Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Sovereign: Ansible playbooks to build and maintain your own private cloud

github.com

Post reply on HN
Print view View original

101–110 of 145 posts

Re: Sovereign: Ansible playbooks to build and maintain your own private cloud

#101

Post by gramakri »

zapt02 wrote: post #76
gramakri wrote: post #28

For those in the market to run a private cloud, please try https://cloudron.io . Our motivation is to make it simple to selfhost apps . The main advantage is that we take care of automatic updates across all the apps we package. Happy to answer any questions. Disclaimer: I am the co-founder

For anyone looking for a free alternative to this, check out: https://caprover.com/ It has many of the same apps as Cloudron and is completely free. And you can of course host your own Dockerfiles on top of it. I think the pricing for Cloudron is way off. I'm not going to spend 5 dollars per month for a DigitalOcean droplet and then 30 dollars per month to host a few open-source apps on that Droplet. Especially since…

The target audience of caprover and cloudron is totally different. caprover is a PaaS. Cloudron lets you install ready to use apps like Ghost/GitLab/Discourse/OpenVPN etc. A person who knows how to deploy using docker and more importantly has the time to setup stuff securely, does not need either of these tools. Even there, people will argue why you need docker and why you cannot run with LXC. This goes as deep as you want to go :)

As for the pricing, agreed that it might be out of reach for personal use. I think it really depends on what you get out of the product. Our target at the moment is primarily family/small businesses/IT teams. For example, a business runs website/file sharing/mail/chat/analytics/crm/forum on a droplet. The server would be around 20/month (4GB server) and then 30 on top of it. For personal use, all my stuff is on Cloudron (calendar/contacts/email/blogs/website/rss/media/docs/notes). I cannot imagine relying on a product which is 5/month for all my stuff.

Besides, having complete control and owning your data is priceless. If you don't value that, I am not sure why one would self-host at all.

Re: Sovereign: Ansible playbooks to build and maintain your own private cloud

#102

Post by gramakri »

solarkraft wrote: post #75
gramakri wrote: post #28

For those in the market to run a private cloud, please try https://cloudron.io . Our motivation is to make it simple to selfhost apps . The main advantage is that we take care of automatic updates across all the apps we package. Happy to answer any questions. Disclaimer: I am the co-founder

Interesting stack. From a first glance it seems to be a bunch of self-made Dockerfiles with an extra manifest. I like the idea, but wouldn't want anything proprietary for this relatively simple task. I suppose this product isn't for me anyway, since eventually (not that long ago) I just bit the bullet and learned the basics of Docker and docker-compose. It's not that hard, costs nothing and is pretty rewarding, imo.

Yes, that's the core of our tech stack. All our packages are opensource (git.cloudron.io). Important thing for us is to have all the docker containers read-only and have a 100% reliable backup/restore mechanism because we do automatic updates for apps to give a SaaS experience to self-hosting. We also provide SSO for users across apps (so you can add your family or colleagues in a cloudron and do access control across apps easily).

Re: Sovereign: Ansible playbooks to build and maintain your own private cloud

#103

Post by rlpb »

jnwatson wrote: post #96
dragonsh wrote: post #88

Earlier quoted context omitted.

Sovereign can be used as is to create linux container with LXD without any changes. You can create container image and than use it across your immutable infrastructure. Don’t waste time in Docker, for this purpose use lxd containers [1]. LXD containers are more secure than docker in general and provide support for unprivileged containers for over 5 years. You can use your ansible scripts to create and manage your con…

Come on. I like LXD, and I used it before docker. Docker is a standard and community. You can find prebuilt containers online and layer your own additions with a single configuration line. Don’t get me wrong, Docker has made some stupid technology decisions, but the network effect of so many adopters means that it should be the default choice for any container situation.

> ...the network effect of so many adopters means that it should be the default choice for any container situation.

People assume that just because Docker and lxd do "containers", they are somehow equivalent and it's simply a matter of choosing between the two. But they are far from equivalent. It's not a choice between two competing technologies that achieve the same goal at all.

Re: Sovereign: Ansible playbooks to build and maintain your own private cloud

#104

Post by nine_k »

dguido wrote: post #19

There are so many servers and apps being installed by Sovereign that I'm certain few would be able to keep it secure ( https://github.com/sovereign/sovereign/wiki/Software-used-by... ). The big win for the cloud is that you're paying a fraction of the cost for access to a, typically, enormous security and operations team. If you want to build software like this that allows people to self-host, you need to scale down…

These are fair points.

