Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Sovereign: Ansible playbooks to build and maintain your own private cloud

github.com

Post reply on HN
Print view View original

61–70 of 145 posts

Re: Sovereign: Ansible playbooks to build and maintain your own private cloud

#61

Post by bcrosby95 »

mindslight wrote: post #45

On the general topic of Ansible and personal infrastructure: Every time I attempt to use Ansible (or its kin) to manage my own network, it feels overly obtuse and ultimately unhelpful. Its gains seem to be rooted in configuring a large number of identical servers, and isn't geared for a handful of hosts with some commonalities and some differences. Writing playbooks feels like a still-imperative wrapper around shell…

I never really saw Ansible as a heavy tool. But a place I worked at in the past used cfengine, so my barometer for this is probably a bit different.

Re: Sovereign: Ansible playbooks to build and maintain your own private cloud

#62

Post by newscracker »

dguido wrote: post #19

There are so many servers and apps being installed by Sovereign that I'm certain few would be able to keep it secure ( https://github.com/sovereign/sovereign/wiki/Software-used-by... ). The big win for the cloud is that you're paying a fraction of the cost for access to a, typically, enormous security and operations team. If you want to build software like this that allows people to self-host, you need to scale down…

> Fun todo: Install this somewhere, nmap it for open ports, then ask "How many of these services had a remotely exploitable CVE in the last year?" "If one of these services had one tomorrow, would I know to patch it and take action faster than someone would takeover my box?" I don't see any containment mechanisms on any of these services beyond what's included by default so a compromise of one service likely leads to total compromise of the entire box.

This is the same concern I have with self-hosting anything with sensitive personal information on it. Without continuous monitoring, alerts and periodic review of audit trails, it’s anybody’s guess what’s going on with all the self-hosters’ data. With larger companies that provide a SaaS solution, there’s a little more hope that someone is looking at this seriously all the time.

Re: Sovereign: Ansible playbooks to build and maintain your own private cloud

#63

Post by gramakri »

jlgaddis wrote: post #46
gramakri wrote: post #28

For those in the market to run a private cloud, please try https://cloudron.io . Our motivation is to make it simple to selfhost apps . The main advantage is that we take care of automatic updates across all the apps we package. Happy to answer any questions. Disclaimer: I am the co-founder

Is it really self-hosting if you're running it on someone's cloud?

I think like many other terms like 'cloud', 'private', 'start up' there is a lot of gray area :). It's up to you where you draw the line. For me, self-hosting means running software in a manner where I have control of the data/application code and the server. With that definition, running software on EC2/DO/Linode is self-hosting. When I self-host using these servers, I know what the server is running and where the data resides.

Also, I think there are other similar popular terms. For those who run in their own premises, the term is on-premise. For those running it home, usually they call it home lab/NAS/home server. Self-hosting to me encompasses all this.

Also, self-hosting doesn't necessarily mean just open source. There are some amazing closed apps out there that you can self-host - emby, confluence, teamspeak to name a few.

Two of my favorite spots - https://github.com/awesome-selfhosted/awesome-selfhosted and https://www.reddit.com/r/selfhosted/

Re: Sovereign: Ansible playbooks to build and maintain your own private cloud

#64

Post by gramakri »

choward wrote: post #8
navaati wrote: post #2

For my fellow HNers, this is "private cloud" in the meaning of Owncloud, not of Openstack.

I hear about Nextcloud a lot more than I hear about Owncloud. Does anyone know why this project uses Owncloud instead of Nextcloud?

For some history: ownCloud is a very old stable product. 2-3 years back it got forked into Nexcloud because the founder of ownCloud had some disagreement about ownCloud's direction.

Both the products are backed by companies and both are doing quite well. I would say Nextcloud goes more and more into expanding it's use case and thus makes it product more extensible via plugins. This can be good or bad depending on how you look at it. Plugins go unmaintained/incompatible over time and are a constant source of pain when upgrading. Wordpress gets away with this because it has a massive community.

ownCloud on the other hand has decided to double down on it's roots of file sharing/syncing. I heard they rewrote their stack from PHP to Go now and the frontend is now React.

Re: Sovereign: Ansible playbooks to build and maintain your own private cloud

#65

Post by ocdtrekkie »

gramakri wrote: post #63
jlgaddis wrote: post #46

Earlier quoted context omitted.

Is it really self-hosting if you're running it on someone's cloud?

