Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CLI agents make self-hosting on a home server easier and fun

fulghum.io

Post reply on HN
Print view View original

411–420 of 570 posts

Re: CLI agents make self-hosting on a home server easier and fun

#411

Post by tietjens »

This is very cool and I'm doing something similar but without the Claude interface as the contact point for manipulating the server. What happens if one day Claude is down, or it becomes too expensive, or it is purchased by another company, etc.

In this case you will be completely unable to navigate the infrastructure of your homeserver that your life will have become dependent on.

But a homeserver is always about your levels of risk, single points of failure. I'm personally willing to accept Tailscale but I'm not willing to give the manipulation of all services directly over to Claude.

Re: CLI agents make self-hosting on a home server easier and fun

#412

Post by pferde »

twelvedogs wrote: post #339
drnick1 wrote: post #26

Earlier quoted context omitted.

I'd rather expose a Wireguard port and control my keys than introduce a third party like Tailscale. I am not sure why people are so afraid of exposing ports. I have dozens of ports open on my server including SMTP, IMAP(S), HTTP(S), various game servers and don't see a problem with that. I can't rule out a vulnerability somewhere but services are containerized and/or run as separate UNIX users. It's the way the Inter…

i tried wireguard and ended up giving up on it, too many isps just block it here or use some kind of tech that fucks with it and i have no idea why, i couldn't connect to my home network because it was blocked on whatever random wifi i was on the new problem is now my isp uses cgnat and there's no easy way around it tailscale avoids all that, if i wanted more control i'd probably use headscale rather than bother with…

And there's nothing wrong with it. That is what wireguard is meant to be - a rock-solid secure tunneling implementation that's easy to build higher-level solutions on.

Re: CLI agents make self-hosting on a home server easier and fun

#413

Post by InfinityByTen »

Maledictus wrote: post #394
InfinityByTen wrote: post #341

I was just thinking I should write something about this, because the words needs spreading. I cannot say how happy I am configuring my own immich server on a decade old machine. I just feel empowered. Because despite my 9 years of software development, I haven't gotten into the nitty gritties of networking, VPN and I always see something non-standard while installing an open source package and without all of this cus…

Email is endgame, I suggest you get more experience self hosting in other areas first.

I concur. I did mention there was a rush and foolhardiness. That's my mid 30s excitement. Let me revel a bit :P

I do want to be able to take control; with photos and Google not giving me a folder view to manage them was the last straw that pushed me deep into the self hosted world. I just want to de-google as much as reasonable.

Re: CLI agents make self-hosting on a home server easier and fun

#414

Post by InfinityByTen »

lee_ars wrote: post #409
InfinityByTen wrote: post #341

I was just thinking I should write something about this, because the words needs spreading. I cannot say how happy I am configuring my own immich server on a decade old machine. I just feel empowered. Because despite my 9 years of software development, I haven't gotten into the nitty gritties of networking, VPN and I always see something non-standard while installing an open source package and without all of this cus…

> PS: The rush was so great I was excitedly talking to my wife how I could port our emails away from google, considering all of the automatic opt in for AI processing and what not. The foolhardy me thought of even sabbatical breaks to work on long pending to-do's in my head. I've been email self-hosting for a decade, and unfortunately, self-hosting your email will not help with this point nearly as much as it seems o…

Words of wisdom. Hear hear!

Re: CLI agents make self-hosting on a home server easier and fun

#415

Post by lee_ars »

visageunknown wrote: post #220

I find LLMs remove all the fun for me. When I build my homelab, I want the satisfaction of knowing that I did it. And the learning gains that only come from doing it manually. I don't mind using an LLM to shortcut areas that are just pure pain with no reward, but I abstain from using it as much as possible. It gives you the illusion that you've accomplished something.

>I don't mind using an LLM to shortcut areas that are just pure pain with no reward...

Enlightenment here comes when you realize others are doing the exact same thing with the exact same justification, and everyone's pain/reward threshold is different. The argument you are making justifies their usage as well as yours.

