Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My self-hosting infrastructure, fully automated

github.com

Post reply on HN
Print view View original

61–70 of 228 posts

Re: My self-hosting infrastructure, fully automated

#61

Post by peterbraden »

rhizome wrote: post #59
simonw wrote: post #2

This is very cool! Have you considered something like Tailscale so you can securely access it from outside your home? I've been thinking about spinning up my own home server that way, seeing as Tailscale makes it easy to securely access it from my phone when I'm out and about.

Honest question: why not SSH?

They solve different problems. Tailscale basically allows you to ignore any NAT topologies separating you from your machines. You can have a pseudo local network of your machines behind a VPN, allowing SSH to any machine with zero routing issues. And it’s incredibly seamless. I’m a big fan.

Re: My self-hosting infrastructure, fully automated

#62

Post by throwaway894345 »

akkartik wrote: post #25

The question I have whenever I see something like this is what the upgrade process looks like. How much time do you spend per month upgrading dependencies, how many mailing lists you're subscribed to, etc. When the log4j thing blew up, how long did it take you to gain confidence that you were no longer impacted?

Probably no worse than the alternatives. Just about everything is going to be easy to upgrade except possibly the Kubernetes masters (and even that isn’t so bad if you can spare a bit of downtime).

Re: My self-hosting infrastructure, fully automated

#63

Post by akkartik »

throwaway894345 wrote: post #62
akkartik wrote: post #25

The question I have whenever I see something like this is what the upgrade process looks like. How much time do you spend per month upgrading dependencies, how many mailing lists you're subscribed to, etc. When the log4j thing blew up, how long did it take you to gain confidence that you were no longer impacted?

Probably no worse than the alternatives. Just about everything is going to be easy to upgrade except possibly the Kubernetes masters (and even that isn’t so bad if you can spare a bit of downtime).

For sure no worse than the alternatives. I also don't care about downtime. But I'm looking for something that minimizes the overheads over not self-hosting.

I'd love to prove Moxie Marlinspike wrong that "people don't want to run their own servers, and never will." (https://moxie.org/2022/01/07/web3-first-impressions.html) This is the key bottleneck in getting people to run their own servers.

Re: My self-hosting infrastructure, fully automated

#64

Post by xyzzy_plugh »

danuker wrote: post #46
artdigital wrote: post #27

Earlier quoted context omitted.

It’s a good habit to always use tools like terraform for cloud or Ansible/Salt/Puppet for machines instead of directly doing something. Especially cloud setups that just run containers are relatively easy to get idempotent with terraform

No. It never gets a habit. It is torture, and you have to look up the commands every time you do it, because you do it infrequently enough not to learn by heart.

Huh? Compared to... running commands infrequently to administer servers? IaC is strictly and comically better.

Re: My self-hosting infrastructure, fully automated

#65

Post by aborsy »

0xCMP wrote: post #19
Orou wrote: post #14

Earlier quoted context omitted.

Are there any major benefits to using Tailscale over vanilla Wireguard?

NAT busting is a plus. Avoid needing DDNS and opening a port. Also easier setup for accessing other stuff on the network via that computer vs up/down rules with a standard wg config. For a small setup thats the big thing, but for anything a little more it does key rotation, handles ips for you, and offers "magic dns" which makes all the devices get a nice DNS address when tailscale is on.

NAT busting is a minus. If apps can create holes in your network and “bust your NAT,” your network is not well secured; you should disable UPnP and filter egress.

Also, you gain simplicity but give up to coordination servers, that can be a privacy and security problem.

Re: My self-hosting infrastructure, fully automated

#66

Post by rhizome »

peterbraden wrote: post #61
rhizome wrote: post #59

Earlier quoted context omitted.

Honest question: why not SSH?

They solve different problems. Tailscale basically allows you to ignore any NAT topologies separating you from your machines. You can have a pseudo local network of your machines behind a VPN, allowing SSH to any machine with zero routing issues. And it’s incredibly seamless. I’m a big fan.

But in this model wouldn't you control the NAT config? You're already running servers, so outside access isn't an issue. I dunno, OP is running that "Cloudflare tunnel" thing for exposed ports so maybe there's something I don't know, or that the internet connection is still some consumer thing that prevents or forbids running servers.

Actually, now that I look closer they aren't running their own email, so maybe this really is primarily a mostly-internal-access project. I do like those SFFs tho!

Re: My self-hosting infrastructure, fully automated

#67

Post by throwaway894345 »

ekianjo wrote: post #34

You don't need Kubernetes to do self-hosting. Completely overkill.

I fully agree that setting up Kubernetes is a lot of work, but I think people forget how much work it is to set up anything maintainable for more than a few services running on a handful of services.

The nice thing about Kubernetes is that it’s probably not much harder (if at all) than the alternative (assuming you already know which tools to use to compose your bespoke platform) and you can easily find online resources and support (never mind all of the problems you don’t run into because they’re already solved in Kubernetes).

Re: My self-hosting infrastructure, fully automated

#68

Post by [deleted] »

aborsy wrote: post #65
0xCMP wrote: post #19

Earlier quoted context omitted.

NAT busting is a plus. Avoid needing DDNS and opening a port. Also easier setup for accessing other stuff on the network via that computer vs up/down rules with a standard wg config. For a small setup thats the big thing, but for anything a little more it does key rotation, handles ips for you, and offers "magic dns" which makes all the devices get a nice DNS address when tailscale is on.

NAT busting is a minus. If apps can create holes in your network and “bust your NAT,” your network is not well secured; you should disable UPnP and filter egress. Also, you gain simplicity but give up to coordination servers, that can be a privacy and security problem.

[deleted]

Re: My self-hosting infrastructure, fully automated

#69

Post by pdonis »

turtlebits wrote: post #7

This is cool, but are you doing this as learning experience? For a homelab it seems severely overkill. I understand it all being self-hosted, but it could be drastically simpler if you adopt a few SaaS products (using free-tier)

> it could be drastically simpler if you adopt a few SaaS products (using free-tier)

For some people (including me), the risk involved in any SaaS product suddenly either dropping or imposing unworkable restrictions on free tier is high enough to make the extra work involved in self-hosting worth it. (Granted, my current self-hosting setup is a lot simpler than the one described in this article, but even if mine were more complex I would still say the same thing.)

Re: My self-hosting infrastructure, fully automated

#70

Post by hahajk »

smasher164 wrote: post #23
simonw wrote: post #2

This is very cool! Have you considered something like Tailscale so you can securely access it from outside your home? I've been thinking about spinning up my own home server that way, seeing as Tailscale makes it easy to securely access it from my phone when I'm out and about.

This is how I currently manage my RPi NAS on NixOS: https://github.com/smasher164/nas . Exposing Home Assistant over it allows me to do things like turn my lights off when I'm away from home, without exposing stuff to the public internet. https://www.blog.akhil.cc/shelly-dimmer

Before I clicked I thought “man, a single config.nix for his whole system? this is going to be big…” But I’ve continually been surprised how little configuration you actually need to do in nixos. I’ve been planning on configuring Home assistant on an RPi myself, so this will help. Thanks for sharing!
Post reply on HN