Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Start Self Hosting

rohanrd.xyz

Post reply on HN
Print view View original

341–350 of 625 posts

Re: Start Self Hosting

#341

Post by cmroanirgo »

rashkov wrote: post #312
cmroanirgo wrote: post #161

Earlier quoted context omitted.

It should start with how to make your system upgradeable too. I've server that started on Ubuntu 16 and made a helluva mess upgrading to 18. Due to php changes i've had to use ondrej's packages for later php... but that will break on a (very overdue) upgrade to 20... All these script kiddie tutorials are terrible at showing how to maintain a server for years .

This is where docker really shines. Unless you’re a php developer or have a lot of experience with it, gluing it all together is best left to some clever person maintaining an upstream docker image.

Docker and I are not friends. The quickest way I found to fill up my limited VPS hard drive was to install Docker. All the work arounds to limit it failed. Then there's the whole lack of concrete control over iptables, where a tiny mistake can open you up to all sorts of horrors. So, it's great that Docker works for many, but I get the exact opposite of warm and fuzzy for it however.

Re: Start Self Hosting

#342

Post by throwaway0x7E6 »

mgraczyk wrote: post #331

My personal site is a static page on github pages, behind cloudflare. It almost never goes down. This page appears to be down, probably because of the HN traffic. I don't buy counter arguments to “I don’t care, I have nothing to hide”. This is completely reasonable if you mean it as "It's extremely unlikely that github or cloudflare will ever choose to censor any content I care to share. Therefore I'm okay with takin…

>It's extremely unlikely that github or cloudflare will ever choose to censor any content I care to share

are you absolutely certain that in 5, 10, 15 years, _all_ things you do and views you express that are widely acceptable today will continue to be so?

Re: Start Self Hosting

#343

Post by egberts1 »

The hardest part is drafting a series of questions for the end-user to understand and answer before we get that “MAGIC-PRESTO-CHANGO” get those configuration files that just works.

I blame the program providers.

Some Debian maintainers are trying to do this simple querying of complex configurations (dpkg-reconfigure `). And I applaud their limited inroad efforts there because no else one has seem to bother.

I have made a bash script to configure for each Chronyd, named, sshd, dhcpd, dhclient, NetworkManager, systemd-networkd, /etc/resolv.conf, amongst many. They try and ask simple questions and glue appropriate settings then run their own syntax checkers (most are provided by the original stream).

Postfix, Shorewall, and Exim4 remain a nightmare to my evolving design. CISecurity and other government hardening docs were applied as well and then some I took even further like Chrony had its file permissions/ownership even further and MitM block feature as well.

These are dangerous scripts where it can write files as root but as a user, you will instead get configuration files written out in appropriate directories under `build` subdirectory.

If these designs work across Redhat/Fedora/CentOS, Debian/Devuan, and ArchLinux well, I may forge even further.

https://github.com/egberts/easy-admin

Re: Start Self Hosting

#344

Post by asoneth »

lnxg33k1 wrote: post #292
prox wrote: post #282

Earlier quoted context omitted.

It is about expendable time. I mean it might take you a few hours or so do it, or even less. People working in other sectors, maybe with a family when they come home, do not have that skill or luxury. And speaking from experience, documentation is often greatly lacking. For example just today I had to thumb down a couple of google docs because it was riddled with inconsistencies and lacking crucial information. And t…

I don't agree with you, only for the fact that right now, in this age computers are everywhere, everything is digital, it is not luxury to learn how things work, it's survival, it's not expendable time, it's professional time

I have various friends who have made similar statements about food (everyone should cook meals for themselves), cars (everyone should do their own basic repairs and maintenance), homes (everyone should do their own basic home maintenance), keyboards (everyone should do basic soldering and learn a non-qwerty layout), accounting (everyone should have a budget and do their own taxes), gardening, fitness, investing, education, etc.

The number of people who can learn all of the skills that someone in the world considers essential is small. The number of people who can do all those things while having a job, kids, and a working partner is smaller still. The rest of us have to focus on a proper subset.

For me, every minute I waste learning how to configure my server is a minute I could have been playing Legos with my kids or riding my bike or sleeping.

