Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Self-Hosting like it's 2025

kiranet.org

Post reply on HN
Print view View original

211–220 of 240 posts

Re: Self-Hosting like it's 2025

#211

Post by doublerabbit »

palata wrote: post #158
doublerabbit wrote: post #70

Earlier quoted context omitted.

I colocate four servers in two DCs all running FreeBSD with PF. My main host is running a jail that hosts a bHyve VM With four jails, each running their own bHyve VMs they run another FreeBSD OS allowing me to host jails for different services. Email, web and game servers. I'm not a fan of DMZ as they get messy as you then have to ensure your host is protected correctly. So I use bridges, I have two bridges an outer…

This is very interesting! Have you considered writing a blog post explaining that kind of setup? I would love that! In the meantime, thanks a lot for the insights, that's a good starting point! > I'm not a fan of DMZ as they get messy as you then have to ensure your host is protected correctly. Could you elaborate on that? Specifically in my case I would have a perimeter router to which I would connect both my server…

That sounds pretty reasonable.

While home routers tend to set their rules as outbound allow and inbound denied. My DC just provides me with a network cable to the big pond of data.

How I secure that for my home network is using my personal rig with multiple network ports.

One port acts as a public bridge. And the 3rd and 4th network ports then are then assigned to the private bridges

The 2nd port then sits in a middle bridge where it communicates to both the public and private bridge.

Re: Self-Hosting like it's 2025

#212

Post by pedantsamaritan »

nijave wrote: post #175
swizzler wrote: post #134

Earlier quoted context omitted.

I was using straight filesystem backups for a while, but I knew they could be inconsistent. Since then, I've setup https://github.com/prodrigestivill/docker-postgres-backup-lo... , which regularly dumps a snapshot to the filesystem, which regular filesystem backups can consume. The README has restore examples, too I haven't needed to tune selfhosted databases. They do fine for low load on cheap hardware from 10 years…

Inconsistent how? Postgres can recover from a crash or loss of power which is more-or-less the same as a filesystem snapshot

Getting my backup infrastructure to behave they way I'd want with filesystem snapshot (e.g. zfs or btrfs snapshot) was not trivial. (I think the hurdle was my particularity about the path prefix that was getting backed up.) write once pg_dumps could still have race conditions, but considerably fewer.

So, if you're using filesystem snapshots as source of backups for database, then I agree, you _should_ be good. the regular pgdumps is a workaround for other cases for me.

Re: Self-Hosting like it's 2025

#213

Post by nz »

candiddevmike wrote: post #85
homebrewer wrote: post #29

Earlier quoted context omitted.

Put it on a zfs dataset and back up data on the filesystem level (using sanoid/syncoid to manage snapshots, or any of their alternatives). It will be much more efficient compared to all other backup strategies with similar maintenance complexity.

Filesystem backups may not be consistent and may lose transactions that haven't made it to the WAL. You should always try to use database backup tools like pgdump.

Entire companies have been built around synchronizing the WAL with ZFS actions like snapshot and clone (i.e. Delphix and probably others). Would be cool to have `zpgdump` (single-purpose, ZFS aware equivalent).

Re: Self-Hosting like it's 2025

#214

Post by Aachen »

0xEF wrote: post #185
Aachen wrote: post #87

Earlier quoted context omitted.

Could you give an example of a guide that helped you self host a system or service by telling you how to do the security? One that shows what information would be missing from a regular setup tutorial? I'm a security consultant so this is not a problem I have. To me it seems very straightforward and like most things are secure by default (with the exceptions being notorious enough that I'd know of it), so I'm interes…

I'm not the person you asked, but if some security researcher such as yourself needs a million-dollar service to sell, I'll offer that I would pay decent money for a webapp or something where I can list all the things in my stack or project and it spits out a list of known and possible vulnerabilities that I should check default configs for, update, patch, etc. My thinking is this; if I'm willing to fork over dollars…

The CVE database is free. Or maybe NVD are the ones publishing this mapping of CVEs to software packages and versions, but either way, a site like cvedetails will give you this information. I'm less sure where you could subscribe to these for all software thingies you run (maybe cvedetails already has that)

Re: Self-Hosting like it's 2025

#215

Post by seba_dos1 »

alabastervlog wrote: post #139
seba_dos1 wrote: post #54

Earlier quoted context omitted.

"apt-get install" tends to be enough once you stop chasing latest-and-greatest and start to appreciate things just running with low maintenance more.

I only host 3rd party daemons (nothing custom) and only on my local network (plus Tailscale) so Docker’s great for handling package management and init, since I get up-to-date versions of a far broader set of services than Debian or ubuntu’s repos, clean isolation for easy management, and init/restarts are even all free. Plus it naturally documents what I need to back up (any “mounted” directories) Docker lets my OS…

> do I risk a 3rd party back port repo screwing up my system or other services, or upgrade the whole OS just to get one newer package, which comes with similar risks?

