Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CLI agents make self-hosting on a home server easier and fun

fulghum.io

Post reply on HN
Print view View original

131–140 of 570 posts

Re: CLI agents make self-hosting on a home server easier and fun

#131

Post by drnick1 »

SchemaLoad wrote: post #99
sva_ wrote: post #81

Earlier quoted context omitted.

You exposed your redis publicly? Why? Edit: This is the kind of service that you should only expose to your intranet, i.e. a network that is protected through wireguard. NEVER expose this publicly, even if you don't have admin:admin credtials.

I actually didn't know I had. At the time I didn't properly know how docker networking worked and I exposed redis to the host so my other containers could access it. And then since this was on a VPS with a dedicated IP, this made it exposed to the whole internet. I now know better, but there are still a million other pitfalls to fall in to if you are not a full time system admin. So I prefer to just put it all behind…

> but there are still a million other pitfalls to fall in to if you are not a full time system admin.

Pro tip: After you configure a new service, review the output of ss -tulpn. This will tell you what ports are open. You should know exactly what each line represents, especially those that bind on 0.0.0.0 or [::] or other public addresses.

The pitfall that you mentioned (Docker automatically punching a hole in the firewall for the services that it manages when an interface isn't specified) is discoverable this way.

Re: CLI agents make self-hosting on a home server easier and fun

#133

Post by zrail »

bakies wrote: post #123
zrail wrote: post #105

Earlier quoted context omitted.

Curious how long you've been sitting on the IP block. I've been nosing around getting an ASN to mess around with the lower level internet bones but a /24 is just way too expensive these days. Even justifying an ASN is hard, since the minimum cost is $275/year through ARIN.

Is that the minimum for an ASN? /24 is a lot of public IP space! I'd expect just to get a static IP from and ISP if I were to coloc like this

The minimum publicly routable IPv4 subnet is /24 and IPv6 is /48. IPv6 is effectively free, there are places that will lease a /48 for $8/year, whereas as far as I can tell it's multiple thousands of USD per year to acquire or lease a /24 of IPv4.

Re: CLI agents make self-hosting on a home server easier and fun

#134

Post by prima-facie »

Frotag wrote: post #108
drnick1 wrote: post #26

Earlier quoted context omitted.

I'd rather expose a Wireguard port and control my keys than introduce a third party like Tailscale. I am not sure why people are so afraid of exposing ports. I have dozens of ports open on my server including SMTP, IMAP(S), HTTP(S), various game servers and don't see a problem with that. I can't rule out a vulnerability somewhere but services are containerized and/or run as separate UNIX users. It's the way the Inter…

Speaking of Wireguard, my current topology has all peers talking to a single peer that forwards traffic between peers (for hole punching / peers with dynamic ips). But some peers are sometimes on the same LAN (eg phone is sometimes on same LAN as pc). Is there a way to avoid forwarding traffic through the server peer in this case?

Two separate WG profiles on the phone; one acting as a Proxy (which forwards everything), and one acting just as a regular VPN without forwarding.

Re: CLI agents make self-hosting on a home server easier and fun

#135

Post by Frotag »

Frotag wrote: post #108
drnick1 wrote: post #26

Earlier quoted context omitted.

I'd rather expose a Wireguard port and control my keys than introduce a third party like Tailscale. I am not sure why people are so afraid of exposing ports. I have dozens of ports open on my server including SMTP, IMAP(S), HTTP(S), various game servers and don't see a problem with that. I can't rule out a vulnerability somewhere but services are containerized and/or run as separate UNIX users. It's the way the Inter…

Speaking of Wireguard, my current topology has all peers talking to a single peer that forwards traffic between peers (for hole punching / peers with dynamic ips). But some peers are sometimes on the same LAN (eg phone is sometimes on same LAN as pc). Is there a way to avoid forwarding traffic through the server peer in this case?

I guess I'm looking for wireguard's version of STUN. And now that I know what to google for, finally found some promising leads.

https://github.com/jwhited/wgsd

https://www.jordanwhited.com/posts/wireguard-endpoint-discov...

https://github.com/tjjh89017/stunmesh-go

Re: CLI agents make self-hosting on a home server easier and fun

#136

Post by epistasis »

drnick1 wrote: post #26
simonw wrote: post #3

This posts lists inexpensive home servers, Tailscale and Claude Code as the big unlocks. I actually think Tailscale may be an even bigger deal here than sysadmin help from Claude Code at al. The biggest reason I had not to run a home server was security: I'm worried that I might fall behind on updates and end up compromised. Tailscale dramatically reduces this risk, because I can so easily configure it so my own devi…

I'd rather expose a Wireguard port and control my keys than introduce a third party like Tailscale. I am not sure why people are so afraid of exposing ports. I have dozens of ports open on my server including SMTP, IMAP(S), HTTP(S), various game servers and don't see a problem with that. I can't rule out a vulnerability somewhere but services are containerized and/or run as separate UNIX users. It's the way the Inter…

I've managed wireguard in the past, and would never do it again. Generating keys, distributing them, configuring it all...... bleh!

Never again, it takes too much time and is too painful.

Certs from Tailscale are reason enough to switch, in my opinion!

The key with successful self hosting is to make it easy and fast, IMHO.

Re: CLI agents make self-hosting on a home server easier and fun

#137

Post by appplication »

lmm wrote: post #122
buran77 wrote: post #84

Earlier quoted context omitted.

> I'd rather expose a Wireguard port and control my keys than introduce a third party like Tailscale. Ideal if you have the resources (time, money, expertise). There are different levels of qualifications, convenience, and trust that shape what people can and will deploy. This defines where you draw the line - at owning every binary of every service you use, at compiling the binaries yourself, at checking the code th…

> It's simple, you increase your attack surface, and the effort and expertise needed to mitigate that. Sure, but opening up one port is a much smaller surface than exposing yourself to a whole cloud hosting company.

Ah… I really could not disagree more with that statement. I know we don’t want to trust BigCorp and whatnot, but a single exposed port and an incomplete understanding of what you’re doing is really all it takes to be compromised.

Re: CLI agents make self-hosting on a home server easier and fun

#138

Post by epistasis »

edoceo wrote: post #68
zeroxfe wrote: post #62

Earlier quoted context omitted.

> Plex is just sugar on top of file sharing. right, like browsers are just sugar on top of curl

curl is just sugar on sockets ;)

SSH is just sugar on top of telnet and running your own encryption algorithms by hand on paper and typing in the results.

Re: CLI agents make self-hosting on a home server easier and fun

#139

Post by alpn »

drnick1 wrote: post #26
simonw wrote: post #3

This posts lists inexpensive home servers, Tailscale and Claude Code as the big unlocks. I actually think Tailscale may be an even bigger deal here than sysadmin help from Claude Code at al. The biggest reason I had not to run a home server was security: I'm worried that I might fall behind on updates and end up compromised. Tailscale dramatically reduces this risk, because I can so easily configure it so my own devi…

I'd rather expose a Wireguard port and control my keys than introduce a third party like Tailscale. I am not sure why people are so afraid of exposing ports. I have dozens of ports open on my server including SMTP, IMAP(S), HTTP(S), various game servers and don't see a problem with that. I can't rule out a vulnerability somewhere but services are containerized and/or run as separate UNIX users. It's the way the Inter…

> I'd rather expose a Wireguard port and control my keys than introduce a third party like Tailscale.

I’m working on a (free) service that lets you have it both ways. It’s a thin layer on top of vanilla WireGuard that handles NAT traversal and endpoint updates so you don’t need to expose any ports, while leaving you in full control of your own keys and network topology.

https://wireplug.org

Post reply on HN