Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: What do you self-host?

news.ycombinator.com

Post reply on HN
Print view View original

251–260 of 347 posts

Re: Ask HN: What do you self-host?

#251

Post by ricardbejarano »

lbotos wrote: post #225
ricardbejarano wrote: post #166

Earlier quoted context omitted.

I've seen it, never tried it. The thing is, I don't use Kubernetes for convenience or because I need it, I use to learn it. I was just fine with Docker Swarm before switching, but I wanted to learn Kubernetes as a valuable skill, and I know no better way of learning something than using it every day. And the thing about Kubernetes distros is that they usually all apply a new layer of "turning Kubernetes' complexity i…

I was like you, I knew about the "concept" of a pod, and nothing more. k3s is not very far from the fundamentals. It's really just "one binary" instead of many for the space savings/ simple deployment. That said, consider Kubernetes in Action by Manning. I'm about 75% done now, was a great help, and I'm continuing with k3s after doing it.

At this point I consider myself pretty knowledgeable on Kubernetes.

I bought Kubernetes Up & Running a year ago, I was disappointed to see it is a very over-the-top view, without getting into details.

I skimmed over Kubernetes in Action a couple months ago. Nothing really catched my eye either.

The last one I read was Kubernetes Security by Liz Rize. Either there's not that much to securing Kubernetes or the book is very introductory too.

The only parts of K8s I don't know a lot about are storage (haven't got past the NFS driver yet), CRDs and distributions like OpenShift. But in the same way I'm lacking storage expertise outside of Kubernetes.

Re: Ask HN: What do you self-host?

#252

Post by dmos62 »

mavidser wrote: post #60

I reworked my servers a while ago to host literally everything through docker, managed via terraform. All web-services are reverse-proxied through traefik At home: loki + cadvisor + node-exporter + grafana + prometheus syncthing tinc vpn server jackett + radarr + sonarr + transmission jellyfin samba server calibre server On a remote server: loki + cadvisor + node-exporter + grafana + prometheus syncthing tinc vpn ser…

I see you're using Bitwarden.

Does anyone have recommendations for password+sensitive-data management?

I'm currently using Keepass and git, but I have one big qualm. You cannot choose to not version-control that one big encrypted (un-diff-able) file.

Re: Ask HN: What do you self-host?

#253

Post by ricardbejarano »

tptacek wrote: post #249
ricardbejarano wrote: post #173

Earlier quoted context omitted.

There you go! Essentially, this setup achieves 5 features I wanted my DNS to have: - Confidentiality: from my ISP; and from anyone listening to the air for plain-text DNS questions when I'm on public WiFi. Solution: DNS-over-TLS[1] - Integrity: of the answers I get. Solution: DNS-over-TLS authenticates the server - Privacy: from web trackers, ads, etc. Solution: domain name blacklist - Speed: as in, fast resolution t…

DoH isn't an "L7 hack to speed up adoption". It's a DNS privacy mechanism that can't easily be disabled by network administrators, unlike DoT. You may have lots of good reasons to want to disable DNS privacy on your own network, and by all means use DoT to do that. But DoH is superior for end-users.

  s/mechanism/hack/g
DoH is a hack, the use of suboptimal protocol to achieve the same goal.

DoT is a protocol explicitly designed for it's purpose.

If brickhead sysadmins block DoT it's their problem, and if you have to work around that then it is, in fact, a hack (or a "workaround", doesn't matter).

It's not that DoT or DoH are superior to one another, it's that DoT is "DNS in TLS", and DoH is "DNS in HTTP in TLS", doesn't that raise a red flag for you?

Re: Ask HN: What do you self-host?

#254

Post by tptacek »

ricardbejarano wrote: post #253
tptacek wrote: post #249

Earlier quoted context omitted.

