My Self-Hosted Life | Hacker News Reader

My Self-Hosted Life

webworxshop.com

41 pointswebworxshop78 comments

For me the problem is making stuff secure (..enough, and that would require my "full" attention).

That's why I would love if a company like Mozilla, that offers stuff I support like Firefox, started offering a paid "Google suite" with custom domains. Or at least e-mail and storage. I understand most of it is a race to the bottom but it might be viable if it was open source, community driven. What I care about is knowing my data is not being sold and paying for not having to monitor logs, update servers and all of that.

I do use the cloud but only for encrypted tar files.

I do know about alternatives like the ones listed at privacytools.io, but it's all about trust (in before someone tells me why I shouldn't trust Mozilla).

Of all the companies, I think Mozilla is one of the best ones these days. I'd not be surprised to hear there has been bad behavior from an employee or some corporate manager, but overall, they still stand for something.

This. I have been actively building tools to enable decentralization of social networking and I can tell you that security is the main downside of new, open-source tools you can self-host. What is the solution for young new projects?

Completely sympathize with the reasoning behind this.

Have done similar myself, trying to make the most of low-resource software to run on low-powered hardware.

Self-hosting email, while a PITA at times (must use mailinabox next time... but spf, dmarc, tls everywhere wasn't too bad to set up, just the multiple accounts were fun) is extremely satisfying. And no, it doesn't mostly end up in a gmail inbox. But even if it does, Prism leaks resulted in Google de-pwning themselves (internal encryption), supposedly. For now, etc.

Otherwise RSS (newsbeuter), XMPP (finch), email (mutt), IRC (irssi), Drupal with nginx + php opcode caching + microcaching, Hugo sites with nginx, letsencrypt/certbot. SSH tunnels for socks and remote connections. Cheap router with tomato firmware... Quite amazing what you can run on a pi, router and low end VPS with a bit of time and effort.

Even transitioning much of my word processing to markdown/latex/pandoc for dead simple clean and quick publishing.

I may be completely deluded, but for me the future is still the command line, low powered hardware and FOSS. Its strength is in its fluid development that seems able to endure decades of change and advances, weathering rises and falls of shinier things.

More power to the OP, may many more share their non-shiny setups.

I was interested in Piwik until I noticed the many, many open security issues:

https://github.com/piwik/piwik/issues?q=is%3Aopen+is%3Aissue...

Includes an issue from January about insecure random-number-generation: https://github.com/piwik/piwik/issues/9473

and one from March claiming that it doesn't reliably use TLS to update plugins: https://github.com/piwik/piwik/issues/7582

It bothers me a lot when people advocate self-hosted services with really bad security posture to increase privacy (or "control", as the author says).

Having seen the issue trackers of many closed source SaaS products, let me tell you that this is hardly anything. If anything, it's great that all this is in the open and I can assess and prepare myself in terms of sysadministration accordingly.

Maybe!

But for example Piwik's main competitor is Google Analytics. It's reasonable to not trust Google for privacy reasons, but Google employs one the largest security teams in the world and produces very well-regarded research. I trust Google with securing Google Analytics more than I trust Piwik's developers with securing Piwik.

Yes, snicker at the failing server of the self-hosting guy, ye who are made rich by SaaS.

I applaud him for denying money to an industry that doesn't deserve it

SaaS isn't IaaS, and administrative incompetence happens on both IaaS and self-hosted.

It's software as a service, is it not?

And administrative incompetence? Dude had his server temporarily overrun with traffic. C'mon.

No, you would run Wordpress on EC2 or Google Compute; that would be IaaS, not SaaS.

As far as competence goes: you're submitting yourself to Hacker News and your Wordpress site isn't caching content? Yes, that's incompetence.

Sure, if you're a Hacker News(tm) web developer.

But computin' is such a big field...

Or if I'm a high-school student in 2005. Because I was building Wordpress sites for people then. And staticize (or, later, staticize-reloaded) was on everything I built. If you can't step to a high-school student in a backwater state who had access to state-of-the-PHP eleven years ago when you want to start virtue-signaling your way to glory (and don't pretend creating an account just to post a story is anything but), you are not building a argument for yourself.

