Hacker News Reader

Comment by zxcvbn4038 | Hacker News Reader

I’ve been using gitea for a number of years - before GitHub started letting people have private repos for free it was about the only option for a self hosted private repo with a GUI. It’s written in Go which makes it very convenient to run from a usb stick. It also has a feature to mirror other repos and I use that to keep local copies of projects I follow - and has saved me a couple times when the project authors decided to delete their repos or YouTube decided to not host them. Today I use gitea to host my private development server as a Tor hidden service which makes it easily accessible from almost anywhere - though many major hotels chains will ban your MAC address locally if they see you connecting to Tor servers, but never had issues while at an AirBNB which is where I spend most of my time these days.

View on HN

> as a Tor hidden service which makes it easily accessible from almost anywhere

I have a wireguard with the server running on a small VPS, which is useful for both ignoring filtering on public wifi and getting into my home network from wherever.

I'm thinking of doing this but at the same time I'm afraid of exposing my home network to a remote VPS. Am I being too paranoid about this?

If I do go this route do you have any suggestions with respect to security?

I have a similar setup and I was also quite paranoid at first. Wireguard is a very solid solution that does precisely what it claims to do and allows you to layer extra network controls on top of it, so the vpn clients only get routed where you allow them to.

A bit less hands-on solution could be something like tailscale.

The VPS is running sshd (pubkey auth only) and Wireguard, and I also see bound UDP sockets for dhclient and ntpd. And that's it, at least for the public interface.

Also, things I want to look at on my home network mostly work fine over ssh (console stuff, git, etc). So I haven't actually gotten around to setting up full routing yet, and use the wireguard endpoint box as an ssh jumphost / bastion (and can forward ports if I do have something to get at that doesn't like to play nice).

You can lock down a wireguard vpn server pretty hard, because wireguard itself is essentially invisible unless you know it's there. It doesn't respond to anything but well formed, correctly signed (in the case of connection initiation) or encrypted (for the actual network itself) packets. So conceivably, you can have your vpn server not respond to public icmp, not expose even ssh without wireguard under it, and be essentially invisible to the internet.

If you are not replying to ICMP you let everyone know that you are there. If you we're not there, the error would be 'no route to host', but there is a route, so you must bei there

For me, https://tailscale.com/ gives me an easy-to-use personal network. It uses wireguard with custom configuration on top of it.

One of the benefits to Tor is you don’t need to open any ports, the Tor acts as a reverse proxy for onion services. A lot of Tor services run over port 443 because it gets passed through with little to no issue. With Wireguard you have to deal with all the networks, particularly airports and businesses, that don’t allow UDP. I’ve had a good bit of luck using the dns and ntp ports for wireguard but if your on a network that has something filtering/monitoring dns or only wants you to use their time server, those can stop you also. Once http/3 is official that should make things better for everyone using wireguard.

Plus tor hidden services -or whatever the current nomenclature is- offer a fairly robust and painless story for authentication in this "sorta VPN" scenario. Generate a couple extra keys and invite a friend and his bots.

https://community.torproject.org/onion-services/advanced/cli...

I do the client auth feature. The chances of someone stumbling across my hidden service is pretty low I think, but it’s not zero. With auth set up I don’t think a Tor client can even get the Id of the rendezvous server without having the correct key.

I think headscale/ other mesh vpns would be better choices so you can get direct connection to your home instead of passing everything through the VPS.

>it was about the only option for a self hosted private repo with a GUI.

Bitbucket had free private repos for a long time. There were other services as well.

Side track, but what circumstances/choices lead to spending most of your time at AirBnB’s?

I didn’t leave my apartment for two years because of Covid and decided a change of scenery would be nice, so my family and I have been bouncing around rural AirBNBs for about six months. Though we’ll have to go back in another month - my son really wants to go back to in-person schooling, that is starting soon. But back to the woods as soon as he gets tired of high school life!

Was Gitlab around?

Timeline:

2008: Github launched

2008: Bitbucket launched

2010: Atlassian purchases bitbucket, makes private repos free

2011: Gitlab launched

2014: Gogs (Gitea's predecessor) first public release

2016: Gitea forks from Gogs

So at the very least, bitbucket was established and gitlab was around

And even before Github, there was Trac [https://en.wikipedia.org/wiki/Trac]

I'm not sure when Git support was initially added to Trac, but TracGit 1.0 released in 2012.[0]

[0] https://trac.edgewall.org/wiki/TracGit

Yes, that's when it was included to Trac 1.0 as a built-in plugin. Before that, it was a 3rd party plugin you have to install yourself. I remember using it before 2010 and I'm pretty sure the plugin pre-dates github.

Trac is without a doubt the most frustrating product I’ve ever had the misfortune of working with.

I don’t even know why. Just seeing the interface rubs me entirely the wrong way.

Personal choice but indeed Trac is very nice and is still used by high profile projects like Django (especially supporting ticket triage) and Twisted Matrix.

Indeed fossil-scm [1], has same interface as Trac (in my view partly inspired by it). Have used Trac for a long time, so can't complain, it works well, its simple and flexible.

[1] https://fossil-scm.org

I mean, if we're counting Trac as the same, despite the drastically different UI and project-first rather than code-first focus, then we also need to count Sourceforge, which was open source in its first (2000) and third (2009) incarnations.

Nice timeline. One thing to point out though is Bitbucket only supported Mercurial up until October 2011.

Gitlab is great, but it also is pretty resource hungry. I opted for Gitea for that reason, so it would be viable on the cheapest Linode server option, and I've mostly been satisfied with it, thus far.

Same, there were a number of GitHub like services you could self host but gitea stood out to me as the easiest to install and maintain. A lot of the other options I looked at required multiple daemons, a full database, etc. Gitea can use a full database but works great with SQLite also.

Reply on news.ycombinator.com