Hacker News Reader

Comment by vladvasiliu | Hacker News Reader

I've seen the other day people talking about Heimdall in a thread about self-hosted things.

I do run a (distributed!) homelab, but it's not clear to me what problem these dashboards solve.

I can split the things I run on my homelab in two categories: either "infrastructure", things like VPNs, routing, DB, etc, or "actual apps", like a wiki and whatnot.

For the first category, I basically don't "do" anything to them once they're set up.

For the second, I type directly the URL as I do with any other website.

For my monitoring needs I have a bunch of Grafana dashboards connected to Prometheus. I check them from time to time because I like looking at the pretty colored graphs for some reason, but that's about it.

View on HN

Regarding your second point: When I initially configured my Cloudflare Tunnels + Access setup, I spent way too much time getting the App Launcher [0] nice and pretty. Seemed really useful seeing as I came from a setup with VPNs and internal IPs, but did not realize that because Cloudflare Access gives you free pretty URLs, I would never look at it again…

0: https://developers.cloudflare.com/cloudflare-one/application...

That’s really neat. I want to expose some self hosted services externally. Is this a good option? I see that there’s a free plan. How’s it working for you?

I'm also doing this and I like it.

One of the most useful things for my case is the access control. Basically, I want my services to be accessible from anywhere, but only by me. This allows me set up authentication before the requests even hit my server.

If you want your services to be world accessible, that works well, too. They even have an agent that initiates the connection from the server, so it works well behind ISP CG-NAT, dynamic IPs, etc, and you don't have to mess around with incoming connection filtering.

This is really cool. So I just exposed an instance of next cloud, but it requires an email verification before being accessible. Super cool.

Is the cloudflared smart enough to route connections locally? Hm, not sure how that would work.

I'm sitting at home, but accessing my nextcloud through the cloud flare. Is there a way to get it to talk to nextcloud locally or is it going through the net?

> Is the cloudflared smart enough to route connections locally? Hm, not sure how that would work.

Do you mean have cloudflared expose your local server locally? No. It's just a reverse proxy of sorts between cloudflare's network and your local server.

What you want can be achieved with local DNS, so that nc.tra3.com resolves to <cloudflare-ip> from outside and to 192.168.1.2 from inside. But you should probably also have a local certificate for this to be fully transparent.

Yeah it’s the typing bit I can’t bothered doing. Heimdall has all the IPs and ports with an easy to recognise icon. Save’s me remembering things when I want to do things.

It is my ‘job to be done’, and it does it well.

That is the problem these things solve.

I guess the distinction for my setup and the parent poster's is having an actual DNS setup? Typing foo and letting it autocomplete to foo.xyz.com in my address bar is faster than going to a dashboard and then clicking a link on the dashboard.

Some people like clicking at things.

For me, if I have the browser already open, it's control-L type a few characters enter to get to most of my usual destinations.

A lot of people don't have nice urls for their homelab services, having to memorize IP-numbers and ports is a lot harder.

Personally I get a nice feeling of accomplishment from looking at a dashboard with all the services I've set up. It's maybe not super useful but it's nice.

Fair point.

It's true that in my case, one of the first things I did was set up DNS. My lab also has a public domain name that I manage through Cloudflare, which also gives me easy SSL [0] for my services.

---

[0] "easy" as in I don't have to have an open port for Let's Encrypt. And I'm also uncomfortable with giving full DNS access to every service, because I haven't yet found a registrar with sane access control for zone management.

I've never tried this before, but take a look at https://www.eff.org/deeplinks/2018/02/technical-deep-dive-se..., specifically the CNAME and ACME-DNS methods.

I was familiar with the CNAME workaround, but it's not practical, since I'd have to manage X different zones, one for each redirection. I thought about abusing DuckDNS or something similar for this, but I figured it wouldn't be fair, so I never did.

At one point I set up an internal Smallstep CA [0], which kinda worked but was pretty fragile, so I abandoned it.

I didn't know about ACME-DNS. It looks interesting, but for the time being tunneling everything through Cloudflared works well enough for my needs.

[0] https://smallstep.com/

So what I did was put acme-dns on a publicly accessible server I have, and use DNS zone delegation to that, as like you, my provider basically gives you an all or nothing API key as far as DNS access goes.

>A lot of people don't have nice urls for their homelab services, having to memorize IP-numbers and ports is a lot harder.

There isn't much excuse for that though. In a homelab setting in particular I think you should just run your own DNS and CA with your own domain. The Name Constraints option is handy there for containing scope (also useful for restricting the scope of any other internal CAs a business might ask you to run for example via cross signing).

I don’t want to remember names either. I type in ‘hei-‘ in the browser, it autocompletes to Heimdall, then I click the shiny button of the thing I want.

Is that any different than me typing 'gite' and it autocompletes to my gitea DNS, or 'jell' and it autocompletes to my jellyfin?

I'm guessing if you are self-hosting these things they are used often enough that they would be in the top of your autocomplete?

Hah, I don't want to remember either. I have 18 services, so it's nice to have a catalog of what I have installed.

I don't suppose either of you have considered, you know, bookmarks in your browser ;)? And for tons of services a dashboard wouldn't be my first choice for cataloging/planning anyway, there are other tools for more or less automated planning/deployment/herding. One still often needs to actually know some addresses too just to make use of services in non-web contexts, and a way to have things not break if IPs need to be adjusted. And you still need some way to make sure everything is talking securely. More than one way to do that too but CAs scale pretty well and have decent general support even amongst end devices.

But for a homelab whatever one wants ultimately is fine, whole point is to experiment after all!

> I don't suppose either of you have considered, you know, bookmarks in your browser ?

One commenter mentioned sharing some apps with other people, so browser bookmarks may not be the best solution.

I've actually been looking into self-hosted bookmark managers yesterday, some of which can handle sharing. These may work.

My use case is somewhat similar, in that I sometimes use PCs different from my main one, and they also use different browsers. But I haven't found anything that I felt like taking for a spin.

Bookmarks don't show me the status of the apps. I also use multiple browsers in multiple devices so my bookmarks are... scattered. Very fault tolerant, because they exist in multiple locations in different forms. That's something I have to centralize. Someday.

In theory I agree, it's not hard and if you can run a homelab you definitely should be able to set it up. But from what I've seen a lot of people done.

If you don't have DNS you can't have publicly trusted certificates, I'm very doubtful homelabbers go through the effort of getting servers, configuring services and the lot without the most rudimentary protocol in place. Self-managed or not, it's VERY essential with functional DNS

I've got about 15 of those "actual apps", and my family and friends use some of them too.

I can share one homepage to all of them, and only update one place if there are changes.

Dashy also has status lights for services, which isn't a replacement for real monitoring, but has been useful.

Reply on news.ycombinator.com