The best part is, though? For all his very manly self-reliance, this blog of his is on a DigitalOcean droplet. He isn't "denying" anything to anyone, whether they deserve it or not (and that's a laughable sentiment in your OP anyway, while we're at it).

Well, technically Linode. Not DO, but close enough :P That is pretty funny though.

My sentiments remain. I want a world of self-reliant experts, not halfwitted idea-people who see technology as a means to an end. That may not be this world, but one can dream.

PS: He admits as such in the blog that it is hosted on a VPS. And no one person is going to be able to step to another on every possible criteria. (Frankly, I read your high-school 2005 PHP staticize story with probably the same eye-rolling you gave that dude, cause i was building static HTML in elementary school in the 90s and was doing dynamic flash sites before AJAX became a think in the mid-aughts... and the dude sitting one cubicle over would roll HIS eyes at me because he used to program simulators and missile code for the military in the 70s and 80s. Holier-than-thou can backfire)

I was building static sites in elementary school in the nineties, too. I was building correct things that worked in a business context in high school in 2005. In your haste to praise the guy for nonsense virtues of "self-reliance"--and let me be real for a sec, I've been paid in the last year to debug kernel drivers on physical hardware and architect self-bootstrapping, multi-tier, cross-datacenter systems, I could be said to be big on "self-reliance"--you missed the forest for the trees: his stuff doesn't work.

Setting up mail is easy. Setting up a web server that doesn't go down under medium load is easy. If you want to lecture others about this sort of thing, you had best come correct. Because those of us who do--and who especially those of us who are capable of using tools hosted in either our own racks or Amazon's without trouble, who are likely to have a problem with the shitty virtue-signaling in his post--will call you on it. Because the world is not so simple as to scream that "SaaS is bad!" and, sometimes, there are economics of scale worth leveraging. There is no virtue in refusing them; there are places for self-hosting and there are places for cloud systems and ascribing the rise of cloud services to "halfwitted idea-people" is a sign of a profoundly juvenile understanding of both the technologies and the economics involved.

Kind of comically ironic. I can't currently load the article.. Hug of death I'm guessing? So much for self-hosting?

I had the same thought.

Looks like it. Here's a mirror: http://webcache.googleusercontent.com/search?q=cache:https:/...

Keeping the site online despite being self hosted and on the front page of HN might be the ultimate challenge for the people fond of self hosting!

Not using Wordpress to serve static blog content should be a good start.

Also running the database, webserver, mail server, etc. off a single machine is just asking for trouble.

Wordpress can trivially handle "static blog content" with any of a number of caching plugins. (And you get a lot more out of it, in my experience, than trying to use Jekyll or the like.)

nginx, PHP-FPM and APC, your caching tool of choice, done.

And yet after all these years, they've never bothered to roll functionality like that into the base install.

I much prefer, as somebody who uses this stuff pretty heavily, to make the choice of caching particulars myself and to not have to unscrew their defaults. A cache API would be fine, but I'd rather have as few decisions made inside Wordpress as possible.

I know that attitude well, but really this is a problem that's persisted for years and they have basically acted like it's not their problem, which leaves me unimpressed.

Wordpress is fine; this is why things like Varnish exist. If it's static content you can generate it by hand and serve it as fast as possible (after initial generation, obviously).

> Wordpress is fine; this is why things like Varnish exist

Sounds like "now you have two problems"? There is plenty of blog software out there but very few are so terribly, terribly slow as Wordpress. I'm pretty sure it's the slowest thing I've ever installed on my server (and uninstalled, obviously). Just use something else and there is no need for caching in the first place.

Why would the speed of the blog be a problem if it's behind a cache? Just ramp up the ttl entering varnish and purge aggressively on changes; hell, just reboot varnish any time you make a change. Nothing about a cache interface is difficult to work around when your content changes as little as a blog would.

If anything, moving to an unproven blog framework is going to cause much more headaches than a worpress blog slowing down for seconds every time you make a post.

> Also running the database, webserver, mail server, etc. off a single machine is just asking for trouble.

Until five years ago I ran that* on an old 2001 laptop with 128MB RAM, of which about 56MB went to Windows XP. Worked quite fine really.

* That, plus FTP server, SMB, DNS, VNC and uTorrent. I think that was all.

I've been on the front page of HN a couple times, it's not really all that much traffic. Ten thousand pageloads, at most. If your blog can't handle tens of simultaneous connections, you've got problems.

