Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CLI agents make self-hosting on a home server easier and fun

fulghum.io

Post reply on HN
Print view View original

81–90 of 570 posts

Re: CLI agents make self-hosting on a home server easier and fun

#81

Post by sva_ »

SchemaLoad wrote: post #72
drnick1 wrote: post #26

Earlier quoted context omitted.

I'd rather expose a Wireguard port and control my keys than introduce a third party like Tailscale. I am not sure why people are so afraid of exposing ports. I have dozens of ports open on my server including SMTP, IMAP(S), HTTP(S), various game servers and don't see a problem with that. I can't rule out a vulnerability somewhere but services are containerized and/or run as separate UNIX users. It's the way the Inter…

If you expose ports, literally everything you are hosting and every plugin is an attack surface. Most of this stuff is built by single hobbiest devs on the weekend. You are also exposed to any security issues you make in your configuration. My first attempt self hosting I had redis compromised because I didn't realise I had exposed it to the internet with no password. Behind a VPN your only attack surface is the VPN…

You exposed your redis publicly? Why?

Edit: This is the kind of service that you should only expose to your intranet, i.e. a network that is protected through wireguard. NEVER expose this publicly, even if you don't have admin:admin credtials.

Re: CLI agents make self-hosting on a home server easier and fun

#82

Post by zrail »

easterncalculus wrote: post #35

Nice. This is a great start. The next steps are backups and regular security updates. The former is probably pretty easy with Claude and a provider like Backblaze, for updates I wonder if "check for security issues with my software and update anything in need" will work well (and most importantly, how consistently). Alternatively, getting the AI to threat model and perform any docker hardening measures. Then someday…

My security update system is straightforward but it took quite a lot of thought to get here.

My self hosted things all run as docker containers inside Alpine VMs running on top of Proxmox. Services are defined with Docker Compose. One of those things is a Forgejo git server along with a runner in a separate VM. I have a single command that will deploy everything along with a Forgejo action that invokes that command on a push to main.

I then have Renovate running periodically set to auto-merge patch-level updates and tag updates.

Thus, Renovate keeps me up to date and git keeps everyone honest.

Re: CLI agents make self-hosting on a home server easier and fun

#83

Post by SchemaLoad »

danpalmer wrote: post #40

There's something ironic about using Claud Code – a closed source service, that you can't self-host the hardware for, and that you can't get access to the data for – to self-host so that you can reduce your dependencies on things.

Before you had to rely on blog posts and reddit for information, something you also couldn't self host. And if you are just asking it questions and taking actions yourself, you are learning how it works to do it yourself next time.

Re: CLI agents make self-hosting on a home server easier and fun

#84

Post by buran77 »

drnick1 wrote: post #26
simonw wrote: post #3

This posts lists inexpensive home servers, Tailscale and Claude Code as the big unlocks. I actually think Tailscale may be an even bigger deal here than sysadmin help from Claude Code at al. The biggest reason I had not to run a home server was security: I'm worried that I might fall behind on updates and end up compromised. Tailscale dramatically reduces this risk, because I can so easily configure it so my own devi…

I'd rather expose a Wireguard port and control my keys than introduce a third party like Tailscale. I am not sure why people are so afraid of exposing ports. I have dozens of ports open on my server including SMTP, IMAP(S), HTTP(S), various game servers and don't see a problem with that. I can't rule out a vulnerability somewhere but services are containerized and/or run as separate UNIX users. It's the way the Inter…

> I'd rather expose a Wireguard port and control my keys than introduce a third party like Tailscale.

Ideal if you have the resources (time, money, expertise). There are different levels of qualifications, convenience, and trust that shape what people can and will deploy. This defines where you draw the line - at owning every binary of every service you use, at compiling the binaries yourself, at checking the code that you compile.

> I am not sure why people are so afraid of exposing ports

It's simple, you increase your attack surface, and the effort and expertise needed to mitigate that.

> It's the way the Internet is meant to work.

Along with no passwords or security. There's no prescribed way for how to use the internet. If you're serving one person or household rather than the whole internet, then why expose more than you need out of some misguided principle about the internet? Principle of least privilege, it's how security is meant to work.