Re: Start Self Hosting

#345

Post by pbronez »

gz5 wrote: post #245
kodah wrote: post #98

Self-hosting is something that we should be constantly iterating on making easier; it's really the path forward for privacy centric folks. The main challenges are managing workload scheduling (SystemD is complicated for a layperson). Networking is another challenge; for instance, if you wanted all or part of these services to remain offline or on a Mesh VPN there's a lot of knowledge required. There's some projects t…

tailscale is strong for network-centric use cases. openziti is strong for app-centric use cases - put the (programmable, zero trust) network into your self-hosted app (via SDKs for various languages), rather than putting the app on the network. https://openziti.github.io/ (quick starts) https://github.com/openziti disclosure: founder of company selling saas on top of openziti

That’s pretty cool. So I could use Ziti two write a client-server app where the server is only accessible/visible to clients running Ziti with appropriate keys?

Re: Start Self Hosting

#346

Post by mgraczyk »

throwaway0x7E6 wrote: post #342
mgraczyk wrote: post #331

My personal site is a static page on github pages, behind cloudflare. It almost never goes down. This page appears to be down, probably because of the HN traffic. I don't buy counter arguments to “I don’t care, I have nothing to hide”. This is completely reasonable if you mean it as "It's extremely unlikely that github or cloudflare will ever choose to censor any content I care to share. Therefore I'm okay with takin…

>It's extremely unlikely that github or cloudflare will ever choose to censor any content I care to share are you absolutely certain that in 5, 10, 15 years, _all_ things you do and views you express that are widely acceptable today will continue to be so?

In 15 years I may be dead, and yes I'm pretty much certain.

Life is too short to worry about these things. I'll say controversial things in private or anonymously.

Re: Start Self Hosting

#347

Post by kovac »

kodah wrote: post #98

Self-hosting is something that we should be constantly iterating on making easier; it's really the path forward for privacy centric folks. The main challenges are managing workload scheduling (SystemD is complicated for a layperson). Networking is another challenge; for instance, if you wanted all or part of these services to remain offline or on a Mesh VPN there's a lot of knowledge required. There's some projects t…

For laypeople self-hosting is out of the question for now. I'd say the more immediate problem is that even for competent engineers this is a difficult task with all the artificial restrictions put in place in the name of security, anti-fraud, etc.

Re: Start Self Hosting

#348

Post by [deleted] »

kovac wrote: post #347
kodah wrote: post #98

Self-hosting is something that we should be constantly iterating on making easier; it's really the path forward for privacy centric folks. The main challenges are managing workload scheduling (SystemD is complicated for a layperson). Networking is another challenge; for instance, if you wanted all or part of these services to remain offline or on a Mesh VPN there's a lot of knowledge required. There's some projects t…

For laypeople self-hosting is out of the question for now. I'd say the more immediate problem is that even for competent engineers this is a difficult task with all the artificial restrictions put in place in the name of security, anti-fraud, etc.

[deleted]

Re: Start Self Hosting

#349

Post by gcommer »

itsjloh wrote: post #325
gcommer wrote: post #234

Lots of good points about the challenges of self-hosting throughout this thread, especially maintenance, security, and time-investment. Here's my solution to all of them: Invest in your common infra. Docker provides stable images configured primarily with env vars. I have a docker-compose host with logging/monitoring/alerting. All service-specific files are mounted from a NAS that has backups. All network access is c…

How'd you go getting docker + IPv6 going? I spent hours trying to get docker containers to get native IPv6 IPs and eventually gave up because it was to painful.

I feel for you. I also wasted a lot of very painful hours trying to get it to work. I even had it working for a while before a docker update broke it -- turns out docker-compose's ipv6 support that many people relied on for years was a "bug" that they "fixed".

Ultimately I also gave up and now have a combination of port forwarding, nat64, and 10+ socat proxies in my docker-compose file. (Specifically, intranet->container and container->intranet are ipv6; but container->container is still ipv4)

More generally, I now try to keep my docker host as stock as possible. Whenever I'm reaching for daemon.json I just catch myself, take a step back, and say "what's the stupid but easy way to get this working".

Re: Start Self Hosting

#350

Post by gz5 »

pbronez wrote: post #345
gz5 wrote: post #245

Earlier quoted context omitted.

tailscale is strong for network-centric use cases. openziti is strong for app-centric use cases - put the (programmable, zero trust) network into your self-hosted app (via SDKs for various languages), rather than putting the app on the network. https://openziti.github.io/ (quick starts) https://github.com/openziti disclosure: founder of company selling saas on top of openziti

That’s pretty cool. So I could use Ziti two write a client-server app where the server is only accessible/visible to clients running Ziti with appropriate keys?

yep, literally shut down all inbound firewall ports and link listeners. keys are bootstrapped and you can add your own CA if desired (RFC 7030).

https://ziti.dev/blog/bootstrapping-trust-part-5-bootstrappi...

Post reply on HN