I have the same experience. 10k+ views, maxing out at 100-ish simultaneous. To me a failure to keep the site up is less about the server and more a commentary on the platform the server is running. A single $20/mo box can support a remarkable amount of traffic if you are running lightweight blogging platforms like Ghost.

A single $20/mo box can handle thousands of concurrent hits to a Wordpress site when that site is properly configured. This is user error.

I did that on a 100KB/s uplink and an EEE box as server. And yes, the self-written software loaded the blog from a database (plus tag cloud and stuff) on every page load. The secret (buy my new book!) is to Not Use Wordpress®.

I guess it depends on your point of view. I also self-host, but I do it because I want control of my data. I'm not the blogging type, but even if I were, I would not consider it a failure that my self-hosted blog went down under the weight of hacker news.

It's not like many other professionally hosted websites haven't done the same over the years, and my data remains in my control even when my website is crushed under the weight of enthusiastic visitors, so my self-hosting goal would be intact.

Isn't that... The definition of a failure?

Only if your goal is to support that amount of traffic.

He's saying his goal is controlling his data, not necessarily 100% uptime, so even if the site ends up going down, he still retained control of his data, and therefore did not fail on the metric that is actually important to him.

Maybe if you specialize in hosting large traffic sites, but if the content got enough attention to cause server failure, then it had to be at least moderately successful content.

This is the first I've heard of Syncthing. Would be interested to know if hn people think it is reasonably secure. Finding a good self-hosted sync option is hard, one of the last places where I'm reluctant to give up SaaS (using Egnyte now since ~2010). Waiting for magic folders from Least Authority. And then even if they put down zcash long enough to finish the magic folders project, someone still has to build a GUI for idiots like me. Is Syncthing security OK for relatively normal people who don't have any secrets of interest to the Russians?

Syncthing has a good reputation in every department except the usability one. It's workflow is generally considered a bit clumsy, but it's a good product.

You could also look into librevault if you're interested in pursuing this avenue.

Good post! I run a homeserver too. It serves media content (1080p) to everyone in the house and never has any trouble. It's main purposes are running Plex and nginx, and soon, e-mail. Only port 80 is accessible to the internet atm (it's fun to read the access logs & see the latest exploit attempts)

It's hard because you have to really be on top of security, but it's worth it.

> You might say that this is a bit of a cop out, since this all runs on a virtual machine, which itself runs on someone else’s computer. I would agree, however it’s a nice middle ground between going all out with your own servers and running everything in the cloud. To me the reality that the VPS is in the cloud is obscured by the ability to control every detail of its running software.

Hmm. Contrarily, this part convinced me to completely self-host all aspects of my internet life.

Also, sorry about your blog going down! What was the cause of that?

> I have taken the decision to self-host as much of my online services as possible, rather than relying on the cloud (since that’s just someone else’s computer)

I understand the desire to take control, and have been on a similar kick lately to reduce my dependence on The Cloud. But I'm not an experienced network or system admin and I'm not concerned about using Someone Else's Computer when it's convenient for me. What I am worried about is my data being locked in to any particular service or being a pain to migrate somewhere else if I want.

I've also been documenting my progress, if anyone's interested. It's on a not-self-hosted-but-still-extremely-portable GitHub Pages site: http://ajashton.ca/decloud/

For those looking into self-hosting, there are many great options these days. https://github.com/Kickball/awesome-selfhosted#self-hosting-... has a full list.

I believe Monit could have solved this, check it out: https://mmonit.com/monit/

I second your self-hosted life. "The Cloud" is just someone else's computer running Apache instead of mine. I will never pay for someone else's servers. That just makes no sense to me.

Maybe someone else's servers wouldn't be down when you post a link to your blog on HN.

As someone who hosts a lot of his own stuff, that's the real selling point of cloud hosting. Not having to care about things like spam filtering, or how some blog you want to publish is going to scale in the face of unexpected traffic.

Also price. I'm not sitting next to a giant hydro dam or solar install where the price of running a server and keeping it cool is near zero. I still want to be able to take advantage of that.

Meh. It's not really a hosting issue, just poor web dev fundamentals. He's clearly using a non cached, basic wordpress installation on mysql. Just the basics of using a varnish or nginx cache + cloudflare would have prevented this. Pretty incredible to believe that people are hitting a database on their index page a for static site in 2016.

