Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CLI agents make self-hosting on a home server easier and fun

fulghum.io

Post reply on HN
Print view View original

271–280 of 570 posts

Re: CLI agents make self-hosting on a home server easier and fun

#271

Post by johnisgood »

Jtsummers wrote: post #19
ryandrake wrote: post #13

Earlier quoted context omitted.

Maybe I'm dumb, but I still don't quite understand the value-add of Tailscale over what Wireguard or some other VPN already provides. HN has tried to explain it to me but it just seems like sugar on top of a plain old VPN. Kind of like how "pi-hole" is just sugar on top of dnsmasq, and Plex is just sugar on top of file sharing.

I think you answered the question. Sugar. It's easier than managing your own Wireguard connections. Adding a device just means logging into the Tailscale client, no need to distribute information to or from other devices. Get a new phone while traveling because yours was stolen? You can set up Tailscale and be back on your private network in a couple minutes. Why did people use Dropbox instead of setting up their own…

Yeah, but "people" here are alleged software engieners. It is quite disheartening.

Re: CLI agents make self-hosting on a home server easier and fun

#272

Post by [deleted] »

heavyset_go wrote: post #90
edoceo wrote: post #67

Earlier quoted context omitted.

Is a container not enough isolation? I do SSH to the host (alt-port) and then services in containers (mail, http)

Depends on your risk tolerance. I personally wouldn't trust a machine if a container was exploited on it, you don't know if there were any successful container escapes, kernel exploits, etc. Even if they escaped with user permissions, that can fill your box with boobytraps if they have container-granted capabilities. I'd just prefer to nuke the VPS entirely and start over than worry if the server and the rest of my s…

[deleted]

Re: CLI agents make self-hosting on a home server easier and fun

#273

Post by joshvm »

JamesSwift wrote: post #160
thrownawaysz wrote: post #126

I went down the self host route some years ago but once critical problems hit I realized that beyond a simple NAS it can be a very demanding hobby. I was in another country when there was a power outage at home. My internet went down, the server restart but couldn't reconnect anymore because the optical network router also had some problems after the power outage. I could ask my folks to restart, and turn on off thin…

Well, its not a bottomless pit really. Yes you need a UPS. That’s basically it though.

My home server doesn't need to be high availability, and the BIOS is set to whatever state prior to power loss. I don't have a UPS. However, we were recently hit with a telco outage while visiting family out of town. As far as I can tell there wasn't a power outage, but it took a hard reboot of the modem to get connectivity back. Frustrating because it meant no checking home automation/security and of course no access to the servers. I'm not at a point where my homelab is important enough that I would invest in a redundant WAN though.

I've also worked in environments where the most pragmatic solution was to issue a reboot periodically and accept the minute or two of (external) downtime. Our problem is probably down to T-Mobile's lousy consumer hardware.

Re: CLI agents make self-hosting on a home server easier and fun

#274

Post by johnisgood »

danpalmer wrote: post #103
SchemaLoad wrote: post #83

Earlier quoted context omitted.

Before you had to rely on blog posts and reddit for information, something you also couldn't self host. And if you are just asking it questions and taking actions yourself, you are learning how it works to do it yourself next time.

Or you could read man pages, ask people for help, read books... all of which are more closely aligned with self-hosting than outsourcing the whole process. I agree you could use LLMs to learn how it works, but given that they explain and do the actions, I suspect the vast majority aren't learning anything. I've helped students who are learning to code, and very often they just copy/paste back and forth and ignore the…

That would be ideal, but there are software engineers who use Tailscale, so I think our expectations are too high.

Re: CLI agents make self-hosting on a home server easier and fun

#275

Post by johnisgood »

appplication wrote: post #137
lmm wrote: post #122

Earlier quoted context omitted.

> It's simple, you increase your attack surface, and the effort and expertise needed to mitigate that. Sure, but opening up one port is a much smaller surface than exposing yourself to a whole cloud hosting company.

Ah… I really could not disagree more with that statement. I know we don’t want to trust BigCorp and whatnot, but a single exposed port and an incomplete understanding of what you’re doing is really all it takes to be compromised.

Same applies to Tailscale. A Tailscale client, coordination plane vulnerability, or incomplete understanding of their trust model is also all it takes. You are adding attack surface, not removing it.

