Dank-selfhosted: automated deployment of email, web, DNS, XMPP, ZNC on OpenBSD
github.com
github.com
[1]: https://github.com/vedetta-com/caesonia
[2]: https://news.ycombinator.com/item?id=16392096
edit: formatting
You could probably distill that from their scripts. Be the change you want to see in the world!
Cloudron I've heard is excellent, completely dockerizes and automates everything with a slick webui, has lots of apps, however I just am unwilling to pay $15 a month for it.
Will likely roll my own apps/services with Rancher/haproxy/LE (or traefik as the reverse proxy/SSL term) on my sufficiently beefy Netcup rootserver KVM instance (at 8G should handle everything I want to do, but will likely use up most of it's resources which is fine).
In return it places some restrictions on how developers build apps, which unfortunately means that it can't take advantage of all of the existing open source apps out there without extra work. But hopefully as people start to prioritize having control over their data, the app ecosystem will pick up steam.
Ha. I'm not sure of the intent, but I like this as a naming pattern for different kinds of projects.
Maybe awesome is friendly and optimistic.
Whereas dank is a little more "Really not suited for the general public, no automated password reset, no web GUIs..."
A one click "email" server which allows you to receive emails from anywhere but only send emails to addresses on the current server. If I don't send emails, I don't need to worry about people not being able to receive my emails, right?
I have a small instance on AWS that forwards my outgoing email and it works great.
The use case I'm thinking is let's say I have a domain like foo.bar. Each user gets a sub domain like user1.foo.bar. User 1 can send emails to anyone with an email address of .foo.bar but nobody else.
User 1 can get emails from anyone at anything* at user 1 dot foo dot bar
For example, facebook at user 1 dot foo dot bar
The main benefit this project would have is zero customization. No setting is customizable and the whole thing is an appliance that keeps itself up to date.
Thoughts?
I think it would be easy to get one person in a family to pay for hosting while another person keeps an eye on updates and backups. Same with groups of friends, even if most are broke / not willing to pay, if just one would pay it would be trivial to host a few hundred friends on one install and a few hundred family members on another.
Buddypress is mature enough with enough plugins to do most of what fbook and similar offer all for free. Only thing I don't really know is what kind of mobile notifications options are out there and people would expect or need, as I don't use fbk the same way others do.
But groups, pics, vids, messaging, profiles, privacy settings, these things are fairly easy with BP really.
An intro to your parts suppliers and negotiating mates rates would also help.
EDIT: I get some grandmothers/fathers could be proficient in this, and power to them for being so. Mine are not, and I’m not going to waste their time teaching them when they’re mostly concerned with living out the remainder of the lives with family, etc.
99% of the time it was fine, but then we'd occasionally run into some odd spam vendor who had blacklisted our IP address (presumably from someone who had used it to spam a decade prior).
Maintaining our own spam filters was a bit of a pain.
For our business, I'm pretty happy shelling out $50 a month to have someone else (Google) take care of everything. I'm basically paying that for the security of knowing my e-mails are actually being delivered. Pretty sure most people feel the same.
My server sends and receives properly. Not my problem if others have misconfigured email servers
Cmon.
But of all the options available, self-hosted was the least reliable.
It is a sleight of hand that the big cloud corps have gotten people using the word “public” to describe them.
"Your email address is your identity. We are talking the rest of your life. I’ve done custom hosting for 10 years. My first email host got acquired by a conglomerate. That has not been pleasant or confidence-instilling."
"Need to remember, having your own domain means you need to stay financially capable at all times. You end up in hospital and bills lapse and domain scooped by a squatter? Get ready to start over in life like you’re 12. People do not appreciate what it means to have free email."
I would like to believe I'm savvy and diligent to self-host my own email. Odds are I probably am.
But the downside is colossal. One small fuckup on my part, and I lose access to my key to, basically, every institution I engage with. Irreversibly. Even if it never happens, the thought that it could would be a constantly pressing weight in my mind.
I suppose hosted SMTP from a hosted service like SES or Mandrill could work, as long as inbound email was handled directly by my own server. There is also the matter of spam, but it appears there are many battletested solutions for that. The last thing I need is wondering if my emails hit the spam folder or not. I worked for a company with email delivery issues associated with the corporate domain once... it was difficult to do business.
Edit: To clarify - if one line of code is fd in any of the daemons you’re running you’ll lose everything.
Practice defense in depth.
Minimize the damage possible.
For example, driving is convenient. That doesn’t mean someone who has never driven before should just drive. It’s definitely better for them to taxi.
It’s a hard problem - we have to make things easier for people.
When King Sejong saw that people were illiterate, he didn’t try to force everyone to suddenly learn a difficult language - he just made an easier one.
Now korea is 99.9% literate.
That being said, for example, let’s say pledge or unveil have one line of code that is fd.
You can’t put all your eggs in a basket given the probability that something is fd.
Downvoting my statement is fine as long as it’s noobs learning from this script and not someone who is running critical infrastructure. :)
But you'd be doing that no matter what unless you're running each daemon on a different physical machine. That basket's just called "Xen" now instead of "OpenBSD". Worse, if the hypervisor has a bug that can be triggered from unprivileged guest code (i.e. as a non-root user in the guest OS), then any layers added in the guest are moot.
https://www.openwall.com/lists/oss-security/2018/07/26/2
https://www.openwall.com/lists/oss-security/2018/03/17/2
Lots of points in a short time with few or no comments will push an item to the top.
No RBLs? I see cullum hasn't spent any time running a mail server.
One can scan the whole IPv4 address space in probably an hour, so you'll find any service you want to find. You might say, "I have a CDN in front of it", but that is just basic firewalling (or reverse proxying) and not really worth of being called "IP obfuscation".
It may be weak security to keep a bit of cash in my cars glovebox rather than in plain sight, but let me tell you how effective it is at keeping my windows from getting smashed...
That reminds me of the good old days of the Interwebs: Your computer is currently broadcasting an IP address!