exposed management interface. For a homelab, that trade-off is usually the wrong one. This post summarizes how OpsHome NOC approaches it, based on our public security whitepaper.
1. Outbound-only by design
The Docker Probe runs inside a network you authorize and initiates outbound HTTPS connections. In normal operation it needs:
- no inbound firewall ports
- no router port forwarding
- no published internal management interface
Your private infrastructure stays behind your network boundary.
2. Least-privilege Probe
Permissions follow the monitoring features you enable, and the requested access is shown before deployment:
- Reaches only targets you authorize
- Host data paths mounted read-only
- No inbound service port published
- No remote shell, Docker Exec, or container-control feature
- No customer credential embedded in the published image
3. Credentials and transport
- Client and Probe traffic uses encrypted HTTPS
- Probe requests are authenticated with replay protection
- Supported server-side credentials are encrypted before storage
- iOS authentication data is protected by Apple Keychain Services
- Full secrets are excluded from application logs
We still recommend dedicated, least-privilege accounts for every integration.
4. What data is (and isn't) kept
Monitoring records (status, events, trends) are limited to the history window of the active plan and removed automatically when it expires. Application secrets and business-file contents are outside the telemetry scope and are not retained as monitoring records. Account deletion triggers an automated deletion process.
5. Don’t take our word for it. Verify it yourself
The whitepaper ties its scan result to an exact image digest, so you can check what you're running. You can also watch the Probe's traffic yourself:
tcpdump -i any host app.opshome.run -nn -A -c 5
Check the digest, published ports, read-only mounts, and outbound connections against the published evidence. The service also publishes SSL Labs A+ and SecurityHeaders.com Grade A results.
Full whitepaper (document OPS-NOC-SEC-2026-V1): https://noc.opshome.run/security.html
Found a problem? The whitepaper lists a security contact, and I'd like to hear about it.
Top comments (0)