How safe is web ui?

[g5r7hj7g57]

I set up ASF on A Linux VPS and the web ui only requires a password
Is it safe to keep it like that? How could someone get the ip of my vps to get access to my ASF?

[JustArchi]

Have you even bothered reading first question of IPC's FAQ?

[g5r7hj7g57]

How can I add know networks so only I can access the UI?
ASF crashes when I try to do it this is how my config looks
{
"Kestrel": {
"Endpoints": {
"example-http4": {
"Url": "http://ip.port"
}
}
}
}

[JustArchi]

That's not what known networks are for. ASF will not limit IPs that can connect to the interface once you take it out of localhost, it's even stated.

Host accepts either localhost, a fixed IP address of the interface it should listen on (IPv4/IPv6), or * value that binds ASF's http server to all available interfaces. Using other values like mydomain.com or 192.168.0.* acts the same as *, there is no IP filtering implemented, therefore be extremely careful when you use Host values that allow remote access. Doing so will enable access to ASF's IPC interface from other machines, which may pose a security risk. We strongly recommend to use IPCPassword (and preferably your own firewall too) at a minimum in this case.

If IPCPassword doesn't feel like enough of security for you, then you should implement your own security on top of it such as iptables or running ASF through a reverse proxy such as nginx. That however is not related to ASF anymore, but to the Linux security which applies to all of the applications. If you're not experienced, I can recommend ufw and setting up a rule that will allow only your trusted IP to reach ASF interface. That however is outside of ASF support scope - you can find tutorials online.