Live data from Hacker News

Ask HN: How can a total beginner start with self-hosting?

news.ycombinator.com

121–130 of 194 posts

Re: Ask HN: How can a total beginner start with self-hosting?

#121
post #50
post #32

Without meaning that in a rude way: Learn to find and read documentation. Oh and very much avoid random tutorials on the internet. As in, go for official source and use these tutorial only to connect the dots. The reason is that there is huge amounts of really bad advice on the internet and a lot of the tutorials only work in very specific situations (versions, OSs, etc.). Official documentation tends to be a lot bet…

No offense taken. Sounds like good advice.

Exception: any how-to guides in Arch or Gentoo's documentation & community wikis or what have you are likely to be excellent and sometimes a far better use of time than reading the official docs. Most of the steps, tips, and advice aside from parts related to package management will be useful just about anywhere.

Re: Ask HN: How can a total beginner start with self-hosting?

#122
post #94

Earlier quoted context omitted.

Nextcloud released a new version of their photos app a few days ago ( https://nextcloud.com/blog/announcing-nextcloud-hub-3-brand-... ). Haven't had the chance to try it yet though

What’s the difference between nextcloud hub and the good old nextcloud server?

No difference. Just a branding exercise.

Nextcloud will soon be at version 25, which will also be named Nextcloud Hub 3. Frank Karlitchek talks about this during the Q&A, about an hour and a half into the video linked below.

However there are major improvements coming in that new version, specifically to the Photos app[1]

[1] https://www.youtube.com/watch?v=dhJXZzqsv8A&t=1103

Re: Ask HN: How can a total beginner start with self-hosting?

#123
Start by reading about docker and docker compose. You will have almost everything in docker containers.

Pay attention to the basic networking part. Especially where it says that you can refer to a container by name in your configurations

Then have a look at Caddy, a web server, to use it as a reverse proxy. You will end up with very simple configurations Read about reverse proxy in caddy's excellent doc.

Test on a machine in your lan first, by installing docker on it and administrating it via ssh,b this will be how you will interact with your VPS.

Install the containers you are interested in and configure them.

When you decide to move them to your VPS, make sure to use long passwords (and MFA if available) sans expert only 80 and 443 ( both will be marked by caddy to he right way ootb). The containers for week known apps are usually secure by default, and they highlight in their docs what you ansolutely need to change.

...

After some time, when you finally understand everything, you will reorganize everything. No worries, containers are made for that, your data is independent.

...

Then you will realize that you actually need an OS that is almost empty except for docker and a backup program (easier to use it at the OS level than as a container). You should consider borg.

...

Than you will move to home automation with Home Assistant

Re: Ask HN: How can a total beginner start with self-hosting?

#125

Start by reading about docker and docker compose. You will have almost everything in docker containers. Pay attention to the basic networking part. Especially where it says that you can refer to a container by name in your configurations Then have a look at Caddy, a web server, to use it as a reverse proxy. You will end up with very simple configurations Read about reverse proxy in caddy's excellent doc. Test on a ma…

Helpful. Thank you.

Re: Ask HN: How can a total beginner start with self-hosting?

#126
Setting up WireGuard is definitely the way to go. I learned a ton about networking doing that. It's a beautifully elegant implementation and actually very easy, but it exposes a lot of networking concepts that are important to understand. Don't use PiVPN and the like, just install it and write the configuration files manually.

I used WG to get two homes talking to each other. A Pi at each end running WG, with static routes set up in the actual routers, and both networks function like one. It was fun to configure, and I learned a fair amount about networking doing it.

Also, using WG to access your network addresses a lot of security concerns. You open up 22, and you're going to get hammered day and night. Assuming you set it up correctly, it shouldn't matter, but there's still always some risk. WG just silently fails if it doesn't receive the proper key. There's literally zero difference (from the client's perspective) between using an incorrect WG key and a machine's simply not existing at that IP address.

And then, once you get WG set up, you can expand stuff like pihole to cover all of your devices wherever you are; just run a split tunnel on the client and route all DNS lookups back to your home.

