Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My self-hosting infrastructure, fully automated

github.com

Post reply on HN
Print view View original

161–170 of 228 posts

Re: My self-hosting infrastructure, fully automated

#161

Post by g_p »

simonw wrote: post #2

This is very cool! Have you considered something like Tailscale so you can securely access it from outside your home? I've been thinking about spinning up my own home server that way, seeing as Tailscale makes it easy to securely access it from my phone when I'm out and about.

It's not quite the same as a VPN, but in addition to Tailscale and some of the alternatives suggested in other comments, it may be worth looking at using HTTPS client certificates.

Done right, you get a pretty simple second line of defence - you can validate the client has an appropriate certificate (running your own CA is pretty straightforward for small-scale home use or for a small group of users). Without such a certificate, users can't access the web service.

If your goal around a VPN is a second line of defence against the application's own authentication logic failing, client certificate authentication might be worth a look. If your threat model needs to cover a major issue in your web server, you might still want to stick with a VPN-based setup.

(You can of course do both, and bind services to an internal-only IP that you can only reach via a VPN, then have certificate auth on that too if you so desire)

Re: My self-hosting infrastructure, fully automated

#162

Post by mlangenberg »

simonw wrote: post #2

This is very cool! Have you considered something like Tailscale so you can securely access it from outside your home? I've been thinking about spinning up my own home server that way, seeing as Tailscale makes it easy to securely access it from my phone when I'm out and about.

I found the Tailscale Android app to take quite a big hit on my battery when used as an always-on VPN, so I use cloudflared on a VPS to create a Google authenticated tunnel to home assistant (over Tailscale).

Re: My self-hosting infrastructure, fully automated

#163

Post by marginalia_nu »

candiddevmike wrote: post #44

I enjoy reading about homelabs that aren't using kubernetes or some other scheduler and how they're doing it/what the full stack looks like. This is just another "how I installed kubernetes" thing only without any real scale behind it. There are other ways to deploy and run things, and it takes people toying around with alternatives for something unique to spring up.

My "homelab" is just debian stable, with a moratorium against containerization. Systemd keeps the services going. Updates are manual. It's a bit incredible how clean and easy such a set-up can be. Like there's almost nothing to say. It's extremely reliable and just keeps ticking.

I actually did use to have a bunch of virtualization and kubernetes and crap, but got rid of it because it ate literally half the systems' resources, in a death by a thousand containers-type of way. There was also a lot of just jank, stuff was constantly breaking and I was always trying to piece together why from half a dozen out-of-date tutorials. Felt like herding cats.

Re: My self-hosting infrastructure, fully automated

#165

Post by chaxor »

simonw wrote: post #2

This is very cool! Have you considered something like Tailscale so you can securely access it from outside your home? I've been thinking about spinning up my own home server that way, seeing as Tailscale makes it easy to securely access it from my phone when I'm out and about.

Isn't headscale a clearly better option, since it removes the need to trust and depend on external sources? It the same software essentially, but if we're talking about self hosting, headscale is just inherently better, since it actually is self hosted.

Re: My self-hosting infrastructure, fully automated

#166

Post by midasuni »

chaxor wrote: post #160
midasuni wrote: post #112

Earlier quoted context omitted.

Apt install your lamp stack Deploy your files Cronjob to apt upgrade every night Why does that need a full team? Or more than 10 minutes every few years?

Ummm I'm sorry, but I don't see how this is practically simple. Theoretically , maybe - [and I agree with the idea that there is potentially (hopefully) a paradigm shift in initial play now, with the thrust being multifaceted including companies' lack of upholding user privacy/selling you as a product, slowly increasing service charges, and lack of customer customization.] I think tis thrust towards self hosting shou…

I’ve been self hosting for over 20 years on apt based systems, aside from changing from telnet/ftp to ssh, adding in letsencrypt, very little has changed. You can still collocate your hardware, but it’s cheaper to use a generic VPS. You can host from home, but even a pi will probably cost more in electricity use than a $3/month vps.

Backups are far easier now as you use a VM provider like linode, digital ocean, even lightsail, which will schedule snapshots. If you run your own hardware then mysqldump and restore to your backup server is a small shellscript and cronjob. Disk encryption is handled by your OS.

LAMP was trivial in 2002, it still is. You can use nginx or postgres instead of apache and mysql, but it’s broadly the same.

