Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CLI agents make self-hosting on a home server easier and fun

fulghum.io

Post reply on HN
Print view View original

341–350 of 570 posts

Re: CLI agents make self-hosting on a home server easier and fun

#341

Post by InfinityByTen »

I was just thinking I should write something about this, because the words needs spreading.

I cannot say how happy I am configuring my own immich server on a decade old machine. I just feel empowered. Because despite my 9 years of software development, I haven't gotten into the nitty gritties of networking, VPN and I always see something non-standard while installing an open source package and without all of this custom guidance, I always would give up after a couple of hours of pulling my hair apart.

I really want to go deeper and it finally feels this could be a hobby.

PS: The rush was so great I was excitedly talking to my wife how I could port our emails away from google, considering all of the automatic opt in for AI processing and what not. The foolhardy me thought of even sabbatical breaks to work on long pending to-do's in my head.

Re: CLI agents make self-hosting on a home server easier and fun

#342

Post by twelvedogs »

johnisgood wrote: post #284
simonw wrote: post #3

This posts lists inexpensive home servers, Tailscale and Claude Code as the big unlocks. I actually think Tailscale may be an even bigger deal here than sysadmin help from Claude Code at al. The biggest reason I had not to run a home server was security: I'm worried that I might fall behind on updates and end up compromised. Tailscale dramatically reduces this risk, because I can so easily configure it so my own devi…

Tailscale does not solve the "falling behind on updates" problem, it just moves the perimeter. Your services are still vulnerable if unpatched: the attacker now needs tailnet access first (compromised device, account, or Tailscale itself). You have also added attack surface: Tailscale client, coordination plane, DERP relays. If your threat model includes "OpenSSH might have an RCE" then "Tailscale might have an RCE"…

> Tailscale does not solve the "falling behind on updates" problem, it just moves the perimeter.

nothing 100% fixes zero days either, you are just adding layers that all have to fail at the same time

> You have also added attack surface: Tailscale client, coordination plane, DERP relays. If your threat model includes "OpenSSH might have an RCE" then "Tailscale might have an RCE" belongs there too.

you still have to have a vulnerable service after that. in your scenario you'd need an exploitable attack on wireguard or one of tailscale's modifications to it and an exploitable service on your network

that's extra difficulty not less

Re: CLI agents make self-hosting on a home server easier and fun

#343

Post by subscribed »

mtoner23 wrote: post #305
simonw wrote: post #3

This posts lists inexpensive home servers, Tailscale and Claude Code as the big unlocks. I actually think Tailscale may be an even bigger deal here than sysadmin help from Claude Code at al. The biggest reason I had not to run a home server was security: I'm worried that I might fall behind on updates and end up compromised. Tailscale dramatically reduces this risk, because I can so easily configure it so my own devi…

People are way too worried about security imo. Statistically, no one is targeting you to be hacked. By the time you are important and valuable enough for your home equipment to be a target you would have hired someone else to manage this for you

Oh, sure, no one is targeting me specifically.

Its only swarms of bots and scripts going through the entire internet, including me.

iptables and fail2ban should be installed pretty early, and then - just watch the logs.

Re: CLI agents make self-hosting on a home server easier and fun

#344

Post by fartfeatures »

miki123211 wrote: post #340
simonw wrote: post #3

This posts lists inexpensive home servers, Tailscale and Claude Code as the big unlocks. I actually think Tailscale may be an even bigger deal here than sysadmin help from Claude Code at al. The biggest reason I had not to run a home server was security: I'm worried that I might fall behind on updates and end up compromised. Tailscale dramatically reduces this risk, because I can so easily configure it so my own devi…

Now I wish there was some kind of global, single-network version of Tailscale... TS is cool if you have a well-defined security boundary. This is you / your company / your family, they should have access. That is the rest of the world, they should not. My use case is different. I do occasionally want to share access to otherwise personal machines around. Tailscale machine sharing sort of does what I want, but it's re…

Take a look at Zrok it might be what you want: https://zrok.io

Re: CLI agents make self-hosting on a home server easier and fun

#345

Post by johnisgood »

twelvedogs wrote: post #342
johnisgood wrote: post #284

Earlier quoted context omitted.

