Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CLI agents make self-hosting on a home server easier and fun

fulghum.io

Post reply on HN
Print view View original

311–320 of 570 posts

Re: CLI agents make self-hosting on a home server easier and fun

#311

Post by zmmmmm »

it's kind of fascinating, LLMs suddenly are making the Linux Desktop waaay more accessible, of all things.

All those fancy GUIs in Mac and Windows designed to be user friendly (but which most users hate and are baffled by anyway) are very hostile for models to access. But text configuration files? it's like a knife through butter for the LLMs to read and modify them. All of a sudden, Linux is MORE user friendly because you can just ask an LLM to fix things. Or even script them - "make it so my theme changes to dark at night and then back to light each morning" becomes something utterly trivial compared to the coding LLMs are being built to handle. But hey, if your OS really doesn't support something? the LLM can probably code up a whole app for you and integrate it in.

I think it's going to be fascinating to see if the power of text based interfaces and their natural compatibility with LLMs transfers over into an upswing in open source operating systems.

Re: CLI agents make self-hosting on a home server easier and fun

#312

Post by wao0uuno »

byb wrote: post #261
drnick1 wrote: post #26

Earlier quoted context omitted.

I'd rather expose a Wireguard port and control my keys than introduce a third party like Tailscale. I am not sure why people are so afraid of exposing ports. I have dozens of ports open on my server including SMTP, IMAP(S), HTTP(S), various game servers and don't see a problem with that. I can't rule out a vulnerability somewhere but services are containerized and/or run as separate UNIX users. It's the way the Inter…

My biggest source of paranoia is my open home assistant port, while it requires a strong password and is TLS-encrypted, I'm sure that one day someone will find an exploit letting them in, and then the attacker will rapidly turn my smart home devices on and off until they break/overheat the power components until they start a fire and burn down my house.

Why expose HA to the internet? I’m genuinely curious.

Re: CLI agents make self-hosting on a home server easier and fun

#313

Post by wiether »

johnisgood wrote: post #271
Jtsummers wrote: post #19

Earlier quoted context omitted.

I think you answered the question. Sugar. It's easier than managing your own Wireguard connections. Adding a device just means logging into the Tailscale client, no need to distribute information to or from other devices. Get a new phone while traveling because yours was stolen? You can set up Tailscale and be back on your private network in a couple minutes. Why did people use Dropbox instead of setting up their own…

Yeah, but "people" here are alleged software engieners. It is quite disheartening.

First and foremost they are humans, with a limited time on Earth.

Being a software engineer doesn't mean you want to spend you free time tinkering about your self-hosting setup and doing support for your users.

With Tailscale, not only you don't have to care about most things since _it just works_, but also on-boarding of casual users is straightforward.

Same goes for Plex. I want to watch movies/shows, I don't want to spend time tinkering with my setup. And Plex provides exactly that. Ditto for my family/friends that can access my library with the same simple experience as Netflix or whatever.

Meanwhile, I have a coworker who want to own/manage everything. So they don't want to use Tailscale and they dropped Plex when they forced to use the third-party login system. Now they watch less than a third than they used to be, and they share their setup with nobody since it's too complicated to do.

To each their own, but my goal is to enjoy my setup and share it with others. Tailscale and Plex give me that.

Re: CLI agents make self-hosting on a home server easier and fun

#314

Post by znpy »

simonw wrote: post #3

This posts lists inexpensive home servers, Tailscale and Claude Code as the big unlocks. I actually think Tailscale may be an even bigger deal here than sysadmin help from Claude Code at al. The biggest reason I had not to run a home server was security: I'm worried that I might fall behind on updates and end up compromised. Tailscale dramatically reduces this risk, because I can so easily configure it so my own devi…

> The biggest reason I had not to run a home server was security: I'm worried that I might fall behind on updates and end up compromised.

In my experience this is much less of an issue depending on your configuration and what you actually expose to the public internet.

Os-side, as long as you pick a good server os (for me that’s rocky linux) you can safely update once every six months.

Applications-wise, i try and expose as little as possible to the public internet and everything exposed is running in an unprivileged podman container. Random test stuff is only exposed within the vpn.

Also tailscale is not even a hard requirement: i rub openvpn and that works as well, on my iphone too.

The truly differentiating factor is methodological, not technological.

Re: CLI agents make self-hosting on a home server easier and fun

#315

Post by johnisgood »

Galanwe wrote: post #306
johnisgood wrote: post #284

Earlier quoted context omitted.

