Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My self-hosting infrastructure, fully automated

github.com

Post reply on HN
Print view View original

81–90 of 228 posts

Re: My self-hosting infrastructure, fully automated

#81

Post by khuedoan »

erulabs wrote: post #24

Awesome! hajimari is neat, haven't seen that before. I'm building a startup that's trying to put a good chunk of this in a box for folks to buy and plug-n-play self-hosting (as much as that is possible). Since you're running k3s already, you might checkout our templates at https://kubesail.com/templates for more home-hosting apps :)

(Repo owner here) The templates look cool, are those Helm charts underneath?

Also I believe the tag filter is malfunctioning: https://kubesail.com/templates-by-tag/Media

Re: My self-hosting infrastructure, fully automated

#82

Post by akkartik »

khuedoan wrote: post #80
akkartik wrote: post #25

The question I have whenever I see something like this is what the upgrade process looks like. How much time do you spend per month upgrading dependencies, how many mailing lists you're subscribed to, etc. When the log4j thing blew up, how long did it take you to gain confidence that you were no longer impacted?

(Repo onwer here) The upgrade process can mostly be automated (for example using Dependabot). I haven't configured it yet, but that's on my TODO list.

You're fighting the good fight, keep it up.

Re: My self-hosting infrastructure, fully automated

#83

Post by akkartik »

khuedoan wrote: post #80
akkartik wrote: post #25

The question I have whenever I see something like this is what the upgrade process looks like. How much time do you spend per month upgrading dependencies, how many mailing lists you're subscribed to, etc. When the log4j thing blew up, how long did it take you to gain confidence that you were no longer impacted?

(Repo onwer here) The upgrade process can mostly be automated (for example using Dependabot). I haven't configured it yet, but that's on my TODO list.

What languages does it depend on so far? Do you try to minimize the number of language eco-systems you rely on?

Re: My self-hosting infrastructure, fully automated

#84

Post by rwbhn »

aborsy wrote: post #65
0xCMP wrote: post #19

Earlier quoted context omitted.

NAT busting is a plus. Avoid needing DDNS and opening a port. Also easier setup for accessing other stuff on the network via that computer vs up/down rules with a standard wg config. For a small setup thats the big thing, but for anything a little more it does key rotation, handles ips for you, and offers "magic dns" which makes all the devices get a nice DNS address when tailscale is on.

NAT busting is a minus. If apps can create holes in your network and “bust your NAT,” your network is not well secured; you should disable UPnP and filter egress. Also, you gain simplicity but give up to coordination servers, that can be a privacy and security problem.

Tailscale isn't using UPnP. See https://tailscale.com/blog/how-nat-traversal-works/

Re: My self-hosting infrastructure, fully automated

#85

Post by gigel82 »

dmayle wrote: post #37
gigel82 wrote: post #28

This needs a companion guide about how to set up the host machine. Which Linux distro to choose, how to set it up / harden it, nftables / firewall, public key login, etc. If anyone has one handy, I'd appreciate a link.

You are unlikely to find what you're looking for. I'm going to dig into this article a bit, but what you're talking about is inherently hard, and delivers tremendous value to businesses. There are a lot of people doing it for money, and someone builds something that starts to actually work, they get acquired, or they take their project and make it enterprise-y (because that's where the funding is). There's flatcar an…

Thanks, some of this went over my head and sounds way too complicated.

I'd be satisfied with a home-user-oriented manual tutorial, like install Debian with these packages, a nftables setup that firewalls everything but these 3 ports, how to setup auto-update, turn off root & password-only logins, and general things to be reasonably secure; as well as tips for on-going maintenance and so on.

Re: My self-hosting infrastructure, fully automated

#86

Post by khuedoan »

akkartik wrote: post #83
khuedoan wrote: post #80

Earlier quoted context omitted.

(Repo onwer here) The upgrade process can mostly be automated (for example using Dependabot). I haven't configured it yet, but that's on my TODO list.

What languages does it depend on so far? Do you try to minimize the number of language eco-systems you rely on?

Yes, I aim to keep the amount of languages and tools I use to a minimum:

- For simple scripts, use POSIX sh

- For more complex scripts, use Python

- For the same sort of task, use only one tool (e.g., only use Ansible for configuration management, don't mix in Puppet or Chef)

Re: My self-hosting infrastructure, fully automated

#87

Post by nullwarp »

candiddevmike wrote: post #44

I enjoy reading about homelabs that aren't using kubernetes or some other scheduler and how they're doing it/what the full stack looks like. This is just another "how I installed kubernetes" thing only without any real scale behind it. There are other ways to deploy and run things, and it takes people toying around with alternatives for something unique to spring up.

I've used everything under the sun and for homelab use IMO nothing beats using docker-compose and salt.

1. Unless you have crazy dynamic scaling needs, there's literally no point in using k8s or nomad 2. Unless you want RBAC and fine tuned ACL, theres literally no point in using k8s or Nomad

I hate this idea that you need a Ceph cluster and a 3 node HA cluster to have a home lab.

Not saying don't do it because you want to play/test/learn any of those platforms, just that if you are going to run a server service maybe consider if you are doing it for learning a task orchestration service or just want to run XYZ reliably.

Re: My self-hosting infrastructure, fully automated

#88

Post by endigma »

Axsuul wrote: post #54
candiddevmike wrote: post #44

I enjoy reading about homelabs that aren't using kubernetes or some other scheduler and how they're doing it/what the full stack looks like. This is just another "how I installed kubernetes" thing only without any real scale behind it. There are other ways to deploy and run things, and it takes people toying around with alternatives for something unique to spring up.

I run mine using HashiStack (Nomad, Vault, Consul), highly recommend going that route over Kubernetes which I have also used.

What do you use for storage?

Re: My self-hosting infrastructure, fully automated

#89

Post by sandGorgon »

khuedoan wrote: post #47

Repo owner here, I just created this account, I'm a long time HN lurker. I was surprised to find this on Hacker News, I wanted to wait until the stable release before posting on HN, but thank you for posting :) This project is still in alpha stage, but please feel free to critique; I'd appreciate it. Edit 1: After reading some of the comments, I want to clarify a few things: - Because it is currently in the alpha sta…

do you use k3s in production as well ?

Re: My self-hosting infrastructure, fully automated

#90

Post by akkartik »

khuedoan wrote: post #86
akkartik wrote: post #83

Earlier quoted context omitted.

What languages does it depend on so far? Do you try to minimize the number of language eco-systems you rely on?

Yes, I aim to keep the amount of languages and tools I use to a minimum: - For simple scripts, use POSIX sh - For more complex scripts, use Python - For the same sort of task, use only one tool (e.g., only use Ansible for configuration management, don't mix in Puppet or Chef)

Awesome!

I was thinking more about the user-facing apps you use. Scanning https://github.com/khuedoan/homelab, Gitea is Go, Grafana is Javascript (approximately), Element is Javascript, Dendrite is Go, Vault is Go. K8s itself is Go. Are you planning to run your own email server?

Now I find myself wondering what app choices exist if one were to try to constrain oneself entirely to operating in the Go eco-system, with Javascript only for web clients. That would be quite parsimonious.

Post reply on HN