Re: CLI agents make self-hosting on a home server easier and fun

#416

Post by fooqux »

pferde wrote: post #407
fooqux wrote: post #187

Earlier quoted context omitted.

Port scanners don't try to ssh into my server with various username/password combinations. I prefer to hide my port instead of using F2B for a few reasons. 1. Log spam. Looking in my audit logs for anything suspicious is horrendous when there's just megs of login attempts for days. 2. F2B has banned me in the past due to various oopsies on my part. Which is not good when I'm out of town and really need to get into my…

You can tweak rate thresholds for F2B, so that it blocks the 100-attempts-per-second attackers, but doesn't block your three-attempts-per-minute manual fumbling.

I know this. But I don't like that they still get to try at least once, and there's still the rest of my list.

Re: CLI agents make self-hosting on a home server easier and fun

#417

Post by inapis »

drnick1 wrote: post #26
simonw wrote: post #3

This posts lists inexpensive home servers, Tailscale and Claude Code as the big unlocks. I actually think Tailscale may be an even bigger deal here than sysadmin help from Claude Code at al. The biggest reason I had not to run a home server was security: I'm worried that I might fall behind on updates and end up compromised. Tailscale dramatically reduces this risk, because I can so easily configure it so my own devi…

I'd rather expose a Wireguard port and control my keys than introduce a third party like Tailscale. I am not sure why people are so afraid of exposing ports. I have dozens of ports open on my server including SMTP, IMAP(S), HTTP(S), various game servers and don't see a problem with that. I can't rule out a vulnerability somewhere but services are containerized and/or run as separate UNIX users. It's the way the Inter…

Skill issue. Not to mention the ongoing effort required to maintain and secure the service. But even before that, a lot of people are behing CGNAT. Tailscale makes punching a hole through that very easy. Otherwise you have to run your own relay server somewhere in the cloud.

Re: CLI agents make self-hosting on a home server easier and fun

#418

Post by wasmitnetzen »

lee_ars wrote: post #399
gsich wrote: post #304

Earlier quoted context omitted.

change port.

After years of cargo-culting this advice—"run ssh on a nonstandard port"—I gave up and reverted to 22 because ssh being on nonstandard ports didn't change the volume of access attempts in the slightest. It was thousands per day on port 22, and thousands per day on port anything-else-i-changed-it-to. It's worth an assessment of what you _think_ running ssh on a nonstandard port protects you against, and what it's actu…

Conversely, what do you gain by using a standard port?

Now, I do agree a non-standard port is not a security tool, but it doesn't hurt running a random high-number port.

Re: CLI agents make self-hosting on a home server easier and fun

#419

Post by lee_ars »

wasmitnetzen wrote: post #418
lee_ars wrote: post #399

Earlier quoted context omitted.

After years of cargo-culting this advice—"run ssh on a nonstandard port"—I gave up and reverted to 22 because ssh being on nonstandard ports didn't change the volume of access attempts in the slightest. It was thousands per day on port 22, and thousands per day on port anything-else-i-changed-it-to. It's worth an assessment of what you _think_ running ssh on a nonstandard port protects you against, and what it's actu…

Conversely, what do you gain by using a standard port? Now, I do agree a non-standard port is not a security tool, but it doesn't hurt running a random high-number port.

> Conversely, what do you gain by using a standard port?

One less setup step in the runbook, one less thing to remember. But I agree, it doesn't hurt! It just doesn't really help, either.

Re: CLI agents make self-hosting on a home server easier and fun

#420

Post by bjt12345 »

eqvinox wrote: post #336
heavyset_go wrote: post #276

Earlier quoted context omitted.

Someone would need your 256-bit key to do anything to an exposed Wireguard port.

In theory. In the same theory, someone would need your EC SSH key to do anything with an exposed SSH port. Practice is a separate question.

SSH is TCP though and the outside world can initiate a handshake, the point being that wireguard silently discards unauthenticated traffic - there's no way they can know the port is open for listening.
Post reply on HN