None of that is in any way an argument against cloud hosting. Do you think anyone who uses say Blogspot has to care about any of that?

The entire point of using cloud hosting is to pay money to not have to care about stuff like that.

> "The Cloud" is just someone else's computer running Apache instead of mine.

Yes, plus a bunch of engineers keeping the thing running.

Plus a whole bunch of new operational techniques, security concerns, development paradigms, scaling opportunities, service offerings, integration possibilities, failure modes, billing options.

That phrase, "just someone else's computer", has long seemed to me a piece of recklessly dismissive arrogance. Engineering cloud-based systems is simply not the same as off-cloud, and assuming otherwise will lead to dissimilar outcomes.

Do you homeschool your kids? Grow your own produce? Kill your own cows?

I mean, why don't you let experts do what they do and you spend your time doing what you do?

Unless you do servers. In that case, sure. Whatever.

Lots of people home school their kids, grow their own produce, and kill their own cows. One doesn't need to do everything themselves to want to do some things themselves. And if your premise is that one needs to be an expert, before doing anything on their own, then how would people learn? How do people become experts?

I never said that. If you want to learn to manage servers, by all means. The industry needs more good people!

But to suggest that everyone should do (or will do it, as some people are commenting here) it is bananas.

  I never said that.

The implication in your original comment is quite clear, "why don't you let experts do what they do and you spend your time doing what you do?". So, you actually did say that...

  But to suggest that everyone should do (or will do it, as some people are commenting here) it is bananas.

The comment you replied to didn't suggest that everyone should self host, it simply stated a preference. Your comment, however, was the exact opposite, and suggested people shouldn't self host "unless they do servers"

Sometimes, yes. And in each of those cases, the right and motivated person can produce a better product that institutions.

Personally, I self host services on IaaS (Vultr). At least then I have full ownership of my data, and it guarantees I'm running on open source software that can be modified for data extraction at any time.

I do the same. And some times it goes down and I'm busy so it stays down for a day. And I never find time to keep everything updated to the latest security patches, etc. Fun hobby, but I wouldn't trust that as my only repository of data.

Your attitude includes an implicit "trust the smart people."

But the smart people are proving again and again that they are not worthy of our trust. They find bigger and better and stealthier ways to learn about us so they can influence and move against us in the future. Why should we trust anyone who sees us as a product?

You lost me on how you went from "They find bigger and better and stealthier ways to learn about us" (which I agree with) to "move against us in the future". Care to elaborate?

Or to put it a bit more shortly, extreme data collection is a trojan horse, for a brave new world where individual taste, free will, and unpredictability are nearly completely quantified.

You do own your own phone right? Owning a server on the cloud is no different. There will be a future shortly where everyone keeps their data on their own servers instead of handing out to all these corporations.

I own my phone, but the data is still in the cloud.

I'm not sure I agree with your version of the future. People don't know enough ( and don't want to) about security, scalability, availability, etc.

OK, since you own your phone. Do you have any clue about security and availability of your phone? Why do you think millions can own and "run" their own phone but not own and run their server?

You should read the terms of service with your Cloud provider again. When you go out and buy a phone with cash, nobody can take that from you. When you go out and spend money on Cloud servers you will not walk away with that data should you stop paying your bill, or the company is hacked, or there is a scandal and they go out of business, or they decide you're breaking their rules and they delete it. When you setup an externally available NAS from home the only thing stopping you from accessing it is your ISP and your electric company, and those are already common denominators of accessing any Cloud storage medium. And lets not forget Uncle Sam and random Google execs picking up the hood every so often to see what's under there. It's a lot of work, and it isn't for everyone, but the benefits outweigh the risks for me.

"...why don't you let experts do what they do and you spend your time doing what you do?"

I think, mainly, because life is more interesting when you do things you are not an expert of.

Sure. And that's called a hobby. You can do whatever you want, but the point here is this is not what the masses are going to do. Or should do, for that matter.

Makes sense to me.

I can't afford a wide pipe, I can afford Digital Ocean.

If I want to spin up a server for a day or two it's much more economical to pay for a virtual server than buy one and install it in my home.

