thirdBreakfast

@[email protected]

This profile is from a federated server and may be incomplete. View on remote instance

thirdBreakfast ,
  • Climate change contributing to
  • Climate refugees contributing to
  • Breakdown in social cohesion contributing to
  • Populism, oligarchs, and authoritarianism contributing to
  • Breakdown of international cooperation contributing to
  • Inter-nation conflict contributing to
  • GOTO 10

Is it practically impossible for a newcomer selfhost without using centralised services, and get DDOSed or hacked?

I understand that people enter the world of self hosting for various reasons. I am trying to dip my toes in this ocean to try and get away from privacy-offending centralised services such as Google, Cloudflare, AWS, etc....

thirdBreakfast ,

+1 for the main risk to my service reliability being me getting distracted by some other shiny thing and getting behind on maintenance.

thirdBreakfast ,

Yeah na, put your home services in Tailscale, and for your VPS services set up the firewall for HTTP, HTTPS and SSH only, no root login, use keys, and run fail2ban to make hacking your SSH expensive. You're a much smaller target than you think - really it's just bots knocking on your door and they don't have a profit motive for a DDOS.

From your description, I'd have the website on a VPS, and Immich at home behind TailScale. Job's a goodun.

thirdBreakfast ,

Yes, and it's very phrased based, so you sort of absorb the grammar without a lot of explicit rules.

thirdBreakfast ,

I started as more "homelab" than "selfhosted" as first - so I was just stuffing around playing with things, but then that seemed sort of pointless and I wanted to run real workloads, then I discovered that was super useful and I loved extracting myself from commercial cloud services (dropbox etc). The point of this story is that I sort of built most of the infrastructure before I was running services that I (or family) depended on - which is where it can become a source of stress rather than fun, which is what I'm guessing you're finding yourself in.

There's no real way around this (the pressure you're feeling), if you are running real services it is going to take some sysadmin work to get to the point where you feel relaxed that you can quickly deal with any problems. There's lots of good advice elsewhere in this thread about bit and pieces to do this - the exact methods are going to vary according to your needs. Here's mine (which is not perfect!).

  • I'm running on a single mini PC & a Synology NAS setup for RAID 5
  • I've got a nearly identical spare mini PC, and swap over to it for a couple of weeks (originally every month, but stretched out when I'm busy). That tests my ability to recover from that hardware failure.
  • All my local workloads are in LXC containers or VM's on Proxmox with automated snapshots that are my (bulky) backups, but allow for restoration in minutes if needed.
  • The NAS is backed up locally to an external USB that's not usually plugged in, and to a lower speced similar setup 300km away.
  • All the workloads are dockerised, and I have a standard directory structure and compose approach so if I need to upgrade something or do some other maintenance of something I don't often touch, I know where everything is with out looking back to the playbook
  • I don't use a script or Terrafrom to set those up, I've got a proxmox template with docker and tailscale etc installed that I use, so the only bit of unique infrastructure is the docker compose file which is source controlled on Forgejo
  • Everything's on UPSs
  • A have a bunch of ansible playbooks for routine maintenance such as apt updates, also in source control
  • all the VPS workloads are dockerised with the same directory structure, and behind NGINX PM. I've gotten super comfortable with one VPS provider, so that's a weakness. I should try moving them one day. They are mostly static websites, plus one important web app that I have a tested backup strategy for, but not an automated one, so that needs addressed.
  • I use a local and an external UptimeKuma for monitoring, enhanced by running a tiny server on every instance that just exposes a disk free and memory free api that can be consumed by Uptime.

I still have lots of single points of failure - Tailscale, my internet provider, my domain provider etc, but I think I've addressed the most common which would be hardware failures at home. My monitoring is also probably sub-par, I'm not really looking at logs unless I'm investigating a problem. Maybe there's a Netdata or something in my future.

You've mentioned that a syncing to a remote server for backups is a step you don't want to take, if you mean managing your own is a step you don't want to take, then your solutions are a paid backup service like backblaze or, physically shuffling external USB drives (or extra NASs) back and forth to somewhere - depending on what downtime you can tolerate.

thirdBreakfast OP ,

Thanks. I'll keep an eye out. Now I know that it gets daily use, a more expensive machine doesn't seem so crazy.

‘My whole library is wiped out’: what it means to own movies and TV in the age of streaming services ( www.theguardian.com )

*What rights do you have to the digital movies, TV shows and music you buy online? That question was on the minds of Telstra TV Box Office customers this month after the company announced it would shut down the service in June. Customers were told that unless they moved over to another service, Fetch, they would no longer be...

thirdBreakfast ,

Wish by Peter Goldsworthy. J.J. has always been more at home in Sign language than in spoken English. Recently divorced, he returns to school to teach Sign. His pupils include the foster parents of a beautiful and highly intelligent ape named Eliza.

thirdBreakfast ,

Greta Tintin Thunberg

Certbot is great. Let's Encrypt is great. ( lemmy.world )

I've been downloading SSL certificates from my domain provider, using cat to join them together to make the fullchain.pem, uploading them to the server, and myself adding a 90 day calendar reminder. Every time I did this I'd think I should find out about this Certbot thing....

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • kbinchat
  • All magazines
    •