Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My Homelab Setup

bryananthonio.com

Post reply on HN
Print view View original

201–210 of 232 posts

Re: My Homelab Setup

#201

Post by bjackman »

embedding-shape wrote: post #198
bjackman wrote: post #159

Earlier quoted context omitted.

You are always gonna have some downtime in a homelab setup I think. Unless you go all in with k8s I think the best you can do is "system reboots at 4AM, hopefully all the users are asleep". (Probably a lot of the services I run don't even really support HA properly in a k8s system with replicas. E.g. taking global exclusive DB locks for the lifetime of their process)

> You are always gonna have some downtime in a homelab setup I think. Unless you go all in with k8s I think the best you can do is "system reboots at 4AM, hopefully all the users are asleep". Huh, why? I have a homelab, I don't have any downtime except when I need to restart services after changing something, or upgrading stuff, but that happens what, once every month in total, maybe once every 6 months or so per ser…

> I don't have any downtime except when I need to restart services

So... you have downtime then.

(Also, you should be rebooting regularly to get kernel security fixes).

> not sure why you'd need Kubernetes at all here

To get HA, which is what we are talking about.

> only serves to complicate

Yes, high-availability systems are complex. This is why I am saying it's not really feasible for a homelabber, unless we are k8s enthusiasts I think the right approach is to tolerate downtime.

Re: My Homelab Setup

#202

Post by jamiemallers »

acidburnNSA wrote: post #14

I have something like this, in the same case. I have beefier specs b/c I use it as a daily workstation in addition to running all my stuff. * nginx with letsencrypt wildcard so I have lots of subdomains * No tailscale, just pure wireguard between a few family houses and for remote access * Jellyfin for movies and TV, serving to my Samsung TV via the Tizen jellyfin app * Mopidy holding my music collection, serving to…

[dead]

Re: My Homelab Setup

#203

Post by sylens »

lukevp wrote: post #106
brownindian wrote: post #89

Earlier quoted context omitted.

Could also use Cloudflare tunnels. That way: 1. your 1password gets a different entry each time for . . 2. you get https for free 3. Remote access without Tailscale. 4. Put Cloudflare Access in front of the tunnel, now you have a proper auth via Google or Github.

You can also use cloudflare to create a dns record for each local service (pointed to the local IP) and just mark it as not proxied, then use Wireguard or Tailscale on your router to get VPN access to your whole network. If you set up a reverse proxy like nginx proxy manager, you can easily issue a wildcard cert using DNS validation from your NAS using ACME (LetsEncrypt). This is what I do, and I set my phone to use…

This is the way

Re: My Homelab Setup

#204

Post by avtar »

nickdichev wrote: post #168
avtar wrote: post #71

Earlier quoted context omitted.

This would be perfect with TLS. The docs don't make this clear... > tailscale serve --service=svc:web-server --https=443 127.0.0.1:8080 > http://web-server. .ts.net:443/ > |-- proxy http://127.0.0.1:8080 > When you use the tailscale serve command with the HTTPS protocol, Tailscale automatically provisions a TLS certificate for your unique tailnet DNS name. So is the certificate not valid? The 'Limitations' section do…

It works, I’m using tailscale services with https

Thanks for clarifying :) I'll try it out this weekend.

Re: My Homelab Setup

#205

Post by oarsinsync »

altano wrote: post #142
dewey wrote: post #28

Earlier quoted context omitted.

This is always annoying me with 1Password, before that I just always added subdomains but now I'm usually hosting everything behind Tailscale which makes this problem even worse as the differentiation is only the port.

In the 1Password entry go to the "website" item. To right right there's an "autofill behavior" button. Change it to "Only fill on this exact host" and it will no longer show up unless the full host matches exactly

Is this a per-item behaviour or can this be set as a global default?

I'm guessing this is 1Password 8 only, as I can't see this option in 1Password 7.

Re: My Homelab Setup

#206

Post by mhurron »

jorvi wrote: post #191
altano wrote: post #142

Earlier quoted context omitted.

In the 1Password entry go to the "website" item. To right right there's an "autofill behavior" button. Change it to "Only fill on this exact host" and it will no longer show up unless the full host matches exactly

Not entirely true. It can't seem to distinguish between ports..

because ports don't indicate a different host.

Re: My Homelab Setup

#207

Post by somehnguy »

miloschwartz wrote: post #108
QGQBGdeZREunxLe wrote: post #105

Earlier quoted context omitted.

Tunnels go through Cloudflare infrastructure so are subject to bandwidth limits (100MB upload). Streaming Plex over a tunnel is against their ToS.

Pangolin is a good solution to this because you can optionally self-host it which means you aren't limited by Cloudflare's TOS / limits.

Also achievable with Tailscale. All my internal services are on machines with Tailscale. I have an external VPS with Tailscale & Caddy. Caddy is functioning as a reverse proxy to the Tailscale hosts.

No open ports on my internal network, Tailscale handles routing the traffic as needed. Confirmed that traffic is going direct between hosts, no middleman needed.

Re: My Homelab Setup

#208

Post by kelvinjps10 »

I decided that instead of having to deal with self hosting or cloud solutions to just use local apps and sync them. Syncing Syncthing manages the syncing Passwords Keepassxc for desktop Keepassdx Mobile Note taking and documents Obsidian Neovim and PAndoc doc Photos Native gallery apps Mpv I might do a post about it

Re: My Homelab Setup

#209

Post by ryukoposting »

kelvinjps10 wrote: post #208

I decided that instead of having to deal with self hosting or cloud solutions to just use local apps and sync them. Syncing Syncthing manages the syncing Passwords Keepassxc for desktop Keepassdx Mobile Note taking and documents Obsidian Neovim and PAndoc doc Photos Native gallery apps Mpv I might do a post about it

Syncthing is the way, especially for OP's photography. My film scans spit out TIF files that can be north of 100MB. Editing those files on a network share is unpleasant. But Syncthing keeps local copies of the files, so editing a photo inside a Synthing folder is like editing a normal file on your computer - because it is.
Post reply on HN