If you want to make your site complex and dependent on thousands of JavaScript libraries and frameworks which change every year or two, that’s fine, but you don’t need to, it’s a choice, one which adds complexity. If you want five nines or absolute guarentee of not failing, you need to think more about replication than just a nightly snapshot, but that’s not a problem solved with thinks like kubernetes.

If you want to scale to millions of concurrent users pulling terabytes, sure, don’t self host from your DSL on a pi. If you want to serve a personal site for hosting bits of stuff, it’s not hard.

Re: My self-hosting infrastructure, fully automated

#167

Post by zrail »

LilBytes wrote: post #20
616c wrote: post #10

Pretty sweet. I have been called a devops person by others around me (and I am hesitant to proudly identify as one) because this homelab is more impressive and modular than a lot of stuff I have seen colleagues and I put together for professional stuff. Well done. I was not aware of the Cloudflare solution. Is this something someone can use, _with_ their Cloudflare Access offering, for personal dev/lab envs without b…

I set up Tailscale a little over a week ago, it boggled my mind how easy it was. I'm using it for personal use at the moment and I'm considering changing to a paid user to my friends and family can access Emby over the internet. I did have a few dramas getting in to work for my LxC environments but nothing a quick Google resolved for me.

Fwiw you probably don't need to pay for tailscale for that. You can just have them set up their own single user tailscale accounts and then share your Emby node with their account.

https://tailscale.com/kb/1084/sharing/

Re: My self-hosting infrastructure, fully automated

#168

Post by k8sToGo »

cyfex wrote: post #102

I always found the hurdle with self-hosting to be maintaining, not the initial setup. Things like upgrading, in order to keep getting security fixes, and verifying everything works after the upgrade, are what has taken the most effort and time in the past for me. This looks like a great setup by the author, but difficult to maintain in the long run without significant time investment.

Automating it away (Ansible and Docker) is a good way to reduce overhead. I barley invest any time in maintaining my infrastructure.

Re: My self-hosting infrastructure, fully automated

#169

Post by nyellin »

dijit wrote: post #154
nyellin wrote: post #141

Earlier quoted context omitted.

I don't know how you implemented it, but the big innovation of kubernetes was doing this with declarative inputs and using control loops for reconciliation instead of edge triggered changes. It might not matter on a small scale, but on a large scale that's what makes it robust. It's also not trivial to implement a distributed version of this in house at scale. At the very least you need something like etcd at the cor…

The way we did it is that we registered to a centralised “name” service which was an in memory database. Failure to register to the name service leads to registration towards the next name service in the list, we ran three- so there were two spares, the library would then keep trying to register to the first name service, this would be our reconciliation loop. When you request a service you request “traits” through t…

Very cool and thanks for sharing.

Re: My self-hosting infrastructure, fully automated

#170

Post by ryandrake »

marginalia_nu wrote: post #163
candiddevmike wrote: post #44

I enjoy reading about homelabs that aren't using kubernetes or some other scheduler and how they're doing it/what the full stack looks like. This is just another "how I installed kubernetes" thing only without any real scale behind it. There are other ways to deploy and run things, and it takes people toying around with alternatives for something unique to spring up.

My "homelab" is just debian stable, with a moratorium against containerization. Systemd keeps the services going. Updates are manual. It's a bit incredible how clean and easy such a set-up can be. Like there's almost nothing to say. It's extremely reliable and just keeps ticking. I actually did use to have a bunch of virtualization and kubernetes and crap, but got rid of it because it ate literally half the systems'…

Yea I think I missed the whole web-complexity bus and am probably out of touch, but I still don’t get the use case for docker and containers and kubernets and and orchestration and all that stuff, just for a simple home setup. I serve a tiny web site, email, backups, a NAS and a few other internet services for my family, and my “stack” is vanilla Debian Stable.

Maybe I don’t know what I don’t know, but my setup works for me and I don’t really have any problems maintaining it so I figure why add all the complexity?

It always feels weird to see threads and threads of people talking about dozens of software programs I’ve never even heard of, let alone used. Maybe I’m living in the past but to me a “stack” is: OS, server, database, application. Like LAMP. Wonder when this changed!

It makes me curious about what kinds of stuff people do in their home networks that I never even considered doing.

Post reply on HN