Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I host this blog from my garage

eevans.co

Post reply on HN
Print view View original

21–30 of 68 posts

Re: I host this blog from my garage

#21

Post by hellojesus »

scubbo wrote: post #12
shosti wrote: post #9

Earlier quoted context omitted.

(Author here) I mostly worry about security for this. If you have nothing private on your network it's probably fine, but if you have, say, a NAS that isn't using proper authentication (pretty common), an os/nginx vulnerability could end up exposing stuff. Of course there are much simpler ways to lock things down also :)

Thank you for a great article! I recently took the plunge of building-and-hosting a blog too - but, due to security concerns, I took the entirely opposite approach of making it fully cloud-based (Git repos for infra and for content -> AWS CodePipeline, Hugo during CodeBuild -> S3 and CloudFront). This was sadly ironic since I'd mostly wanted to blog about my experiences with homelabbing, but I didn't trust myself to…

I've done something similar to the author but with only ufw and port forwarding.

My closet server is set up with a cron job that runs daily and updates my domain's dns on Cloudflare to my currently allocated dynamic ip.

U Port forwarding sends the 80/443 requests to my closet server.

Closet server only accepts 80/443 requests from Cloudflare's published ip addresses via ufw rules so that all traffic must pass through Cloudflare to be accepted.

Nginx on closet server routes it to the appropriate internal port for that service.

Maybe someone has broken into my home network, but I hope this solution works relatively well!

Re: I host this blog from my garage

#22

Post by int0x2e »

hinkley wrote: post #18

If you wanted to 'publish' a more interactive website to the internet while still keeping all of the publishing tools safe inside an enclave/intranet somewhere, then you probably need a read-only copy of a database. But any time I look at read-replica configurations, it looks like they expect the replica to contact the master. You can't set up a proper bastion server if you have to have a secret door back into your i…

How much latency and inconsistency can you live with? Could you dump full or incremental database backups from your secure enclave, upload them to blobs and ingest on the cloud? Could you publish a change feed of sorts to Kafka and apply changes?

Re: I host this blog from my garage

#24

Post by themadturk »

jmnicolas wrote: post #16
treesknees wrote: post #4

Heh, I'm actually more interested in the "garage" piece of the blog which is barely touched on. I also run a home lab, but from my climate-controlled relatively clean basement. I've thought about moving it to the garage, but I'm worried about temperature and dust/dirt ingress. Do you have a sealed cabinet or air filters or any other environmental controls around the servers? Or are you using industrial machines rated…

I have seen production servers run for ten years upstairs a dirty bus repair shop. The room is never cleaned so there's a few millimeters of black dust on everything. In fact you know the age of a server depending on the amount of dust on it. There's a defective A/C unit that sometimes throw some water all around. There's power cut 2 or 3 times a year, the batteries are old so the servers get their hard reboot. As fa…

Yes, I've run an enterprise server stack on an old closet, with a home air conditioner venting into the warehouse. Even when the A/C unit died for three days one summer (we had to keep the door open and run several fans), the servers, ranging from 3-7 years old, kept running. Far from optimal, but the systems stay up and the company stays in business.

Re: I host this blog from my garage

#25

Post by shosti »

mro_name wrote: post #23

wouldn't a raspberry pi do it from within the drawer? Not only https://solar.lowtechmagazine.com does similar, but https://cheapskatesguide.org/articles/raspberry-pi-3-4-web-s... has some numbers. Seems feasible, unless you are the NYT.

Yeah that’s what I would do if I was just hosting a blog, I already had the k8s lab set up for other reasons and wanted to get more use out of it.

Re: I host this blog from my garage

#26

Post by shosti »

hellojesus wrote: post #21
scubbo wrote: post #12

Earlier quoted context omitted.

