Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Start Self Hosting

rohanrd.xyz

Post reply on HN
Print view View original

271–280 of 625 posts

Re: Start Self Hosting

#271

Post by throwaway684936 »

axlee wrote: post #268
throwaway684936 wrote: post #267

Not quite self- hosting , but in the same spirit I've slowly been working on a simple local archival system for anything I don't want to lose. It's changed my life. Even across years of content, it's required less storage space than I expected. The more I archive, the less I need to rely on online search engines or worry about linkrot. It's also helped me cut down on how many tabs I keep open in fear of losing inform…

What do you use to organize all of this unstructured data in a way that is searchable and retrievable?

It's somewhat structured; I use both broad categories and a tag system. I can also add additional comment text to archived pages. It's all patched together with shell scripts and some Lua (since that's what I'm familiar with). `ripgrep` is the utility used for searching. It's fast enough for me even when I don't use any kind of category filtering, but I have a beefy computer and use NVMe drives, so YMMV.

Re: Start Self Hosting

#272

Post by hosteur »

egberts1 wrote: post #203
rsync wrote: post #140

Earlier quoted context omitted.

I'm not sure I understand what you're describing ... A slug should not need to be dynamic nor should it be complicated in any way ... in fact, it is one of the simpler systems I have ever deployed ...

Does it do Suricata, Zeek, Snort, Transparent Squid (with valid signed CA cert), and a furtive SSH port in which to monitor and API to block ports?

I think all those are anti-features on a network slug. As I understand it, the device is intentionally simple because it is there to ensure some misconfiguration cannot expose some port that should not be exposed.

I have implemented firewalls similar to this in the past. They typically had three network interfaces. Two of them were configured as bridges and then I use ebtables/iptables to filter traffic flowing through. These two interfaces would have no IP address and would not be visible on a traceroute, etc.

The third interface would only be connected to a separate admin network. Or it might not even be plugged in. In the latter case, the admin needing to change anything on the device would have to be physically present and bring a "crossover" ethernet cable and plug their laptop directly into the third NIC of the firewall. From there, they would be able to ssh into the firewall and change config.

Re: Start Self Hosting

#273

Post by rsync »

egberts1 wrote: post #203
rsync wrote: post #140

Earlier quoted context omitted.

I'm not sure I understand what you're describing ... A slug should not need to be dynamic nor should it be complicated in any way ... in fact, it is one of the simpler systems I have ever deployed ...

Does it do Suricata, Zeek, Snort, Transparent Squid (with valid signed CA cert), and a furtive SSH port in which to monitor and API to block ports?

A network slug does not have an IP address. You cannot connect to it over the network. I'm not sure you understand what the device is and what it does.

Let me give you an example - I have a "port 22 slug" and what it does is block all traffic of all kinds except for TCP22. That's it. It does nothing else and it does it transparently without having an IP address of its own. If I wanted to reconfigure it, I would connect with a serial console.

Make sense ?

Re: Start Self Hosting

#274

Post by buzzert »

teekert wrote: post #213
buzzert wrote: post #194

Earlier quoted context omitted.

> Btw, a nice podcast on Selfhosting Ironically, not self-hosted (served from fireside.fm).

In the podcast they talk a lot about when to self host. Sometimes it makes sense, sometimes it doesn't. For example this podcast's community is on Discord, but for their other podcasts they maintain a Matrix server. It's interesting to hear them talk about the joys and pains that both solutions bring. I used to run an email server from my basement, now I also know that that is not something I want to self host anymor…

Ah yeah, I figured it was for a good reason. I just thought it was funny.

Re: Start Self Hosting

#275

Post by hosteur »

rsync wrote: post #85
blenderdt wrote: post #35

Self hosting is hard. You need to take care of security, backups, software updates, software installation and so on. Even on something like a QNAP (which can be compared to managed hosting) this can be hard. Flip the wrong switch and you expose something to the world. Missed a security update: your device is now vulnerable. While I host a lot of things myself I can understand self hosting is not for everyone.

"Flip the wrong switch and you expose something to the world." One strategy for dealing with accidental misconfigurations is to employ a "network slug"[1]: "A Network Slug, or "Slug", is a transparent layer 2 firewall running on a device with only two interfaces. ... The purpose of a Slug is to reinforce a security policy or to block uninentional leaks of information." [1] https://john.kozubik.com/pub/NetworkSlug/tip…

I have never head this idea described in text before. However, I have made firewalls this way for decades. They were typically for stuff that ran in a datacenter so it would be a 1U server with three NICs.

I would really like to make such devices for home or office use. What would be a good device to use for this? Unfortunately, RaspberryPIs do not come with 2 or 3 NICs. Any recommended alternatives?

Re: Start Self Hosting

#276

Post by pkulak »

throwaway894345 wrote: post #92
pkulak wrote: post #79

Earlier quoted context omitted.

