Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I don't need a VPS anymore

greenash.net.au

Post reply on HN
Print view View original

121–130 of 197 posts

Re: I don't need a VPS anymore

#121

Post by CodesInChaos »

DeathArrow wrote: post #113

>The number one thing that I loathed about managing my own VPS, was security. A fully-fledged Linux instance, exposed to the public Internet 24/7, is a big responsibility. I don't share the view, if we consider small web sites or apps. For me, using containerized apps, having external backups of the DB, means I can reboot the app fast in a clean state if an attacker manages to break in and do nasty things. The OS and…

> I can reboot the app fast in a clean state if an attacker manages to break in and do nasty things.

My biggest security worry is the attacker having access to data. That's what leads to reputational loss, fines, etc.

Re: I don't need a VPS anymore

#122

Post by rhizome »

pan69 wrote: post #79
trey-jones wrote: post #57

I might need some perspective. Every time I read one of these I'm just shaking my head, and yes the arguments are Less Power, Less Control, but also SysAdmin is me. That is my identity, and the part of the job that I like the most. I solve problems with configuration before code. So I hate to think that I'm becoming obsolete, of course. I also don't think that I am, because I do think that my way has some clear and d…

You're not obsolete. It's just that some people just want to drive their car and get it serviced somewhere every once in a while rather than doing it themselves. Same for servers.

To be sure, it's not getting it serviced "somewhere," it's getting it serviced at the dealership.

Re: I don't need a VPS anymore

#123

Post by rhizome »

swiftcoder wrote: post #97
mjevans wrote: post #4

There are still reasons to have a VPS. However nearly all of them are driven by one factor for me: American ISPs suck; cash from the wallets and otherwise. For one thing, they often make it against the ToS to host 'a server' (generally). ISPs with even remotely decent uploads, EVEN for their business offerings, in the metro area around Seattle (still crazy rent, can't even afford to try buying a house) are like Cable…

> ISPs with even remotely decent uploads, EVEN for their business offerings, in the metro area around Seattle (still crazy rent, can't even afford to try buying a house) are like CableCo for 1000mbit down 35mbit up for too much a month or DSL for (I am not joking) 7mbit down (if your connection is GOOD) and (LESS THAN) 1mbit up. There are residential ISPs offering symmetrical gigabit fiber in a pretty good chunk of m…

Will they sell you static IPs?

Re: I don't need a VPS anymore

#124

Post by 8fingerlouie »

I'm at the same page.

After decades of self hosting, and gradually warming up to "the cloud", only to promptly pull everything back home in 2013 when Snowden happened, i've yet again moved everything to the cloud.

For personal documents, privacy is handled by Cryptomator (https://cryptomator.org/), and i make local backups as well as remote backups to another cloud.

Everything else is in Azure. Their free tier offers generous consumption limits on Azure Functions and CosmosDB.

I'm currently playing around with Oracle Cloud as well. Their free tier has some generous offerings of ARM cores, 4 cores and 24 GB RAM that can be provisioned as either 4 x 1 core VPS' or a single 4 core VPS, but that just brings back the problem of having to manage stuff myself.

For the first time in decades, i have ZERO open ports in my firewall, and i'd like to keep it that way.

Re: I don't need a VPS anymore

#125

Post by dijit »

ricktdotorg wrote: post #101
pnathan wrote: post #98

Earlier quoted context omitted.

I would note that every single company I've had in the last 8 years has essentially been replacing sysadmins with infra-knowledgable programmers working with AWS services (who might have been sysadmins in a past life). No one in the engineering org was hired who couldn't program. IT's "System Engineers" were aimed towards "you need to write code to do your job with LDAP/AD/Okta/etc". If someone identifies as a sysadm…

> [..] If someone identifies as a sysadmin and can't write Python/Perl/Go/Ruby [..] this is the difference between a systems admin and a systems engineer. some folk can't make the jump from sysadmin, despite best intentions and training.

It is a common (new) myth that sysadmins didn’t code.

There were some IT technicians who couldn’t code and some operations staff who couldn’t code (and would proudly claim this, for some reason). But tools like ansible, salt, chef and terraform were written by sysadmins.

In fact a lot of non-feature code in my companies such as database fencing programs and automated blue/green rollouts has been written by sysadmins.

We’ve just been starting to call them something else since 2013 now.