Tailscale does not solve the "falling behind on updates" problem, it just moves the perimeter. Your services are still vulnerable if unpatched: the attacker now needs tailnet access first (compromised device, account, or Tailscale itself). You have also added attack surface: Tailscale client, coordination plane, DERP relays. If your threat model includes "OpenSSH might have an RCE" then "Tailscale might have an RCE"…

> Tailscale does not solve the "falling behind on updates" problem, it just moves the perimeter. nothing 100% fixes zero days either, you are just adding layers that all have to fail at the same time > You have also added attack surface: Tailscale client, coordination plane, DERP relays. If your threat model includes "OpenSSH might have an RCE" then "Tailscale might have an RCE" belongs there too. you still have to h…

The "layers" argument applies equally to WireGuard without Tailscale. Attacker still needs VPN exploit + vulnerable service.

The difference: Tailscale adds attack vectors that do not exist with self-hosted WireGuard: account compromise, coordination plane, client supply chain, other devices on your tailnet. Those are not layers to bypass, they are additional entry points.

Regardless, it is still for convenience, not security.

Re: CLI agents make self-hosting on a home server easier and fun

#347

Post by torcete »

Frotag wrote: post #108
drnick1 wrote: post #26

Earlier quoted context omitted.

I'd rather expose a Wireguard port and control my keys than introduce a third party like Tailscale. I am not sure why people are so afraid of exposing ports. I have dozens of ports open on my server including SMTP, IMAP(S), HTTP(S), various game servers and don't see a problem with that. I can't rule out a vulnerability somewhere but services are containerized and/or run as separate UNIX users. It's the way the Inter…

Speaking of Wireguard, my current topology has all peers talking to a single peer that forwards traffic between peers (for hole punching / peers with dynamic ips). But some peers are sometimes on the same LAN (eg phone is sometimes on same LAN as pc). Is there a way to avoid forwarding traffic through the server peer in this case?

The way I do it is to have two different first level domains. Let's say:

- w for the wireguard network. - h for the home network.

Nothing fancy, just populate the /etc/hosts on every machine with these names.

Now, it's up to me to connect to my server1.h or server1.w depending whether I am at home or somewhere else.

Re: CLI agents make self-hosting on a home server easier and fun

#348

Post by kalaksi »

Aurornis wrote: post #250
thrownawaysz wrote: post #126

I went down the self host route some years ago but once critical problems hit I realized that beyond a simple NAS it can be a very demanding hobby. I was in another country when there was a power outage at home. My internet went down, the server restart but couldn't reconnect anymore because the optical network router also had some problems after the power outage. I could ask my folks to restart, and turn on off thin…

I thought I was smart because I invested in UPS backup from the start. Then 5 years later there was a power outage and the UPS lasted for about 10 seconds before the batteries failed. That's how I learned about UPS battery maintenance schedules and the importance of testing. I have a calendar alert to test the UPS. I groan whenever it comes up because I know there's a chance I'm going to discover the batteries won't…

My APC UPS self-tested and monitored battery status automatically. Then started to endlessly beep when it noticed the battery needed replacing (could be muted though). Eventually, I stopped using UPS since I rarely needed it and it was just another thing to keep and maintain.

Re: CLI agents make self-hosting on a home server easier and fun

#349

Post by bambax »

I self-host many things on a NAS (Asustor) using Portainer (a Docker UI/facilitator). It all works perfectly and has a marginal cost of about zero, since I need the NAS in any case.

But I wouldn't give the keys of the house to Claude or any LLM for that matter. When needed, I ask them questions and type commands myself. It's not that hard.

Re: CLI agents make self-hosting on a home server easier and fun

#350

Post by PLG88 »

miki123211 wrote: post #340
simonw wrote: post #3

This posts lists inexpensive home servers, Tailscale and Claude Code as the big unlocks. I actually think Tailscale may be an even bigger deal here than sysadmin help from Claude Code at al. The biggest reason I had not to run a home server was security: I'm worried that I might fall behind on updates and end up compromised. Tailscale dramatically reduces this risk, because I can so easily configure it so my own devi…

Now I wish there was some kind of global, single-network version of Tailscale... TS is cool if you have a well-defined security boundary. This is you / your company / your family, they should have access. That is the rest of the world, they should not. My use case is different. I do occasionally want to share access to otherwise personal machines around. Tailscale machine sharing sort of does what I want, but it's re…

You have more or less described OpenZiti. Just mint a new identity/JWT for the user, create a service, and viola, only that user has access to your machine. Fully open source and self-hostable.
Post reply on HN