We used to host our own software. It was called an application and it ran on your personal computer. We just need that, but running on some appliance instead, like a NAS. Package the service up in something like docker-compose, have a way to sell it, install it, update it and support it. Synology is pretty close with their Docker support, but still pretty far.

You also need stuff like networking, TLS/certs, and DNS which aren't easily packaged, at least not in a way that doesn't require you to make sketchy changes on every client device.

Something like Cloudflare Argo tunneling would work great for this. No certs at all for the user to mess around with, it terminated on the public internet, not in your house.

Re: Start Self Hosting

#277

Post by ziml77 »

gcommer wrote: post #234

Lots of good points about the challenges of self-hosting throughout this thread, especially maintenance, security, and time-investment. Here's my solution to all of them: Invest in your common infra. Docker provides stable images configured primarily with env vars. I have a docker-compose host with logging/monitoring/alerting. All service-specific files are mounted from a NAS that has backups. All network access is c…

But then you're adding even more parties to trust as it's often the case that Docker images are not provided by the same people that are maintaining the project.

Re: Start Self Hosting

#278

Post by louison11 »

pjerem wrote: post #210
louison11 wrote: post #191

This article is a bit delusional and oblivious to market dynamics. 1. Privacy: Self hosting is not necessarily more private than cloud services. The security of self hosted services is only as good as the effort put into maintaining it. Who do you think invests more in security: the giant corporation or a free open source project? Even if the project is well maintained, there are many ways your server can be compromi…

1. I don’t understand why you conflate security with privacy. Or to be more precise, it depends on your threat model. A badly secured self hosting will make yourself vulnerable to targeted attacks over your privacy. While it’s an issue you should consider, those attacks are pretty unlikely. However traditional cloud services will harvest every bit of what they get about you with a frightening efficiency but they’ll n…

I think there needs to be clarity about what is harvested and how. Most centralized services actually respect people’s privacy to the extent that they’re not asked to infringe it by law order.

Most major tech cos have encryption at rest and highly regulated access checks. It’s also not clear that they actually do harvest every bit of data they can. They might for the purpose of better UX within the service, but Google ads doesn’t collaborate with gmail or Google photos for example. There are, however, botnets all around the world scanning the web for security flaws.

This is why, in this sense, I argue that most people are actually better off using a safe, centralized service with encryption than try to reinvent the wheel at home and be more exposed.

Re: Start Self Hosting

#279

Post by pSYoniK »

Self hosting seemed so very daunting up until a year or so ago. I decided to give it a shot while struggling to find a way to keep my notes. OneNote isn't good (no Linux support), wasn't a fan of Evernote, Nuclino was crawling on my old laptop and I ended up finding BookStackApp.

This led me to find a cheap VPS, install it using the install script and then figure stuff out from there. It led me to setting up a home server and working my way through the entire setup - format and mount drives, automate backups, automate hdd health checks, setup smb, docker, traefik, emby and so on.

At this point I'm looking at experimenting with Proxmox as my server is overkill (it also made me realize how few resources are used in these setups... we end up needing 2-3000$ systems to just run an OS... which is absolutely ridiculous). Linux showed me that in order to do any meaningful work you don't need a 3k machine. In any case, I'm in the process of arranging ALL my notes in order and I plan on publishing a guide that walks a user through the setup step by step.

I know people are talking about a lot of the complexities, but you can always share your knowledge. Help someone setup an old linux box to use as an smb nas... get them to install jellyfin or emby or plex on it and even there you have already massively helped them in the right direction. I think it's our responsibility to share our knowledge and empower people to migrate or at least understand what's involved.

Re: Start Self Hosting

#280

Post by lnxg33k1 »

kodah wrote: post #160
Hendrikto wrote: post #137

Earlier quoted context omitted.

> SystemD is complicated for a layperson Is it? It has clean and logical abstractions, and consistency. Services depending in each other isn‘t complex or difficult to understand. I suspect that a nice GUI would make systemd quite usable for non-expert users. BTW: It‘s called ”systemd“: > Yes, it is written systemd, not system D or System D, or even SystemD. And it isn't system d either. [0] [0]: https://www.freedeskt…

> Is it? It has clean and logical abstractions, and consistency. Services depending in each other isn‘t complex or difficult to understand. For a technologist or engineer, yes. For a layperson , no. The average consumer who desires privacy is probably neither a technologist or engineer, so the longterm target is something that just works . Laypeople also aren't going to entertain the kind of pedantry that is systemd…

I think it has come the time where the society starts to advance without caring about laypeople, if some folks can learn it, if there is documentation, then we can just go on without caring about who doesn't know how to use it, because that's fixable. And I speak considering the German government who had to pull back from Linux because employee didn't know how to use it

Let's start treating tech as the world treats everything else: Ignorance is not a justification

Post reply on HN