Re: I don't need a VPS anymore

#127

Post by tasuki »

ptman wrote: post #120

In case you still find yourself needing more than netlify can offer, you can get a pretty decent free VPS from Oracle: https://paul.totterman.name/posts/free-clouds/ . Just remember to make backups.

That... sounds a bit too good to be true? But maybe it is true? Have you been using it? Are there any surprise costs (traffic etc)?

Please tell more!

Re: I don't need a VPS anymore

#128

Post by cersa8 »

seanwilson wrote: post #90

For people that self-host and manage security themselves, what steps do you take to actively monitor that you haven't been hacked? I understand how people would set up their own backups and automate security updates, but what do you do to monitor that there hasn't been an intrusion without you noticing (e.g. login attempts, successful logins that aren't you, files changed, root kits, data stolen)? How does that compa…

You can run an automated rootkit detector, but I doubt anyone able to get that far will be caught that easily. Your best bet is using application specific monitoring, eg for WordPress there are excellent tools like Wordfence that monitor login attempts, file changes and block common attacks. For my custom apps I will be alerted on brute force attempts, weird queries (sql injection attempts) and pretty much any anomaly is logged and will stand out. Another big one is monitoring for weird resource usage, I use Netdata for this. But doing some upfront hardening is the most effective way. I have yet to be hacked (as far as I can tell) operating multiple VPS servers in 10 year+ timespan. But have worked with companies that frequently had their servers compromised due to poor security practices.

Re: I don't need a VPS anymore

#129

Post by benplumley »

cutler wrote: post #76
MatthiasPortzel wrote: post #70

Earlier quoted context omitted.

> I tried Github pages once…and pulled my hair out trying to get HTTPS working with a personal domain. Last I checked HTTPs was available by default even on custom domains. I did have to remove and re-add my custom domain on a Github pages site that was created before this was the case. But after doing that, it was 0-config.

It's been available for a long time but when I tried I forget which but one of the 6 url formats didn't work, ie. http://domain.com http://www.domain.com https://domain.com https://www.domain.com domain.com www.domain.com Try them all with your domain. Unless things have improved one of them will fail.

Just tried with my custom-domain GitHub pages, things have improved since you tried.

Re: I don't need a VPS anymore

#130

Post by prmoustache »

tyingq wrote: post #40
lrvick wrote: post #9

I feel the author presents a false dichotomy. I would argue that production servers should be immutable appliances. They should not have mutable root file-systems, they should not have package managers, they should not have ssh or require direct modification. Those are security accidents waiting to happen. I do not babysit my servers in my home rack. I have a company to run and better things to do just like the autho…

There is still some work there for the use cases he's mentioned (git hosts, backups, web servers). Rotating https certs, adding mutable volumes for backups, ssh (you say you don't need it, but it's pretty useful if you're running a git server), and so on. So, yes, they can do much of what you're describing, but it doesn't always work out of the box...there's work involved.

Most of my services are at home in a dedicated lan but I still have one vps server that is used as a reverse proxy and which forward everything via a tunnel.

The OS itself doesn't need much maintenance. I have set up auto updates and auto reboot on a regular basis. And you know what? Distros do their job very well and it just works. We are talking home service, I can deal with (less than) 5 minutes of downtime once in a week. I use rhel derivated distro which means major disruptive upgrade are only dealt with once every n years. I may choose an immutable distro in the future when support ends though.

Rotating https certs? Certbot makes automatic rotation easy.

ssh? What is the deal? You set it up basically once. Add a bit of port knocking if you want more silent logs.

To add a bit of security, set up crowdsec, fail2ban. Again, these tools do not require a lot of maintenance.

Most of the burden of maintenance comes from the management of the apps/services you want to have live. PaaS won't really help you much with that. SaaS tend to be expensive or lock you, they help if the service you want to maintain is complex. I don't think that is the case for the services described in the OP: static websites, git and backups.

There are traps though. For example should you run containers to easily maintain certain services or use the distro packages? You can argue that containers whom upstream project provide image for allows you to easily upgrade any service. I can switch from any postgresql version in a snap for instance. However while it is easy to track and set up auto update a major version using a tag, you might want to be more cautious with major versions bumps. And this keeping informed with the various upstream project, know when and why to do major upgrade, what are the impact and potentially maintenance task of any major release upgrade. This is the hardest part. Sometimes it might be best forgetting about using upstream container for some services and sticking to the version supported by your long term maintenance distro that does the job of backporting any security patch to have that peace of mind. You can still run it as a container, but using the distro packages. That is what I do for databases for example.

Post reply on HN