21–30 of 75 posts
Tailscale https://tailscale.com/> can remove the need to open port 22 to the world, but I wouldn't rely on it unless your VPS provider has a way to access the server console in case of configuration mistakes.
Earlier quoted context omitted.
I'm a bit sceptical of the choice of port 2222 as an alternative. At that point you might as well leave 22, but otherwise it's a good intro. If you're serious about starting post the sections into [insert AI service name] and start asking questions.
Anything other than 22 is an improvement in just the reduced log volume.
So... about docker, did they backtrack on their licensing landgrab? About a year ago I swear everyone was going to podman, but in the last few months I see nothing but docker references. Podman is supposed to be drop-in. Well, it was advertised. I haven't touched anything in six months.
I think podman is more secure and simpler, but not as ergonomic to have locally (it’s not quite a drop in for docker. No real docker compose support for example)
Podman is the default for k8s last I heard
Great post! I (relatively) recently switched my primary home server over to NixOS and am now a huge fan of it as a distribution for self-hosting. Here is how setting this all up would like in NixOS (modulo some details & machine-specific configuration). It's { networking = { # Server hostname hostName = "myserver"; # Firewall firewall = { enable = true; allowedTCPPorts = [ 80 443 2222 ]; }; }; # Users users.users = {…
+1 for NixOS. Amazing for self-hosting and everything-management. Getting into it has a learning curve, but it's honestly so much easier in a lot of ways, too.
I recently tried to get into NixOS for the sake of learning something new. Struggling to find a proper reason to use this as a personal daily-driver.
So... about docker, did they backtrack on their licensing landgrab? About a year ago I swear everyone was going to podman, but in the last few months I see nothing but docker references. Podman is supposed to be drop-in. Well, it was advertised. I haven't touched anything in six months.
I use it and prefer it, much so. Mostly because of rootless (I know docker has made attempts to improve this in the last year or so), not futzing with my iptables and a better handling of pushing images between hosts (it's been over a year since I touched any of that infra, I just remember it being more of hassle with docker which took a "our way or no way" approach).
The biggest issue I have with Podman is the pace of its improvement against the rate of Debian releases!
Qq, do people doing their own server setup like this use containerization at all? When I looked at it, it was like “yeah you can run Docker or k3s,” and I think Hashicorp had their own version, but it seemed like folks didn't really bother? Also like setting up virtual networks among VPSes seemed like it required advanced wizardry.
But I'm also one of those weirdos that does all of their development in a VM. I might be a tiny bit paranoid.
> Also like setting up virtual networks among VPSes seemed like it required advanced wizardry.
Did you try Nebula? Once you get the hang of it it's pretty simple.
You may want to update this post to disable password authentication, and thus you'll no longer need to install fail2ban. An important goal is to tighten your attack surface, not expand it. At this point you will still have an exposed SSHd server, so I'd recommend throwing the server under tailscale. You can setup the SSHd listener to use your tailscale IP or setup tailscale for SSH via ACLs ( https://tailscale.com/ta…
Probably not, as that’s one of the first things they do.
That said, I feel like all this fail2ban stuff is very much cargo culting in the selfhosting community. I’ve had my VPS SSH server on port 22 with no fail2ban for slightly over a decade, exposed to the public internet (home server is behind tailscale, VPS hosts the stuff I always want accessible from everywhere). Bots try it, they fail, the end. Maybe I’m missing something, but I have yet to find a good reason for the added complexity.
I recommend checking out Caddy https://caddyserver.com/ >, which replaces both Nginx and Certbot in this setup. Tailscale https://tailscale.com/ > can remove the need to open port 22 to the world, but I wouldn't rely on it unless your VPS provider has a way to access the server console in case of configuration mistakes.
[1] I'm DevOps there! ;)