Tailscale does not solve the "falling behind on updates" problem, it just moves the perimeter. Your services are still vulnerable if unpatched: the attacker now needs tailnet access first (compromised device, account, or Tailscale itself). You have also added attack surface: Tailscale client, coordination plane, DERP relays. If your threat model includes "OpenSSH might have an RCE" then "Tailscale might have an RCE"…

> BTW, why are people acting like accessing a server from a phone is a 2025 innovation? > SSH clients on Android/iOS have existed for 15 years That is not the point, Tailscale is not just about having a network connection, it's everything that goes with. I used to have OpenVPN, and there's a world of difference. - The tailscale client is much nicer and convenient to use on Android than anything I have seen. - The aut…

You are listing conveniences, which is fair. I said the tradeoff is convenience, not security.

> "Tailscale can terminate SSH publicly"

You are now exposing services via Tailscale's infrastructure instead of your own reverse proxy. The attack surface moved, it did not shrink.

Re: CLI agents make self-hosting on a home server easier and fun

#316

Post by nialv7 »

drnick1 wrote: post #26
simonw wrote: post #3

This posts lists inexpensive home servers, Tailscale and Claude Code as the big unlocks. I actually think Tailscale may be an even bigger deal here than sysadmin help from Claude Code at al. The biggest reason I had not to run a home server was security: I'm worried that I might fall behind on updates and end up compromised. Tailscale dramatically reduces this risk, because I can so easily configure it so my own devi…

I'd rather expose a Wireguard port and control my keys than introduce a third party like Tailscale. I am not sure why people are so afraid of exposing ports. I have dozens of ports open on my server including SMTP, IMAP(S), HTTP(S), various game servers and don't see a problem with that. I can't rule out a vulnerability somewhere but services are containerized and/or run as separate UNIX users. It's the way the Inter…

> introduce a third party like Tailscale.

Well just use headscale and you'll have control over everything.

Re: CLI agents make self-hosting on a home server easier and fun

#317

Post by xnickb »

lmm wrote: post #122
buran77 wrote: post #84

Earlier quoted context omitted.

> I'd rather expose a Wireguard port and control my keys than introduce a third party like Tailscale. Ideal if you have the resources (time, money, expertise). There are different levels of qualifications, convenience, and trust that shape what people can and will deploy. This defines where you draw the line - at owning every binary of every service you use, at compiling the binaries yourself, at checking the code th…

> It's simple, you increase your attack surface, and the effort and expertise needed to mitigate that. Sure, but opening up one port is a much smaller surface than exposing yourself to a whole cloud hosting company.

Headscale is a thing

Re: CLI agents make self-hosting on a home server easier and fun

#318

Post by duttish »

I've been building a home library system mainly for personal use, I want to run it cheaply so a $4 black Friday sale OVH vps is perfect.

But I wanted decent deployments. Hosting a image repository cost 3-4x of the server. Sending over the container image took over an hour due to large image processing python dependencies.

Solution? Had a think and a chat with Claude code, now I have blue-green deployments where I just upload the code which takes 5 seconds, everything is then run by systemd. I looked at the various PaaSes but they ran up to $40/month with compute+database etc.

I would probably never have built this myself. I'd have gotten bored 1/3 through. Now it's working like a charm.

Is it enterprise grade? Gods no. Is it good enough? Yes.

Re: CLI agents make self-hosting on a home server easier and fun

#319

Post by teiferer »

nick2k3 wrote: post #87

All fine and great with Tailscale until you company places an iOS restriction on external VPNs and your work phone is also your primary phone :(

> your work phone is also your primary phone :(

That's the flaw right there. Don't mix company assets with pricate use. Phone, laptop, car. Your life is already very dependent on your employer (through income), don't get yourself locked in even more by depending on them for personal tech. Plus it's a security risk to your company.

Unless you have a low paying job, which rarely anybody on HN does, you can afford your own phone and laptop. And IT won't find your messages to girlfriend or pictures you don't want others to see or browsing history.

Re: CLI agents make self-hosting on a home server easier and fun

#320

Post by teiferer »

jacobthesnakob wrote: post #97
nick2k3 wrote: post #87

All fine and great with Tailscale until you company places an iOS restriction on external VPNs and your work phone is also your primary phone :(

My work WiFi blocked traffic to port 51820, the default WireGuard port. I was wondering why my VPN started failing to handshake one day. I changed my ports to 51821 that night and back in business. I checked our technology policy and there’s no “thou shalt not use a VPN” clause so no clue why someone one day decided to drop WireGuard traffic on the network.

Restrict use of private devices?

Though just blocking particular ports for this purpose is very 90s and obviously ineffective, as you demonstrated. Anybody proficient in installing wireguard also knows how to change ports.

Post reply on HN