The clincher for me is email. I'm happy to configure and run a web server, maybe with a caching reverse proxy, couple of synced db servers, whatever. But configuring email just isn't worth it - I've tried. Whilst it can be setup the big players in email seem to regularly blackhole you 'just because' anyway. So the amount of time in setup and servicing just isn't worth it for a handful of domains (basically me + immediate family) unless you've got time to waste. It if a good learning experience, and I do like the control, particularly over span handling.

Even using a (small) ISP, having DKIM and SPF setup, mail sent, even as a reply, still gets spam binned often by Google, Live, be etc..

Practically it just doesn't seem to be something to do on your own.

I've been using Mail-In-A-Box for self-hosted email for about a year and a half, and it's been very low maintenance and fairly easy to setup.

It did take some time at the beginning to get all of the DNS stuff right, but that's a one-time cost. And, so far, I haven't noticed any spam binning once I finally got the DKIM & SPF stuff correct.

I guess part of it could be that since I'm using a lesser known ISP my IP hasn't been blacklisted as part of a large block.

If you still have an interest in self-hosting email, I highly recommend Mail-In-A-Box (https://mailinabox.email/).

What about just the simple fact of internet connection? Bandwidth limitations? Are you on a business line? If not, I probably wouldn't be a very happy neighbor ;)

This is how computer nerds have been doing it since the 80s.

FTFA:

For those that know me, I’ve made no secret of the fact that I believe that you are better off doing something yourself than outsourcing the task to someone else, especially in areas that you are interested in or have some expertise. For me this has particular value in the case of my computing. As a result, I have taken the decision to self-host as much of my online services as possible, rather than relying on the cloud (since that’s just someone else’s computer). I’ve been working on this for years (actually the whole time this blog has been dark and before) and at this stage I’m mostly there: almost all of my digital life is provided by Open Source software, running under my control.

This post will detail what I’m using and how it all fits together. I’m not going to go into technical specifics since otherwise this post would be huge, perhaps I’ll focus on some of that in future posts (feel free to make requests in the comments). Also, please note that my setup is by no means finished and probably never will be, it’s an ongoing project and it has become pretty much my main hobby to install and maintain this stuff. In the Cloud

I’m going to start right here, with this blog, since that was where the whole thing really started. This blog existed well before my undertaking to self-host. In the early days it lived on a shared hosting plan provided by Dreamhost. The site has always run WordPress, although I’ve toyed with the idea of moving to a static site over the years, I’ve just never quite managed it. In 2011 I moved the site to a shiny new VPS provided by Linode, where it has lived ever since. There is also a Piwik install for tracking website stats (which I’ve blogged about before).

The main motivation behind the VPS was to install and configure my own mail server setup, something which I ranted about shortly after. This setup has be serving myself and various family members well since then, with really very little maintenance on my part (almost everything is automated).

There have been various other uses for the VPS over time, many of which haven’t stuck. Probably the most successful has been an installation of TT-RSS, which started life on my home server and at some point moved to the VPS for convenience of access. I’ve also dabbled with various chat applications, mainly XMPP based, but they’ve never really been that useful due to the network effect of no-one else using them! At this stage email has become my primary form of communication.

You might say that this is a bit of a cop out, since this all runs on a virtual machine, which itself runs on someone else’s computer. I would agree, however it’s a nice middle ground between going all out with your own servers and running everything in the cloud. To me the reality that the VPS is in the cloud is obscured by the ability to control every detail of its running software. Its also pretty nice for services which I want to be reliable, since Linode almost never skips a beat. At Home

So the VPS is one thing and is really used for critical services or stuff that needs to be accessible to the wider Internet (like this site), but the real magic happens on my home servers (yes, there is more than one). My main server (now on its second hardware iteration) started life as a MythTV system and still does a great job in this respect. Many other services have been added over time, such as an MQTT broker (mosquitto), git server (gitolite+gitweb), a calendar/contacts server (Radicale) and file synchronisation (Syncthing). At some point I also switched out the MythTV frontend and replaced it with XBMC (now Kodi).