DoH isn't an "L7 hack to speed up adoption". It's a DNS privacy mechanism that can't easily be disabled by network administrators, unlike DoT. You may have lots of good reasons to want to disable DNS privacy on your own network, and by all means use DoT to do that. But DoH is superior for end-users.

s/mechanism/hack/g DoH is a hack, the use of suboptimal protocol to achieve the same goal. DoT is a protocol explicitly designed for it's purpose. If brickhead sysadmins block DoT it's their problem, and if you have to work around that then it is, in fact, a hack (or a "workaround", doesn't matter). It's not that DoT or DoH are superior to one another, it's that DoT is "DNS in TLS", and DoH is "DNS in HTTP in TLS", d…

You don't seem to follow. Millions of end-users get access to the Internet through major ISPs that monitor, log, monetize, and manipulate DNS. I'm on AT&T, and they absolutely do this. The purpose of DoH is to add a privacy mechanism that AT&T, or coffee shop wireless networks, or airplane wireless, or whatever, can't trivially disable. That's why it exists and why it's tunneled through HTTPS. Meanwhile, the reason network operators have a meme now about how much better DoT is comes down to the fact that they have middleboxes on their networks that passively monitor DNS, and they themselves (and, more importantly, the vendors that sell those boxes) want to hold back DNS privacy --- at least on their networks --- to keep those boxes working. They prefer a DNS privacy mechanism that has a kill switch that the network controls, not the user.

The idea that end-users should give a shit about any of this "L7" "purpose built" "control plane" "layering violation" nonsense, and opt themselves into a version of DNS privacy that their network operators can turn off for them without end-user consent, is lunacy; bamboozlement.

Re: Ask HN: What do you self-host?

#255

Post by dillonmckay »

stiray wrote: post #223
dillonmckay wrote: post #206

Earlier quoted context omitted.

So, that would be interesting to note who here is in the EU self-hosting w/ their symmetric, low-cost, high-speed ISPs, versus the US, paying $600/mo for a 5 year contract for 10/10 Mbit DIA setup (anecdote).

I am paying 76 euros/month for 500/100 (This is max achievable, with latency at around 6ms, after replacing their crappy router (12ms+) with mikrotik, throughput can be lower but mostly it is throttled by source) fiber connection + 1 phone (50gb download, LTE, with 80% of country coverage) + max iptv scheme with HBO + static ipv4 ip and reverse resolve. I would love to hear what the prices are around the world. (edit…

I have DSL in US, and get 12Mbps down and less than 1Mbps up, for $55/mo.

Shared LTE phone and data plan (2 people) w/ 22GB/mo total is $160.

And I also pay about $800/mo for health insurance for 2 people.

Re: Ask HN: What do you self-host?

#256

Post by big_chungus »

cyphar wrote: post #171

I self-host the following at home. Everything is running under LXD (and I have all of the scripts to set it up here[1]): * nginx to reverse-proxy each of the services. * NextCloud. * Matrix Homeserver (synapse). * My website (dumb Flask webapp). * Tor (non-exit) relay. * Tor onion service for my website. * Wireguard VPN (not running in a container, obviously). All running on an openSUSE Leap box, with ZFS as the file…

Why SUSE over another OS? I've used it and like it, though I see more ubuntu, debian, centos among servers. Any particular distinguishing factor/advantage, or just preference?

Re: Ask HN: What do you self-host?

#257

Post by e15ctr0n »

dillonmckay wrote: post #209
whalesalad wrote: post #22

Bums me out when I see people putting so many resources into running/building elaborate piracy machines. Plex, radarr, sonarr, etc... (you note some of these services but /r/homelab is notorious for this) Here’s my home lab: https://imgur.com/a/aOAmGq8 I don’t self host anything of value. It’s not cost effective and network performance isn’t the best. Google handles my mail. GitHub can’t be beat. I use Trello and Not…

Tell me about the wood shelving. Did you build that? It seems to hold rack-mounted gear quite well.

> Tell me about the wood shelving.

Looks like the IKEA IVAR storage system. https://www.ikea.com/kr/en/catalog/categories/departments/li...