Re: CLI agents make self-hosting on a home server easier and fun

#85

Post by dizhn »

chasd00 wrote: post #79

What I do at home is ubuntu on a cheap small computer I found on ebay. ufw blocks everything except 80, 443, and 22. Setup ssh to not use passwords and ensure nginx+letsencrypt doesn’t run as root. Then, forward 80 and 443 from my home router to the server so it’s reachable from the internet. That’s about it, now I have an internet accessible reverse proxy to surface anything running on that server. The computers on…

Put wireguard on that thing and don't expose anything on your public IP. Better yet don't have a public IP. Just port forward the wireguard IP from your router. That's it. No firewall no nothing. Not even accidental exposure.

Re: CLI agents make self-hosting on a home server easier and fun

#86

Post by SchemaLoad »

devonhk wrote: post #56
notesinthefield wrote: post #30

I find myself a bit overwhelmed with hardware options during recent explorations. Seemingly everything can handle what I want a local copy of my Bandcamp archive to stream via jellyfin. Good times we’re in but even having good sysadmin skills, I wish someone would just tell me exactly what to buy.

> I wish someone would just tell me exactly what to buy. I’ll bite. You can save a lot of money by buying used hardware. I recommend looking for old Dell OptiPlex towers on Facebook Marketplace or from local used computer stores. Lenovo ThinkCentres (e.g., m700 tiny) are also a great option if you prefer something with a smaller form factor. I’d recommend disregarding advice from non-technical folks recommending bran…

I spent so long trying to make Raspberry Pis work but they just kind of suck and everything is harder on them. I only just discovered that there are an infinite supply of these micro desktops second hand from offices/government. I was able to pick up a 9th gen intel with 16gb ram for less than the cost of a Pi 5, and it's massively more powerful.

Re: CLI agents make self-hosting on a home server easier and fun

#89

Post by zamadatix »

drnick1 wrote: post #26
simonw wrote: post #3

This posts lists inexpensive home servers, Tailscale and Claude Code as the big unlocks. I actually think Tailscale may be an even bigger deal here than sysadmin help from Claude Code at al. The biggest reason I had not to run a home server was security: I'm worried that I might fall behind on updates and end up compromised. Tailscale dramatically reduces this risk, because I can so easily configure it so my own devi…

I'd rather expose a Wireguard port and control my keys than introduce a third party like Tailscale. I am not sure why people are so afraid of exposing ports. I have dozens of ports open on my server including SMTP, IMAP(S), HTTP(S), various game servers and don't see a problem with that. I can't rule out a vulnerability somewhere but services are containerized and/or run as separate UNIX users. It's the way the Inter…

It's the way the internet was meant to work but it doesn't make it any easier. Even when everything is in containers/VMs/users, if you don't put a decent amount of additional effort into automatic updates and keeping that context hardened as you tinker with it it's quite annoying when it gets pwned.

There was a popular post less than a month ago about this recently https://news.ycombinator.com/item?id=46305585

I agree maintaining wireguard is a good compromise. It may not be "the way the internet was intended to work" but it lets you keep something which feels very close without relying on a 3rd party or exposing everything directly. On top of that, it's really not any more work than Tailscale to maintain.

Re: CLI agents make self-hosting on a home server easier and fun

#90

Post by heavyset_go »

edoceo wrote: post #67
heavyset_go wrote: post #43

Earlier quoted context omitted.

> I'd rather expose a Wireguard port and control my keys than introduce a third party like Tailscale. This is what I do. You can do Tailscale like access using things like Pangolin[0]. You can also use a bastion host, or block all ports and set up Tor or i2p, and then anyone that even wants to talk to your server will need to know cryptographic keys to route traffic to it at all, on top of your SSH/WG/etc keys. > I a…

Is a container not enough isolation? I do SSH to the host (alt-port) and then services in containers (mail, http)

Depends on your risk tolerance.

I personally wouldn't trust a machine if a container was exploited on it, you don't know if there were any successful container escapes, kernel exploits, etc. Even if they escaped with user permissions, that can fill your box with boobytraps if they have container-granted capabilities.

I'd just prefer to nuke the VPS entirely and start over than worry if the server and the rest of my services are okay.

Post reply on HN