Live data from Hacker News

Dank-selfhosted: automated deployment of email, web, DNS, XMPP, ZNC on OpenBSD

github.com

11–20 of 86 posts

Re: Dank-selfhosted: automated deployment of email, web, DNS, XMPP, ZNC on OpenBSD

#11

Their default Prosody config looks pretty nice; having an easy way to deploy a local chat service that has reasonable defaults like stream management, carbons (messages you sent are mirrored across all your clients), history, and HTTP-based file sharing is really nice.

Indeed, it would be great to have a standalone recipe / how to for setting that up. From the scripts there is no black magic involved, except a tiny bit for the integration with LE certificates.

Re: Dank-selfhosted: automated deployment of email, web, DNS, XMPP, ZNC on OpenBSD

#12

I would not put all of this on the same machine. Edit: To clarify - if one line of code is fd in any of the daemons you’re running you’ll lose everything. Practice defense in depth. Minimize the damage possible.

I can see how that kind of makes sense. But if you ask people to run it from multiple machines chances are they will throw their hands up and say too hard and not self host at all?

Re: Dank-selfhosted: automated deployment of email, web, DNS, XMPP, ZNC on OpenBSD

#13
post #7

Heads up you should probably never host your own email on the same server as your web/worker servers if you’re worried about IP leakage. Your IP is exposed on outbound mail. Using SMTP services like SendGrid won’t help, either.

What's the problem with leaking your IP address? If you host a website or any kind of API there, your IP is public anyway?

I was going to ask this as well, surely there shouldn't be a problem with this?

Re: Dank-selfhosted: automated deployment of email, web, DNS, XMPP, ZNC on OpenBSD

#15
post #12

I would not put all of this on the same machine. Edit: To clarify - if one line of code is fd in any of the daemons you’re running you’ll lose everything. Practice defense in depth. Minimize the damage possible.

I can see how that kind of makes sense. But if you ask people to run it from multiple machines chances are they will throw their hands up and say too hard and not self host at all?

Agreed and that would be a reason not to self host at all, if security is critical, because it IS difficult.

For example, driving is convenient. That doesn’t mean someone who has never driven before should just drive. It’s definitely better for them to taxi.

It’s a hard problem - we have to make things easier for people.

When King Sejong saw that people were illiterate, he didn’t try to force everyone to suddenly learn a difficult language - he just made an easier one.

Now korea is 99.9% literate.

Re: Dank-selfhosted: automated deployment of email, web, DNS, XMPP, ZNC on OpenBSD

#16
post #7

Heads up you should probably never host your own email on the same server as your web/worker servers if you’re worried about IP leakage. Your IP is exposed on outbound mail. Using SMTP services like SendGrid won’t help, either.

What's the problem with leaking your IP address? If you host a website or any kind of API there, your IP is public anyway?

maybe the commenter has the scenario of bare metal server at home in mind?

Re: Dank-selfhosted: automated deployment of email, web, DNS, XMPP, ZNC on OpenBSD

#17

I would not put all of this on the same machine. Edit: To clarify - if one line of code is fd in any of the daemons you’re running you’ll lose everything. Practice defense in depth. Minimize the damage possible.

OpenBSD's standard practice is for all daemons to run as unprivileged users in chroots (after using pledge and - nowadays - unveil to restrict themselves further). If one line of code is fd in any of the daemons, it will by default be constrained to that daemon.

Re: Dank-selfhosted: automated deployment of email, web, DNS, XMPP, ZNC on OpenBSD

#18

Heads up you should probably never host your own email on the same server as your web/worker servers if you’re worried about IP leakage. Your IP is exposed on outbound mail. Using SMTP services like SendGrid won’t help, either.

Your IP is exposed on outbound mail.

That reminds me of the good old days of the Interwebs: Your computer is currently broadcasting an IP address!

http://www.codehappy.net/ipaddress.htm

Re: Dank-selfhosted: automated deployment of email, web, DNS, XMPP, ZNC on OpenBSD

#19

Imagine could get away with running this on 1G with light usage/load? Also don't see webmail here, but imagine shouldn't be too difficult to add (I don't have much exposure to the OpenBSD landscape).

For webmail you could use rainloop or squirrel which can use the web server and the email server for example!

Re: Dank-selfhosted: automated deployment of email, web, DNS, XMPP, ZNC on OpenBSD

#20
post #8

Probably is trivial but I figured I'd ask anyway. A one click "email" server which allows you to receive emails from anywhere but only send emails to addresses on the current server. If I don't send emails, I don't need to worry about people not being able to receive my emails, right?

That's correct. For outgoing, assuming you setup certs and DNS correctly, the main challenge is your IP that's in an ISP CIDR which gets marked as spam.

I have a small instance on AWS that forwards my outgoing email and it works great.

Post reply on HN