If I were to provide services for me and my family (or for a small company), I won't make them publicly available at all.

I would have every device connected to them over VPN (OpenVPN, WireGuard, ZeroTier). Of course it would prevent self-registration, and would take some work to distribute keys — but by definition we are a small operation, so this is manageable.

No service would ever listen on a publicly accessible IP. The machine(s) hosting that would firewall off all other incoming connections, except the VPN and SSH for admin purposes. I hope I would be able to quickly address CVEs in these two services, plus the kernel.

A setup like this is already pretty standard with AWS, but you can reproduce it almost anywhere, including your own physical box(es).

The weakest link with this setup is the client computers. So inside the VPN you still need good security practices — but the attack surface becomes much smaller, and a DDoS becomes harder to pull off.

Re: Sovereign: Ansible playbooks to build and maintain your own private cloud

#105

Post by ggregoire »

bwbmr wrote: post #49
ggregoire wrote: post #40

Earlier quoted context omitted.

> Not trying to start a Docker vs. Ansible flame war Don't worry, they serve very different purposes. You already probably know but Docker is for running applications in isolation, while Ansible is for provisioning and configuring hosts. For instance, you won't use Docker to harden sshd on your hosts but Ansible.

Are there any good resources (besides OP) for using Ansible in a home-server environment? Especially in a mixed docker + Ansible environment.

The official doc, StackOverflow and /r/ansible are good resources imo.

Re: Sovereign: Ansible playbooks to build and maintain your own private cloud

#107

Post by haolez »

As the CTO of an established company, I cannot imagine a situation where I would prefer to maintain my own infrastructure vs using managed cloud services.

If I get locked in on a specific product, it's way cheaper to redesign that around an alternative vendor than it is to maintain a private cloud (Ansible, Kubernetes and friends included).

As a nerd, I'd prefer to do things myself, but I have business needs to attend to.

Re: Sovereign: Ansible playbooks to build and maintain your own private cloud

#108

Post by S04dKHzrKT »

bwbmr wrote: post #49
ggregoire wrote: post #40

Earlier quoted context omitted.

> Not trying to start a Docker vs. Ansible flame war Don't worry, they serve very different purposes. You already probably know but Docker is for running applications in isolation, while Ansible is for provisioning and configuring hosts. For instance, you won't use Docker to harden sshd on your hosts but Ansible.

Are there any good resources (besides OP) for using Ansible in a home-server environment? Especially in a mixed docker + Ansible environment.

https://github.com/davestephens/ansible-nas

Uses ansible + docker to setup and run a home server. Its feature-set is close to that of a typical FreeNAS setup in a home environment.

Re: Sovereign: Ansible playbooks to build and maintain your own private cloud

#109

Post by crmrc114 »

tryptophan wrote: post #99
crmrc114 wrote: post #80

Dumb question maybe... but why would you not just configure this yourself on a single virt/host? Most of these services would take less than a day to configure. So many questions on why this is a good thing. Like, there are countless ways to configure your MTA and spam filtering- if you are going to have to dig through this config.. why not just roll your own? Can someone explain to me why you need ansimble for this?…

If you're the type of person that configures servers on your own time for fun, than you would likely find automating the process 'just because' to be fun as well. You do not need ansible for config of a personal server at all.

Oh cool cool, I thought I had a stroke or was missing something here. This is a cool idea in that case.

Re: Sovereign: Ansible playbooks to build and maintain your own private cloud

#110

Post by zzzeek »

dcardoza wrote: post #71
zzzeek wrote: post #70

Earlier quoted context omitted.

I run everything in containers and I spin up all the images / containers from ansible scripts. Am I doing it wrong? I didn't think these two tools were in conflict.

They do complement one another but docker has tooling that solves similar problems. Does docker-compose ( https://docs.docker.com/compose/ ) fit your needs?

I use ansible to build a machine from zero software installed on it to running multiple docker containers that also make use of various filesystem stuff on the host, as well as set up other non-docker things on the host like networking, selinux stuff, and crons. I like that ansible is not hardwired towards everything being a container.
Post reply on HN