In the last couple of years I’ve been moving further down the home automation route, rather than just sensing and logging via MQTT. I’ve finally settled on Home Assistant as my automation controller and UI, along with an instance of Node-RED to do some miscellaneous processing. This all runs on the main server, with a Raspberry Pi 2 in the garage functioning as what I like to call ‘the gateway’ (it has a couple of radios and some sensors connected and runs another instance of Node-RED to shuttle this data to MQTT). In addition I have my home CCTV set up using a couple of webcams and MotionEye. One of the cameras is located remotely and connected to another Raspberry Pi (this time an old model B) and streams back to the main server with mjpg-streamer.

I also run a pfsense based firewall to protect my network and provide remote VPN access. This runs on an old netbook with an extra USB ethernet adapter. The internal network is partitioned using VLANs to provide a separate firewalled subnet for the home automation gear, some of which is cheap Chinese stuff which needs to be forcibly prevented from talking to the cloud. The networking gear consists of two TP-Link routers, flashed with OpenWRT which provides nice VLAN support. These have been configured to just provide switching and wireless access points and delegate all the firewalling, DNS and DHCP stuff to the firewall.

Within the last year or so I’ve been working on streamlining the management of all of this. The principle focus of this has been monitoring all the services I’ve got running. For this I’ve settled on Nagios, which I run in a separate VM hosted on the main home server. Although complex to set up, I can’t talk highly enough of Nagios, it’s brilliant and it saves me so much time just by knowing what is going on on my network. Email notifications from Nagios of course go via my own mail server! I’ve also played around with collectd, InfluxDB and Grafana for performance graphing, although I’ve yet to deploy this to everything. Conclusion and The Future

So that was a probably non-exhaustive list of my self-hosting activities. I’m sure I’ve probably forgotten many things and of course there are the huge amounts of supporting software that I haven’t mentioned. As I said, I’m now at the stage where this meets almost all my computing needs although there are a few areas where I want to improve.

The main thing is automating and persisting my configuration, since I’m still mostly doing things manually. For this I’ve settled on a combination of Ansible and Docker. I’ve played extensively with both but haven’t really made much progress with deploying them for much more than testing purposes.

I’m also constantly evaluating new software to fill gaps in my ecosystem. I’m currently looking at Rocket.Chat and Hubot to provide a chat based interface for remote administration, but don’t have a usable system yet. I’m also toying with the idea of a Gitlab server to replace the gitolite+gitweb system and to utilise the CI in my automation strategy, but I’ve heard it requires a bit in terms of resources (incidently gitlab.com is really the only 3rd party service I heavily use).

That I am able to do this at all is a testament to the power of Free and Open Source software and cheap commodity hardware. I find it pretty awesome to think that almost every interaction I have online utilises my own infrastructure and that it works tirelessly for me 24/7.

I’m only just getting started documenting my setup here, for instance this post hasn’t touched on any of the client applications I use on my phone and desktop machines. I’m also going to do some more technical posts on various aspects as time goes on, so please stay tuned (or even subscribe to the RSS feed or mailing list!).

What to do when your self hosted life crashes? Get a new life?

Wait is this a joke? Like if you self host, you're stuff gonna break and you have to deal with the maintenance headaches? ¯\_(ツ)_/¯

"Error establishing a database connection" Oh the irony :) Poor guy!

"Error establishing a database connection"

We did it once again!

  My Self-Hosted Life
  "Error establishing a database connection"

I think this may have been one of the more unintentionally ironic and hilarious blog posts Ive seen in awhile.

While I run my own server for some personal projects I'd never advise people to do it unless they absolutely have to. The maintenance, security updates and embarrassing events like these for the most part are not worth it.

Static IP address too

Just as many non-self hosted Wordpress installs go down. It's Wordpress that's extremely slow.

Edit: Besides, the article mentions "the VPS is one thing and is really used for critical services or stuff that needs to be accessible to the wider Internet (like this site), but the real magic happens on my home servers". That isn't the self-hosted part anyway. /end of edit.

> I'd never advise people to do it unless they absolutely have to.

I'd compare it to work. When doing a project for a client, all else being equal, you'd rather have them pay a bit more so you have more time to develop a great product. Rush jobs are never fun and you usually have to cut corners. If you can make your code nice, it can be made flexible and neatly extendable.

Same for hosting: yeah it takes a little more time than getting shared hosting, but it gives you so much freedom to install and configure your own software. Save for perhaps mail servers, it's pretty much always worth it in the long run if you can afford it in the short run.

Reply on news.ycombinator.com