Thank you for a great article! I recently took the plunge of building-and-hosting a blog too - but, due to security concerns, I took the entirely opposite approach of making it fully cloud-based (Git repos for infra and for content -> AWS CodePipeline, Hugo during CodeBuild -> S3 and CloudFront). This was sadly ironic since I'd mostly wanted to blog about my experiences with homelabbing, but I didn't trust myself to…

I've done something similar to the author but with only ufw and port forwarding. My closet server is set up with a cron job that runs daily and updates my domain's dns on Cloudflare to my currently allocated dynamic ip. U Port forwarding sends the 80/443 requests to my closet server. Closet server only accepts 80/443 requests from Cloudflare's published ip addresses via ufw rules so that all traffic must pass through…

Yeah this is basically what I was planning to do before I learned about cloudflared.

Re: I host this blog from my garage

#27

Post by silverfox17 »

throwaway894345 wrote: post #15
superkuh wrote: post #6

>Well, hosting a blog from home is probably not a great idea from a practical perspective. I'm not a hater, but maybe he perceives it as not practical here because of all the fun unnecessary complexity. Keeping something like this going for more than a couple years would require complex sysadmin maintainence for updates (which is fun till it isn't). But if you just install nginx from your system repositories, have yo…

If all you're ever doing is hosting a static blog, then yeah, you don't need something like Kubernetes; however, if you want to host other services (e.g., database, authentication, comments, etc) then it quickly behooves you to build on some higher-level platform or else you'll end up building your own (poorly) and missing out on all of the experience, documentation, and tooling that are publicly available for Kubern…

Running a server to do database, authentication, comments, etc. is relatively simple. If you're trying to do scaling or whatever, sure. But to do all of that on a single vanilla server is pretty trivial, especially if you're using a CMS or some other software on it.

Re: I host this blog from my garage

#28

Post by hogFeast »

shosti wrote: post #14
scubbo wrote: post #12

Earlier quoted context omitted.

Thank you for a great article! I recently took the plunge of building-and-hosting a blog too - but, due to security concerns, I took the entirely opposite approach of making it fully cloud-based (Git repos for infra and for content -> AWS CodePipeline, Hugo during CodeBuild -> S3 and CloudFront). This was sadly ironic since I'd mostly wanted to blog about my experiences with homelabbing, but I didn't trust myself to…

I would say you don't really need Kubernetes for this sort of setup (I already was running all the K8s stuff which is why I went with it, but docker compose or even just running things in systemd without containers would work too). I think the main thing is to have some sort of network isolation (like a separate VLAN or a server that blocks outbound traffic) between stuff that's exposed to the internet and stuff that…

I use wireguard/iptables for this.

I have one small VPS with access to wireguard network, wireguard rule to forward certain traffic to a virtual machine running on my desktop, fairly easy to setup tbh (and I add/remove devices constantly). I am not a networking person, my understanding of iptables is shaky but I also ran a similar setup with Nginx. Could also use TailScale, but I found the wireguard CLI very easy. Straightforward to add more networks and isolate stuff from each other (tbh, I only run one network that doesn't isolate my web-facing stuff from other stuff I run privately...as I said, I am not a networking guy so have no idea how bad of an idea this is given that the only way in is traffic on certain ports being forwarded).

Re: I host this blog from my garage

#29

Post by BrandoElFollito »

treesknees wrote: post #4

Heh, I'm actually more interested in the "garage" piece of the blog which is barely touched on. I also run a home lab, but from my climate-controlled relatively clean basement. I've thought about moving it to the garage, but I'm worried about temperature and dust/dirt ingress. Do you have a sealed cabinet or air filters or any other environmental controls around the servers? Or are you using industrial machines rated…

My "datacenter" is on the top shelf of a closed closet. This is in an apartment and the ceiling that is just above the server is heated (heating of the neighbor above me). There is a fiber ONT, switch, router, a raspberry and tower computer ("the server")

The ambient temperature is 32-35°C

The temperature of the disks is 38°C (ssd) to 49°C (hdd), the CPU cores are 27 to 34°C (not sure why there is a difference, it is one CPU).

When I put the computer and other equipment there, I was concerned that the temperature would be unbearable. I am positively surprised.

Post reply on HN