Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Server Setup Basics for Self Hosting

becomesovran.com

Post reply on HN
Print view View original

31–40 of 75 posts

Re: Server Setup Basics for Self Hosting

#31

Post by ftrobro »

Semaphor wrote: post #27
erros wrote: post #20

You may want to update this post to disable password authentication, and thus you'll no longer need to install fail2ban. An important goal is to tighten your attack surface, not expand it. At this point you will still have an exposed SSHd server, so I'd recommend throwing the server under tailscale. You can setup the SSHd listener to use your tailscale IP or setup tailscale for SSH via ACLs ( https://tailscale.com/ta…

> You may want to update this post to disable password authentication Probably not, as that’s one of the first things they do. That said, I feel like all this fail2ban stuff is very much cargo culting in the selfhosting community. I’ve had my VPS SSH server on port 22 with no fail2ban for slightly over a decade, exposed to the public internet (home server is behind tailscale, VPS hosts the stuff I always want accessi…

This and possibly unknown similar flaws is a good reason for not advertising ssh:

https://arstechnica.com/security/2024/07/regresshion-vulnera...

Re: Server Setup Basics for Self Hosting

#32

Post by jw_cook »

At the end of the article, there's a link to a script[1] that does the steps covered in the article.

That got me thinking: how do other self-hosters/homelabbers here go about automating their server setups? None/purely manual? One big shell script? Multiple scripts wrapped in a Makefile (or justfile, or other command runner)? More enterprisey provisioning/automation tools like Ansible, Puppet, etc.?

[1] https://git.sovbit.dev/Enki/sovran-scripts

Re: Server Setup Basics for Self Hosting

#33

Post by jmathai »

jw_cook wrote: post #32

At the end of the article, there's a link to a script[1] that does the steps covered in the article. That got me thinking: how do other self-hosters/homelabbers here go about automating their server setups? None/purely manual? One big shell script? Multiple scripts wrapped in a Makefile (or justfile, or other command runner)? More enterprisey provisioning/automation tools like Ansible, Puppet, etc.? [1] https://git.s…

One big shell script has worked really well for me. One project on AWS ran the script when new EC2 instances with a particular tag/label were spun up and that's how we scaled horizontally.

What's nice about is that it doesn't require any specialized knowledge beyond bash - and that's something which is pretty easy to learn and great to know. It also attracts, IMO, the type of developers who avoid chasing new trends.

Re: Server Setup Basics for Self Hosting

#34

Post by atoav »

jw_cook wrote: post #32

At the end of the article, there's a link to a script[1] that does the steps covered in the article. That got me thinking: how do other self-hosters/homelabbers here go about automating their server setups? None/purely manual? One big shell script? Multiple scripts wrapped in a Makefile (or justfile, or other command runner)? More enterprisey provisioning/automation tools like Ansible, Puppet, etc.? [1] https://git.s…

For my use cases I found that just having a (updated) note with the things I would usually do works best. This is because I would not deploy everything anywhere and manually being aware of each step instead of hiding it within a script is somewhat a feature (e.g. you can easily insert a custom extra step etc).

If I would do basically the same over and over I'd probably go with a script, ansible cookbook or similar, but as of now the manual route is totally fine.

Re: Server Setup Basics for Self Hosting

#35

Post by bpye »

jw_cook wrote: post #32

At the end of the article, there's a link to a script[1] that does the steps covered in the article. That got me thinking: how do other self-hosters/homelabbers here go about automating their server setups? None/purely manual? One big shell script? Multiple scripts wrapped in a Makefile (or justfile, or other command runner)? More enterprisey provisioning/automation tools like Ansible, Puppet, etc.? [1] https://git.s…

I use NixOS on every machine I have running Linux. My config for every machine is in a git repo, and it is super easy to deploy changes via ssh. It took some work to get started - but I would never go back.

Re: Server Setup Basics for Self Hosting

#36

Post by Jedd »

jw_cook wrote: post #32

At the end of the article, there's a link to a script[1] that does the steps covered in the article. That got me thinking: how do other self-hosters/homelabbers here go about automating their server setups? None/purely manual? One big shell script? Multiple scripts wrapped in a Makefile (or justfile, or other command runner)? More enterprisey provisioning/automation tools like Ansible, Puppet, etc.? [1] https://git.s…

Most of my server configuration is defined by Saltstack recipes.

Most of my actual tools now are running in docker via Nomad.

Re: Server Setup Basics for Self Hosting

#37

Post by dingaling »

Semaphor wrote: post #27
erros wrote: post #20

You may want to update this post to disable password authentication, and thus you'll no longer need to install fail2ban. An important goal is to tighten your attack surface, not expand it. At this point you will still have an exposed SSHd server, so I'd recommend throwing the server under tailscale. You can setup the SSHd listener to use your tailscale IP or setup tailscale for SSH via ACLs ( https://tailscale.com/ta…

> You may want to update this post to disable password authentication Probably not, as that’s one of the first things they do. That said, I feel like all this fail2ban stuff is very much cargo culting in the selfhosting community. I’ve had my VPS SSH server on port 22 with no fail2ban for slightly over a decade, exposed to the public internet (home server is behind tailscale, VPS hosts the stuff I always want accessi…

fail2ban is great for reducing clutter in logs. When I'm trying to debug something using auth.log I don't want to sift through 800 attempts by some IP to SSH in as root.

It gives just enough info about the origin and nature of attempted intruders without overwhelming detail.

Re: Server Setup Basics for Self Hosting

#39

Post by cassianoleal »

yjftsjthsd-h wrote: post #19
dsissitka wrote: post #12

Earlier quoted context omitted.

This is one of those things I like to verify: david@desktop:~$ nmap -p 22 --script ssh-auth-methods becomesovran.com Starting Nmap 7.92 ( https://nmap.org ) at 2024-08-25 23:31 EDT Nmap scan report for becomesovran.com (162.213.255.209) Host is up (0.066s latency). rDNS record for 162.213.255.209: server1.becomesovran.com PORT STATE SERVICE 22/tcp open ssh | ssh-auth-methods: | Supported authentication methods: | pub…

I've just been doing ssh -v localhost echo 2>&1 | grep continue (obviously replacing "localhost" with whatever server you want, and you can put anything you want where "echo" is but that's the best no-op I've come up with)

The best no-op, if there is such a thing, is probably `:` or `true`.

Re: Server Setup Basics for Self Hosting

#40

Post by cassianoleal »

ozr wrote: post #17
crdrost wrote: post #15

Qq, do people doing their own server setup like this use containerization at all? When I looked at it, it was like “yeah you can run Docker or k3s,” and I think Hashicorp had their own version, but it seemed like folks didn't really bother? Also like setting up virtual networks among VPSes seemed like it required advanced wizardry.

> do people doing their own server setup like this use containerization at all? Depends on what you're deploying, really. If it's one Go service per host, there's no real need. Just a unit file and the binary. Your deployment scheme is scp and a restart. For more complicated setups, I've used docker compose. > Also like setting up virtual networks among VPSes seemed like it required advanced wizardry. Another 'it dep…

There’s rarely, if ever, a _need_ for containerisation. Even for a single static binary though, there are benefits like network and filesystem segregation, resource allocation, …
Post reply on HN