Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CLI agents make self-hosting on a home server easier and fun

fulghum.io

Post reply on HN
Print view View original

561–570 of 570 posts

Re: CLI agents make self-hosting on a home server easier and fun

#561

Post by butvacuum »

johnisgood wrote: post #527
SchemaLoad wrote: post #524

Earlier quoted context omitted.

I run the tailscale client in it's own LXC on Proxmox. Which connects to nginx proxy manager also in it's own LXC, which then connects to Nextcloud configured with all the normal features (Passkeys, HTTPS, etc). The Nextcloud VM uses full disk encryption as well. Any one of those components might be exploitable, but to get my data you'd have to exploit all of them.

You do not need to exploit each layer because you traverse them. Tailnet access (compromised device, account, Tailscale itself) gets you to nginx. Then you only need to exploit Nextcloud. LXC isolation protects Proxmox from container escapes, not services from each other over the network. Full disk encryption protects against physical theft, not network attacks while running. And if Nextcloud has passkeys, HTTPS, and…

And, Proxmox makes it worse in this case as most people won't know or understand that proxmox's netoworking is fundamentally wrong: its configured with consistent interface naming set the wrong way.

Re: CLI agents make self-hosting on a home server easier and fun

#562

Post by mycall »

woleium wrote: post #534
mycall wrote: post #531

Earlier quoted context omitted.

You could also use ZeroTier and get similar capabilities without a third-party being a blocker.

or netbird

Interesting product here, thanks although I prefer the p2p transport layer (VL1) plus an Ethernet emulation layer (VL2) for bridging and multicast support.

Re: CLI agents make self-hosting on a home server easier and fun

#563

Post by joshvm »

JamesSwift wrote: post #498
joshvm wrote: post #273

Earlier quoted context omitted.

My home server doesn't need to be high availability, and the BIOS is set to whatever state prior to power loss. I don't have a UPS. However, we were recently hit with a telco outage while visiting family out of town. As far as I can tell there wasn't a power outage, but it took a hard reboot of the modem to get connectivity back. Frustrating because it meant no checking home automation/security and of course no acces…

As another commenter said (but got downvoted to oblivion for some reason), its not really about uptime for the homelab, its about graceful shutdown/restart. And theres well defined protocols for it (look up network ups tools, aka NUT).

> its not really about uptime for the homelab, its about graceful shutdown/restart.

These are different requirements. The issue I described was not a power outage and having a well managed UPS wouldn't have made a difference. Nothing shut down, but we lost 5G in the area and T-Mobile's modem is janky. My point is that it's another edge case that you need to consider when self hosting, because all the remote management and PDUs in the world can't save you if you can't log into the system.

Of course there's all you need is a smart plug and a script/Home Assistant routine which pings every now and again. There are enterprise versions of this, but simple and cheap works for me.

Re: CLI agents make self-hosting on a home server easier and fun

#564

Post by jmb99 »

Aurornis wrote: post #252
jmb99 wrote: post #248

Earlier quoted context omitted.

Fairly frequently, 6kVA UPSs come up for sale locally to me, for dirt cheap ( Is it perfect? No, but it's more than enough to cover most brief outages, and also more than enough to allow you to shut down everything you're running gracefully, after you used it for a couple hours. Major caveat, you'll need a 240V supply, and these guys are 6U, so not exactly tiny. If you're willing to spend a bit more money though, a s…

This is a great example of how the homelab bottomless pit becomes normalized. Rewiring the house for 240V supply and spending $400+500 to refurbish a second-hand UPS to keep the 2500W rack running for 15 minutes? And then there's the electricity costs of running a 2.5kW load, and then cooling costs associated with getting that much heat out of the house constantly. That's like a space heater and a half running consta…

Late reply I know, but I wanted to clear up that I don’t want to normalize a 2.5kW homelab. Usually when talking to people about it I refer to it as “insane.” But, having an absolutely insane amount of computer and RAM is fun (and I personally find it genuinely useful for learning, in particular in terms of engineering for massive concurrency) and I can afford the hydro, so whatever. To match the raw compute and RAM with current gen hardware, you only need maybe 500W - you’ll just be spending a shitload of money up front, instead of over time on hydro. (To match my current lab’s utilized performance, I’d need at least 2 servers, one of which with a ~threadripper 7955WX and 256GB of DDR5, and another with an Epyc 9475F and 1TB of DDR5. That would put me somewhere in the neighborhood of $35k? Ish? Costs me about $115/month to run the rack right now (cheaper than my hot tub) and cooling is free in the winter (6~7 months of the year) so the break even is loooooong term. And realistically, $100ish a month isn’t crazy, considering I self host basically everything - the only services I pay for are my VPS to run my mail server, and AWS for glacier S3 for backup-of-last-resort.