You likely won't have a static IP residentially, but you have a few options there. In some cases, a business-class connection isn't much more and is better anyway (this especially is true in cities and other areas that actually have competitive markets for ISP). There are plenty of free and paid dynamic DNS services, and setting up one of those on a router or Pi or something is pretty straightforward. Finally, if your IP is _mostly_ unchanging, you can just do the lazy/cheap move (which is what I ended up doing), having a simple script run every hour that checks the IP address and sends me an email and a slack message if it changes. Happens less than once a year, and updating all of the devices that need updating everything takes maybe a half-hour. If it were a weekly or even monthly thing, I'd probably go the DDNS route.

Re: Ask HN: How can a total beginner start with self-hosting?

#127
The reality is that we've let you down. Self-hosting shouldn't be any more complicated or less secure than installing an app on your phone. You shouldn't need to understand DNS, TLS, NAT, HTTP, TCP, UDP, etc, etc. Domain names shouldn't be any more difficult to buy or use than phone numbers. Apps should be sandboxed in KVM/WHPX/HVP-accelerated virtual machines that run on Windows, Mac, and Linux and are secure-by-default. Tunneling out to the public internet should be a quick OAuth flow that lets you connect a given app to a specific subdomain, with TLS certs automatically obtained from Let's Encrypt and stored locally for end-to-end encryption.

The technology exists to do all of these things, but no one has taken the time to glue it all together in a truly good UX (I'm working on it). Pretty much every solution in this space is targeted at the developer market, not self-hosters.

So for now I'd recommend using a VPS. Your main challenge is going to be learning a lot about security. There's currently no way around that. A VPS limits the scope of damage that can be done if you get hacked. Once you've learned enough you can move to your own hardware. At that point I'd recommend setting up tunneling[0] and using either Docker or QEMU/KVM.

EDIT: I see you're already using Tailscale. That can operate as a tunnel. Basically you'd want to run a reverse proxy like Caddy (recommended) or nginx on the VPS, and point it at services running on your other devices using the IP addresses from your Tailscale network.

[0]: https://github.com/anderspitman/awesome-tunneling

Re: Ask HN: How can a total beginner start with self-hosting?

#128
You sound like you are on a good trajectory. I'd start reading up on and implementing a firewall. Start with host based, then on a router/vlan firewall. Try out wireshark and view things like a simple wget, file download, and similar. If something weird is going on record with tcpdump (see wireshark docs for flags) and you can analyze afterwards with wireshark.

I'd recommend an IPv6 firewall if you can get IPv6, that exposes much complexity (I have 2^68 IPs on a normal consumer/home ISP connection). This will allow much of the complexity of a larger IPv4 LAN.

You sound pretty ambitious, just keep in mind that everything you mention is going to create state that you are responsible for. So implement backups from day 1. Last thing anyone wants is to lose all their photos, git repos, password database, etc.

Make sure your backups are in at least two places that can't be taken out by a single theft, flood, house burning down, company going out of business, etc.

Backups aren't backups until you verify them, do so regularly, maybe the 1st of the month or something. Verify files are exactly as backed up with sha256 or similar.

Specific recommendations: ZFS for any filesystem with 2 or more disks. Digikam for photo org and tagging, in a standards compliant way. Piwigo for self hosted photos ... that can use standard tags for organization.

Re: Ask HN: How can a total beginner start with self-hosting?

#130

I do not know of an opinionated beginners guide, but would recommend browsing r/selfhosted and r/homelab a bit. Lots of these and similar questions are answered on a regular basis. Some starting points - photos: NextCloud - git: Gitea - BitWarden: Vaultwarden (even if you deploy this locally you want a SSL certificate as clients will refuse to connect otherwise) I'd suggest using official docker images to get started…

> As long as you run services locally on your Synology (assuming it supports docker) and don’t expose them to the Internet

How do I do all this while exposing it to the internet? I want to host stuff for my friends and family without putting them on a VPN to my house.

Post reply on HN