Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Sovereign: Ansible playbooks to build and maintain your own private cloud

github.com

Post reply on HN
Print view View original

131–140 of 145 posts

Re: Sovereign: Ansible playbooks to build and maintain your own private cloud

#131

Post by jophde »

hrjd wrote: post #116
jophde wrote: post #95

I currently just let my desktop run constantly. It runs Windows in a KMS for games and sleeping breaks it so I never even suspend. It only seems to use about $10/month in power. I have been considering using DDNS through my router and Cloudflare and trying to create a iOS/Android app that will automatically upload my photos to the my DDNS for storage on my desktop. It feels a little crazy but the idea of syncing my p…

Ngrok as alternative to dynamic DNS?

DDNS maps a domain to your current dynamic IP. Its built into most routers. They will push the new ip to a DDNS service when it changes.

Re: Sovereign: Ansible playbooks to build and maintain your own private cloud

#132

Post by eeZah7Ux »

neop1x wrote: post #126
eeZah7Ux wrote: post #89

Earlier quoted context omitted.

Yet they are both security disasters.

How is docker container, running a process as unprivileged user with reduced capabilities security disaster? With Kubernetes you can even have network policy or service mesh with mTLS. Compare it to bunch of bare processes running on the same machine, lots of services listening on localhost, difficult updates due to different dependency version requirements by different software, requiring you do the manual, painful…

It has a huge attack surface, also a lot of its code runs with high privileges. There's plenty of documentation on this.

Re: Sovereign: Ansible playbooks to build and maintain your own private cloud

#133

Post by eeZah7Ux »

grosswait wrote: post #100
eeZah7Ux wrote: post #89

Earlier quoted context omitted.

Yet they are both security disasters.

How is Ansible a security disaster?

A system designed to SSH into production host with high privileges and make changes automatically instead of enforcing staging...

Re: Sovereign: Ansible playbooks to build and maintain your own private cloud

#134

Post by wpietri »

Tepix wrote: post #57
wpietri wrote: post #51

Earlier quoted context omitted.

Definitely. I mean, you could play an infinite regress game. Do you own the hardware? Do you own the cage the hardware is in? Do you own the building that the cage is in, and the land that the building is on? And then we can go toward owning the power company and the connections to anybody your servers talk to. But in practice, self-hosting is about control. If what you're running it on is a commodity cloud instance…

No. If you have dedicated hardware (rented or owned) and full disk encryption you have decent control over your data. On a virtual server you have no control and no privacy.

Depends on what you mean by control. It sounds like you're worried about different downside risks than I am.

Re: Sovereign: Ansible playbooks to build and maintain your own private cloud

#135

Post by platform »

I looked at Soverign at the time I was setting up private cloud on a $5 VPS (prgmr.com with 1.5 gb ram)

I went with YunoHost.

https://yunohost.org/#/apps

I initially tried sovereign, but once I figured out I had to pay for tarsnap backup service, and that it did not have ansible for nginx setup (I needed that experience for work stuff), I went with Yunohost.

Sofar I am happy with YunoHost and subscribed to send periodic donation to the project.

Overall, though, if you are working with ansible at work, or want to advance in devops field, learning ansible and contributing to Sovereign project would be a good path to take.

Re: Sovereign: Ansible playbooks to build and maintain your own private cloud

#136

Post by matlin »

wpietri wrote: post #90
yjftsjthsd-h wrote: post #78

Earlier quoted context omitted.

Sandstorm was a really nice solution to this, but it required each app to be integrated with it, which I personally think is what killed it. (Which sucked, because for what it supported it was the best option available)

Ah, interesting! Just reading the home page wearing my developer hat makes this stand out: "Each document, chat room, mail box, notebook, blog, or anything else you create is a "grain" in Sandstorm. Sandstorm containerizes each one in its own secure sandbox from which it cannot talk to the world without express permission." The notion that every document is its own independent unit sounds pretty menacing to me. Could…

I feel the exact same way and am currently trying to solve this by decoupling the application from the storage. So the "experts" control the business logic and UI, while I, the user, store the data. It's similar to what Firebase does for app developers but is split by the end user who can also control that data.

> But the part that really concerns me is that they seem to think that server apps can run like mobile apps. To me one of the most powerful things about SaaS products is that the aggregated use...

That definitely seems like the current state of affairs but I think there isn't a reason why writing server apps like mobile apps has to inherently throw away aggregated data. Especially with Google's research in federated learning, apps will soon be able to get insights across their users while preserving their privacy.

Re: Sovereign: Ansible playbooks to build and maintain your own private cloud

#137

Post by apple4ever »

eeZah7Ux wrote: post #133
grosswait wrote: post #100

Earlier quoted context omitted.

How is Ansible a security disaster?

A system designed to SSH into production host with high privileges and make changes automatically instead of enforcing staging...

That’s not really a security disaster unless you consider all of SSH a security disaster.

If you are concerned about Ansible SSH’ing in (which means you are concerned about any person SSH’ing in), you just do the standard SSH hardening.

Re: Sovereign: Ansible playbooks to build and maintain your own private cloud

#138

Post by apple4ever »

mindslight wrote: post #45

On the general topic of Ansible and personal infrastructure: Every time I attempt to use Ansible (or its kin) to manage my own network, it feels overly obtuse and ultimately unhelpful. Its gains seem to be rooted in configuring a large number of identical servers, and isn't geared for a handful of hosts with some commonalities and some differences. Writing playbooks feels like a still-imperative wrapper around shell…

It definitely is target at a large number of identical servers, but is still very helpful for just a handful of hoses.

Putting everything in YAML is helpful because no matter what service you are setting up, the format is the same to read and understand. And I hope you are using modules and not shell command directly (except for the small cases it is necessary)

Ansible can be as simple or as complex as you made it. I bet your script isn’t as nice as an Ansible setup, nor as maintainable. Ansible’s templating engine is super flexible.

Re: Sovereign: Ansible playbooks to build and maintain your own private cloud

#139

Post by apple4ever »

crmrc114 wrote: post #80

Dumb question maybe... but why would you not just configure this yourself on a single virt/host? Most of these services would take less than a day to configure. So many questions on why this is a good thing. Like, there are countless ways to configure your MTA and spam filtering- if you are going to have to dig through this config.. why not just roll your own? Can someone explain to me why you need ansimble for this?…

Because if you want to switch providers, you’d have to do that all again. Or if your current provider’s VPS just dies (I’ve had it happen) you’d have to do that all again.

With Ansible, you just run it again and in a fraction of the time its back up.

Re: Sovereign: Ansible playbooks to build and maintain your own private cloud

#140

Post by apple4ever »

haolez wrote: post #107

As the CTO of an established company, I cannot imagine a situation where I would prefer to maintain my own infrastructure vs using managed cloud services. If I get locked in on a specific product, it's way cheaper to redesign that around an alternative vendor than it is to maintain a private cloud (Ansible, Kubernetes and friends included). As a nerd, I'd prefer to do things myself, but I have business needs to atten…

Performance, cost, security. For small businesses, it may be a wash (due to ability to hire system engineers), but for medium to large business rolling your own is almost always better.
Post reply on HN