Again, not trying to normalize 2500W, most people don’t need that (and I don’t really either), but I do make good use of it.

As for “rewiring the house for 240V”, every house* in Canada and the US is delivered “split-phase” 240V (i.e. 240V with a centre tapped neutral, providing 120V between either end of the 240V phase and neutral or 240V from phase to phase), and many appliances are 240V (dryers, water heaters, stove/ranges/ovens, air conditioners). If you have a space free in your breaker panel, adding a 240V 30A circuit should cost less than $1k if you pay an electrician, and can be DIY’d for like $150 max unless you have an ancient panel that requires rare/specialty breakers or the run is very long. It’s far from the most expensive part of a homelab unless you’re running literally just a raspberry pi or something.

*barring an incredibly small exceptional percentage

Re: CLI agents make self-hosting on a home server easier and fun

#565

Post by jmb99 »

bisby wrote: post #526
jmb99 wrote: post #248

Earlier quoted context omitted.

Fairly frequently, 6kVA UPSs come up for sale locally to me, for dirt cheap ( Is it perfect? No, but it's more than enough to cover most brief outages, and also more than enough to allow you to shut down everything you're running gracefully, after you used it for a couple hours. Major caveat, you'll need a 240V supply, and these guys are 6U, so not exactly tiny. If you're willing to spend a bit more money though, a s…

I agree with you. My use case doesn't call for perfect uptime. Sounds like yours doesn't either (though you've got a pretty deep pit yourself, if 240v and generator weren't part of the sump plans and the rack just got to ride along (that's how it worked for me)). But that doesn't mean its for us to say that someone else's use case is wrong. Some people self host a nextcloud instance and offer access to it to friends…

> though you've got a pretty deep pit yourself, if 240v and generator weren't part of the sump plans and the rack just got to ride along (that's how it worked for me)

Generator was a requirement for the sump pump. My house was basically built on a swamp, so an hour in spring without it means water in the basement. Now admittedly, I spent an extra couple hundred bucks to get a 240V generator with higher capacity than strictly necessary, but it was also roughly the minimum amount of money to spend to get one that can run on gasoline or propane, which was a requirement for me. 240V to the rack cost me $45, most of that cost being the breaker (rack is right next to the panel).

> What if someone else is hosting something important on there and my power is out? My concerns are elsewhere, but there's might not be.

I host roughly a dozen services that have around 25 users at the moment, but I charge $0 for them. I make it very clear: I have a petabyte of storage and oodles of compute, feel free to use your slice, and I’ll do my best to keep everything up and available - for my own sake (and I’ve maintained over 3 nines for 8 years!). But you as a user get no guarantee of uptime or availability, ever, and while I try very hard to backup important data (onsite, offsite split to multiple locations, and AWS S3 glacier), if I lose your data, sucks to suck. So far most people are pretty happy with this arrangement.

I couldn’t possibly fathom worrying about other people’s access to my homelab during a power outage. If I wanted to care, I’d charge for access, and I’d have a standby generator, multiple WANs, a more resilient remote KVM setup, etc. But then I’d be running a business - just a really shitty one that takes tons of my time and makes me little money. And is very illegal (for some of the services I make available, at least), instead of only slightly illegal.

Re: CLI agents make self-hosting on a home server easier and fun

#566

Post by ErikBjare »

cirelli94 wrote: post #547
mtoner23 wrote: post #305

Earlier quoted context omitted.

People are way too worried about security imo. Statistically, no one is targeting you to be hacked. By the time you are important and valuable enough for your home equipment to be a target you would have hired someone else to manage this for you

Crying inside myself after a crypto miner took my VM this past week.