I think like many other terms like 'cloud', 'private', 'start up' there is a lot of gray area :). It's up to you where you draw the line. For me, self-hosting means running software in a manner where I have control of the data/application code and the server. With that definition, running software on EC2/DO/Linode is self-hosting. When I self-host using these servers, I know what the server is running and where the d…

I think it's also important to highlight that perfect is the enemy of good. I moved from Google services (A) to an open source platform... that I was paying them to host on Google Cloud (B). Sure, it's still at Google, but the ability for Google to mine data from it is significantly reduced. Of course, later, I moved to hosting it in-house (C), where I have direct physical control.

It's likely if my choices were A or C, I'd have never left A. But that B option eased the transition for me, and made it possible for me to get to the point I felt like the investment was worth it to create a fully on-premise solution.

There's a part D to this too, actually: I'm still using a service to manage the DNS and TLS for it. Eventually I should be able to move away from that too. But without the intermediate step, it'd be too prohibitive and frustrating to have moved to step C.

Re: Sovereign: Ansible playbooks to build and maintain your own private cloud

#66

Post by jefurii »

bwbmr wrote: post #49
ggregoire wrote: post #40

Earlier quoted context omitted.

> Not trying to start a Docker vs. Ansible flame war Don't worry, they serve very different purposes. You already probably know but Docker is for running applications in isolation, while Ansible is for provisioning and configuring hosts. For instance, you won't use Docker to harden sshd on your hosts but Ansible.

Are there any good resources (besides OP) for using Ansible in a home-server environment? Especially in a mixed docker + Ansible environment.

After figuring out Ansible work I started using it to manage several personal VPS machines and the various boxes at home. I just used the Ansible docs, which are pretty good.

Re: Sovereign: Ansible playbooks to build and maintain your own private cloud

#67

Post by intrepidhero »

mindslight wrote: post #45

On the general topic of Ansible and personal infrastructure: Every time I attempt to use Ansible (or its kin) to manage my own network, it feels overly obtuse and ultimately unhelpful. Its gains seem to be rooted in configuring a large number of identical servers, and isn't geared for a handful of hosts with some commonalities and some differences. Writing playbooks feels like a still-imperative wrapper around shell…

Not a fan of ansible's yaml, but when I setup my personal sever (1 websever) with ansible I though it was pretty cool I could duplicate my entire setup in a VM for testing with one command. Then it saved my butt when I got locked out of my VPS instance cause I lost the key. Just spin up a new one and run ansible. I was back online in less than 5 minutes.

Not saying you couldn't do that with custom scripts, but I found that when I tried writing my own admin scripts I was solving problems that the ansible team has already solved. It's a matter of what you want to spend time on IMO.

Re: Sovereign: Ansible playbooks to build and maintain your own private cloud

#68

Post by Domenic_S »

Tepix wrote: post #53
dguido wrote: post #19

There are so many servers and apps being installed by Sovereign that I'm certain few would be able to keep it secure ( https://github.com/sovereign/sovereign/wiki/Software-used-by... ). The big win for the cloud is that you're paying a fraction of the cost for access to a, typically, enormous security and operations team. If you want to build software like this that allows people to self-host, you need to scale down…

You're not expected to use and install all of the services offered by Sovereign, just as you're not expected to install all packages of your Linus distribution. I guess we need to make this more explicit in the documentation. Just pick services you plan to use during the installation phase as outlined in the instructions.

The documentation instructs you to pick the services you plan NOT to use:

> Don’t want one or more of the above services? Comment out the relevant role in site.yml.

Re: Sovereign: Ansible playbooks to build and maintain your own private cloud

#69

Post by fak3r »

I've used this project off and on for years, and it's always worked perfectly. I'd have an infosec conference to go to, I'd setup a host with wireguard, give my friends the cert, we'd all tunnel out though that, then tear it down after the con. Total cost a few dollars (most are $5/month)

Re: Sovereign: Ansible playbooks to build and maintain your own private cloud

#70

Post by zzzeek »

jlkuester7 wrote: post #17

This is a pretty cool setup! I have been tinkering in the self-hosting world for awhile now and I would say my biggest piece of advice is to learn Docker. (Not trying to shill for Docker here or start a Docker vs. Ansible flame war.) In my personal experience, Docker images (and docker-compose orchestrations) are more pervasive than Ansible playbooks and when it comes to self-hosting for personal use, hosting all my…

I run everything in containers and I spin up all the images / containers from ansible scripts. Am I doing it wrong? I didn't think these two tools were in conflict.
Post reply on HN