If your threat model includes "OpenSSH might have an RCE" then "Tailscale might have an RCE" belongs there too.

If you are exposing a handful of hardened services on infrastructure you control, Tailscale adds complexity for no gain. If you are connecting machines across networks you do not control, or want zero-config access to internal services, then I can see its appeal.

Re: CLI agents make self-hosting on a home server easier and fun

#276

Post by heavyset_go »

appplication wrote: post #137
lmm wrote: post #122

Earlier quoted context omitted.

> It's simple, you increase your attack surface, and the effort and expertise needed to mitigate that. Sure, but opening up one port is a much smaller surface than exposing yourself to a whole cloud hosting company.

Ah… I really could not disagree more with that statement. I know we don’t want to trust BigCorp and whatnot, but a single exposed port and an incomplete understanding of what you’re doing is really all it takes to be compromised.

Someone would need your 256-bit key to do anything to an exposed Wireguard port.

Re: CLI agents make self-hosting on a home server easier and fun

#277

Post by johnisgood »

SchemaLoad wrote: post #155
appplication wrote: post #137

Earlier quoted context omitted.

Ah… I really could not disagree more with that statement. I know we don’t want to trust BigCorp and whatnot, but a single exposed port and an incomplete understanding of what you’re doing is really all it takes to be compromised.

Even if you understand what you are doing, you are still exposed to every single security bug in all of the services you host. Most of these self hosted tools have not been through 1% of the security testing big tech services have.

Now you are exposed to every security bug in Tailscale's client, DERP relays, and coordination plane, plus you have added a trust dependency on infrastructure you do not control. The attack surface did not shrink, it shifted.

Re: CLI agents make self-hosting on a home server easier and fun

#278

Post by BatteryMountain »

simonw wrote: post #3

This posts lists inexpensive home servers, Tailscale and Claude Code as the big unlocks. I actually think Tailscale may be an even bigger deal here than sysadmin help from Claude Code at al. The biggest reason I had not to run a home server was security: I'm worried that I might fall behind on updates and end up compromised. Tailscale dramatically reduces this risk, because I can so easily configure it so my own devi…

Tailscale is a good first step, but its best to configure wireguard directly on your router. You can try headscale but it seems to be more of a hobby project - so native wireguard is the only viable path. Most router OS's supports wireguard these days too. You can ask claude to sanity check your configuration.

Re: CLI agents make self-hosting on a home server easier and fun

#279

Post by BatteryMountain »

drnick1 wrote: post #26
simonw wrote: post #3

This posts lists inexpensive home servers, Tailscale and Claude Code as the big unlocks. I actually think Tailscale may be an even bigger deal here than sysadmin help from Claude Code at al. The biggest reason I had not to run a home server was security: I'm worried that I might fall behind on updates and end up compromised. Tailscale dramatically reduces this risk, because I can so easily configure it so my own devi…

I'd rather expose a Wireguard port and control my keys than introduce a third party like Tailscale. I am not sure why people are so afraid of exposing ports. I have dozens of ports open on my server including SMTP, IMAP(S), HTTP(S), various game servers and don't see a problem with that. I can't rule out a vulnerability somewhere but services are containerized and/or run as separate UNIX users. It's the way the Inter…

Which router OS are you using? I have openwrt + daily auto updates configure with a couple of packages blacklisted that I manually update now & then.

Re: CLI agents make self-hosting on a home server easier and fun

#280

Post by BatteryMountain »

ryandrake wrote: post #13
philips wrote: post #5

Earlier quoted context omitted.

I agree! Before Tailscale I was completely skeptical of self hosting. Now I have tailscale on an old Kindle downloading epubs from a server running Copyparty. Its great!

Maybe I'm dumb, but I still don't quite understand the value-add of Tailscale over what Wireguard or some other VPN already provides. HN has tried to explain it to me but it just seems like sugar on top of a plain old VPN. Kind of like how "pi-hole" is just sugar on top of dnsmasq, and Plex is just sugar on top of file sharing.

Setting up wireguard manually can be a pain in the butt sometimes. Tailscale makes it super easy but then your info flows through their nodes.
Post reply on HN