Re: Ask HN: What do you self-host?

#258

Post by ricardbejarano »

tptacek wrote: post #254
ricardbejarano wrote: post #253

Earlier quoted context omitted.

s/mechanism/hack/g DoH is a hack, the use of suboptimal protocol to achieve the same goal. DoT is a protocol explicitly designed for it's purpose. If brickhead sysadmins block DoT it's their problem, and if you have to work around that then it is, in fact, a hack (or a "workaround", doesn't matter). It's not that DoT or DoH are superior to one another, it's that DoT is "DNS in TLS", and DoH is "DNS in HTTP in TLS", d…

You don't seem to follow. Millions of end-users get access to the Internet through major ISPs that monitor, log, monetize, and manipulate DNS. I'm on AT&T, and they absolutely do this. The purpose of DoH is to add a privacy mechanism that AT&T, or coffee shop wireless networks, or airplane wireless, or whatever, can't trivially disable. That's why it exists and why it's tunneled through HTTPS. Meanwhile, the reason n…

Nothing keeps an end-user from rescinding it's ISP contract as soon as they ever slightly cross the line of filtering a single packet.

I agree in that end-users shouldn't give a dime about DNS privacy, it should be private by default, but it is up to us to promote the correct protocol over the "hacky" one.

If DNS-over-HTTPS is superior, then why don't we shove everything down 443/TCP? Or better yet, why don't we get rid of TCP altogether and send everything over a port-less encrypted dynamically-reliable trasport protocol? Surely middleman couldn't distinguish between traffic.

Ports are there for a reason. The fact that they are used with anti-end-user intent doesn't make them (or any protocol that runs on them) inherently bad. Yet one thing that makes a protocol better than another one, given set of requirements, is efficiency.

By the way, if I were to switch my DoT server from 853/TCP to 443/TCP, the port wouldn't be a problem anymore. Per your standards, now DoT would be better than DoH, wouldn't it? Same results, smaller payloads.

Re: Ask HN: What do you self-host?

#259

Post by tptacek »

ricardbejarano wrote: post #258
tptacek wrote: post #254

Earlier quoted context omitted.

You don't seem to follow. Millions of end-users get access to the Internet through major ISPs that monitor, log, monetize, and manipulate DNS. I'm on AT&T, and they absolutely do this. The purpose of DoH is to add a privacy mechanism that AT&T, or coffee shop wireless networks, or airplane wireless, or whatever, can't trivially disable. That's why it exists and why it's tunneled through HTTPS. Meanwhile, the reason n…

Nothing keeps an end-user from rescinding it's ISP contract as soon as they ever slightly cross the line of filtering a single packet. I agree in that end-users shouldn't give a dime about DNS privacy, it should be private by default, but it is up to us to promote the correct protocol over the "hacky" one. If DNS-over-HTTPS is superior, then why don't we shove everything down 443/TCP? Or better yet, why don't we get…

Why would any end-user care about what the "correct" protocol was, when the choice was between a privacy protocol with an ISP-owned kill switch and one without?

Re: Ask HN: What do you self-host?

#260

Post by whycombagator »

ricardbejarano wrote: post #173
whycombagator wrote: post #65

Earlier quoted context omitted.

> * CoreDNS: DNS cache with blacklisted domains (like Pihole), gives DNS-over-TLS to the home network and to my phone when I'm outside I would be _very_ interested in a write up/explanation of this set up

There you go! Essentially, this setup achieves 5 features I wanted my DNS to have: - Confidentiality: from my ISP; and from anyone listening to the air for plain-text DNS questions when I'm on public WiFi. Solution: DNS-over-TLS[1] - Integrity: of the answers I get. Solution: DNS-over-TLS authenticates the server - Privacy: from web trackers, ads, etc. Solution: domain name blacklist - Speed: as in, fast resolution t…

Thank you for going into such depth! This is really helpful
Post reply on HN