In these rare cases I usually just compile a newer deb package myself and let the package manager deal with it as usual. If there are too many dependencies to update or it's unusually complex, then it's container time indeed - but I didn't have to go there on my server so far.

Not diverging from the distro packages lets me not worry about security updates; Debian handles that for me.

Re: Self-Hosting like it's 2025

#216

Post by nijave »

auxym wrote: post #195
nijave wrote: post #170

Earlier quoted context omitted.

Rclone won't take a consistent snapshot so you either need to shutdown the thing or use some other tool to export the data first

zfs/btrfs snapshot and then rclone that snapshot?

I think that'd break deleting incremental snapshots unless you tried uploading a gigantic blob of the entire filesystem, wouldn't it?

Meaning you'd need to upload full snapshots on a fixed interval

Re: Self-Hosting like it's 2025

#218

Post by Karrot_Kream »

0xEF wrote: post #51

I love the idea of self-hosting, especially since I keep a number of very tiny websites/projects going at any given time, so resources would not really be too much of an issue for me. What stops me is security. I simply do not know enough about securing a self-hosted site on real hardware in my home and despite actively continuing to learn, it seems like the more I learn about it, the more questions I have. My identi…

This is a good concern to have. I feel like the emotional currency around self-hosting on tech forums makes too many people excited to talk about self-hosting and forget about practical things like security. Remember: defense in layers.

Things I do:

* Make sure domain WHOIS does not point to me in any way, even if that means using some silly product like "WHOIS GUARD"

* Lock down any and all SSH access. Preferably only allow key-based authentication.

* Secure the communication substrate. For me this means running a Zerotier network which all dependent services listen on. I also try to use Unix sockets for any services colocated on the same operating system and restrict the service to only listen on sockets in a directory specifically accessible by the service.

* Try to control the permission surface of any service as much as possible. Containers can be a bit heavyweight for self-hosting but make this easy. There's alternatively like bubblewrap and firejail as well.

* Make use of services like fail2ban which can automate some of the hunting of bad actors for you.

* Consider hosting a listener for external traffic outside of your infra. For redundancy, load-shedding, and for security I have an external VPS that runs haproxy before routing over Zerotier to my home infrastructure. I enforce rate limits and fail2ban at the VPS so that bad actors get stopped upstream and use none of my home compute or bandwidth. (I also am setting up some redundant caches that live on the VPS so if my home network is down, one of my services can failover.)

* Segregate data into separate databases and make sure services only have access to databases that they need. With Postgres this is really simple with virtual databases being tied to different logins. I have some services that prune databases that run in a cron-like way (but using snooze instead) and they have no outbound net access.

If your network layer is secure and your services follow least-privilege, then you should be fairly in the clear.

Re: Self-Hosting like it's 2025

#219

Post by Karrot_Kream »

the_snooze wrote: post #100
fm2606 wrote: post #72

Earlier quoted context omitted.

I'm right there with you, except at times I have thrown caution to the wind and made my sites available. My current setup is to rent a cheap $5/month VPS running nginx. I then reverse ssh from my home to the vps, with each app on a different port. It works great until my electric goes out and comes back on the apps become unavailable. I haven't gotten the restart script to work 100% of the time. But, I'd love to hear…

I do something similar with my home server, but with a WireGuard split tunnel. Much easier to set up and keep active all the time (i.e., on my phone). Nginx handles proxying and TLSing all HTTP traffic. It also enforces access rules: my services can only be reached from my home subnet or VPN subnet. Everywhere else gets a 403.

Why not just have nginx listen on the Wireguard interface itself? That way you drop all traffic coming inbound from sources not on your Wireguard network and you don't even have to send packets in response nor let external actors know you have a listener on that port.

Re: Self-Hosting like it's 2025

#220

Post by 3abiton »

Karrot_Kream wrote: post #218
0xEF wrote: post #51

I love the idea of self-hosting, especially since I keep a number of very tiny websites/projects going at any given time, so resources would not really be too much of an issue for me. What stops me is security. I simply do not know enough about securing a self-hosted site on real hardware in my home and despite actively continuing to learn, it seems like the more I learn about it, the more questions I have. My identi…

This is a good concern to have. I feel like the emotional currency around self-hosting on tech forums makes too many people excited to talk about self-hosting and forget about practical things like security. Remember: defense in layers. Things I do: * Make sure domain WHOIS does not point to me in any way, even if that means using some silly product like "WHOIS GUARD" * Lock down any and all SSH access. Preferably on…

Beside fail2ban, I also recommend endlessh. Simple yet beautiful piece of software.
Post reply on HN