And mine last year

Re: CLI agents make self-hosting on a home server easier and fun

#567

Post by josecodea »

simonw wrote: post #3

This posts lists inexpensive home servers, Tailscale and Claude Code as the big unlocks. I actually think Tailscale may be an even bigger deal here than sysadmin help from Claude Code at al. The biggest reason I had not to run a home server was security: I'm worried that I might fall behind on updates and end up compromised. Tailscale dramatically reduces this risk, because I can so easily configure it so my own devi…

Great! I have looked into this and I have a few questions though...

Basically, I feel that tailscale does not make it very easy to set up services this way, and the only method I have figured out has a bit too many steps for my liking, basically:

- to expose some port to the tailnet, there needs to be a `tailscale serve` command to expose its ports

- in order for this command to run on startup and such, it needs to be made into a script that is run as a SystemD service

- if you want to do this with N services, then you need to repeat these steps N times

Is this how you do it? is there a better way?

Re: CLI agents make self-hosting on a home server easier and fun

#568

Post by josecodea »

miki123211 wrote: post #340
simonw wrote: post #3

This posts lists inexpensive home servers, Tailscale and Claude Code as the big unlocks. I actually think Tailscale may be an even bigger deal here than sysadmin help from Claude Code at al. The biggest reason I had not to run a home server was security: I'm worried that I might fall behind on updates and end up compromised. Tailscale dramatically reduces this risk, because I can so easily configure it so my own devi…

Now I wish there was some kind of global, single-network version of Tailscale... TS is cool if you have a well-defined security boundary. This is you / your company / your family, they should have access. That is the rest of the world, they should not. My use case is different. I do occasionally want to share access to otherwise personal machines around. Tailscale machine sharing sort of does what I want, but it's re…

Tailscale Funnel, no?

For the permissions, just add basic auth in the reverse proxy and choose whom to share the passwd with.

Now if you want OAuth or something like that... well tough luck, you need to set up OIDC or whatever and that's going to be taking you some time, but it still works how you want.

Re: CLI agents make self-hosting on a home server easier and fun

#569

Post by twelvedogs »

johnisgood wrote: post #345
twelvedogs wrote: post #342

Earlier quoted context omitted.

> Tailscale does not solve the "falling behind on updates" problem, it just moves the perimeter. nothing 100% fixes zero days either, you are just adding layers that all have to fail at the same time > You have also added attack surface: Tailscale client, coordination plane, DERP relays. If your threat model includes "OpenSSH might have an RCE" then "Tailscale might have an RCE" belongs there too. you still have to h…

The "layers" argument applies equally to WireGuard without Tailscale. Attacker still needs VPN exploit + vulnerable service. The difference: Tailscale adds attack vectors that do not exist with self-hosted WireGuard: account compromise, coordination plane, client supply chain, other devices on your tailnet. Those are not layers to bypass, they are additional entry points. Regardless, it is still for convenience, not…

yeah i agree, it's less secure than just wireguard + self hosted, to be honest i didn't thoroughly read your original comment

Re: CLI agents make self-hosting on a home server easier and fun

#570

Post by legojoey17 »

ibizaman wrote: post #495
legojoey17 wrote: post #219

I just got around to a fresh NixOS install and I couldn't be happier as I've been able to do practically everything via Codex while keeping things concise and documented (given it's nix, not a bunch of commands of the past). I recently had a bunch of breakages and needed to port a setup - I had a complicated k3s container in proxmox setup but needed it in a VM to fix various disk mounts (I hacked on ZFS mounts, and w…

You might be interested in checking out my project SelfHostBlocks which allows you to declaratively setup quite a few services with declarative LDAP and SSO integration with LLDAP and Authelia. Even if you don’t end up using it, it might inspire you. Also, all integrations are tested with NixOS VM tests using playwright to ensure no breakage. https://github.com/ibizaman/selfhostblocks

Cool, I'll definitely take a look! I do have a preference for container-oriented setups and do have an elaborate set of plumbing on kuberenetes at the moment.

That being said, I procrastinated on getting postgres backups working and ended up causing self-inflicted corruption, so it is nice to see you've got that setup and have thought of pretty much everything!

Post reply on HN