A guide for getting started with self hosting
github.com
github.com
Not knocking OP, but a "guide for getting started" seems like it would be a howto for self hosting. This seems like a giant list of tools.
I only note this as I work at a place that self-hosts everything as we already have an on-prem data center. For example, we use openstack for our users to spin up VMs. If I did a guide to self hosting, I would talk briefly about the design choices that led me to openstack, and then about how to prepare for and install openstack. It seems like this guide is more like "you can use openstack for cloud". Needs more "guide".
It's a reference because it's information-oriented, and serves users who want to look up something based on category or keyword.
A "guide for getting started" would be a tutorial, serving the needs of the user who is at study. It should provide a successful learning experience.
The project would also benefit from how-to guides, to serve the needs of the user who have a certain task in mind that they want to accomplish.
Just install nginx from your repos and <html><head><title>My first website</title></head><body><H1>Wow! Hi.</H1></body></html> into a index.html and put in in your www directory. Done. And done in a far more secure, far longer lasting, far less fragile way than anything involving containers or "deployment".
25+ years later and the same steps are still possible to get the same result. I very much doubt k8s and Docker and whatever fancy new technology of the month is being pushed will have the same longevity. Simple technology rules.
The current model for a lot of self-hosted software is "make money with a SaaS offering", which is a fine model IMO, but now you have to cater to two different scales: the small "downscale" of the self-hosted user, and the larger "upscale" one of your SaaS offering.
I actually work on one of those "open source with SaaS offering" things, and it's a real challenge to unify these two use cases because the involved tools are quite different, and I don't want to implement everything twice.
Docker can offer a solution to abstract the complexities that are required, although I agree it's not a good solution to 100% rely on it (which is why I don't do it).
My complaints mainly stem from how docker is often kind of finnicky, eg in a previous setup of my server, I had to put everything through a VPN, but Docker didn't play well with a VPN running on the main system, so I had to limit myself to things I could install without Docker until I had to migrate to a new install.
Another issue I ran into with migrating servers was restoring a Postgres db dump to docker, which similarly didn't have much documentation, so for that I had to resort to a traditional setup. Which made me pretty happy that they at least support traditional setups, even if they lean more towards Docker.
What you find annoying is empowering tons of people like me to run lot of software. I can try lots of software I wouldn't have bothered with due to ease of setup. I don't bork my host machine when I make mistakes. I just start delete the container and start over, with a few adjusted settings before build or compose steps.
1337 hackers can run circles around me for sure, but I have a freaking datacenter in 3 computers at my house. All of them are internet facing with Cloudflare tunnels pointed at the services I want to share or use away from home. It has never been this good.
I want to be able to consume and run code provided by other people on hardware/networks that I own.
In which case - Docker/Containers/K8s(or my preference, MicroK8s) are a fucking godsend compared to 10 years ago.
I host about 25 services, I have all the config in a single repo, and can rebuild the whole fucking thing in about 10 minutes.
Adding a new machine to take load is as easy as installing ubuntu server, adding microK8s, and running a SINGLE freaking line on the cli. Boom - done. I do this basically each time we get a new machine... the old one goes to live in the server farm.
All the backups? Easy, since the storage is my NAS, mounted in microK8s, and I can just run scheduled backups there for literally every new service, without any additional config as I add them.
It's incredible. I have done the whole "SSH into each machine and tediously configure it to run a specific application, configure my router, make sure the config files are in the right place, configure backups, worry about HDD lifespan, etc" bullshit for long enough to know that I don't EVER want to go back to that.
The people that keep talking shit about containers are still incredibly focused on the use-case of "I host my own blog" like that's all that self-hosting is. But it's not - I self host open source applications as a complete replacement for shitty, ad-driven, recurring subscription fee based SaaS companies.
Meal planning (mealie),
Calorie tracking (calorietracker),
Video streaming (jellyfin),
Google Docs/Notion/etc (bookstack/nextcloud),
Authentication (keycloak),
File sharing/storage (seafile),
Digital Library (calibre),
Home automation (openhab),
Asset tracking (snipeit),
todo lists (Taiga),
scheduling (cal)
etc...
Containers aren't there to help you host your blog. They're there to let me host your application. Configured quickly and simply.
If there's company making money through a recurring subscription based website... There is someone who has made a decent clone that I can self-host.
And these tools make that process much easier than it used to be.
You need to be careful with your mount options here, since soft mounts can cause corruption in some cases and performance is not fantastic (although nfs v4.1 is better than nfs v3) - but overall it works and keeps backups strategies simple since everything is on the NAS.
Sadly - it's fairly slow (sqlite in particular is painfully slow when under lots of load and needs care to ensure only one machine is writing to it at a time) but right now I'm avoiding more complex setups since it's not normally a problem with just me+family using things.
Long term - I've been considering moving to iSCSI, or something more robust, but it just hasn't been worth the trouble yet.
Did make me like sqlite a whole lot less though - I opt for mariaDB/Postgres on any service that supports a remote db - they seems to do just fine. 3 years in on this setup and no corruption outside of sqlite on a soft mount (which was solved by reverting to my last backups).
You'd be surprised what you can do with simple files and a single static webserver.
What makes running these things easy isn't the container but that the software is packaged at all and would have the same effect if it were done through a conventional package manager. So of course docker seems like an upgrade when the only other thing they're offering is a loose distribution of files you have to manually copy in and configure.
... i have a vpn and my docker containers work just fine?
Tedious.
In what way does _only_ having a docker install option empower you?
GP wasn't stating that docker is bad, but docker _only_ options are bad.
There are many use cases that are not yours that docker doesn't suit.
For me, containers are just abstractions similar to packages, or OOP objects, or even apps. And as long as a service fits into this view, I think docker provides a great way. But, sure, you can overdo it and end up with more complexity than less (e.g. Nginx Proxy Manager).
I don't even futz with nginx anymore. You don't need to do that with tunnels. This assumes you have created a tunnel with required domain name. Very, very easy to setup.
1. Create container 2. Open Cloudflare ZeroTrust 3. Create a hostname for the new service or app; heim.example.com -> http://localhost:port 4. Save it. 5. Done. -> access the service from http://heim.example.com from anywhere in the world 5. For extra security, register the app in zerotrust with an email verification policy with emails you trust or use a token, or what ever auth you like.
So your solution for self hosting is to use a VPN not self hosted?
On a more serious note though, both technologies have their uses. Docker can be nice for ad-hoc hardware provisioning without needing to think about much, but I think the GP's comment is still relevant. For a lot of users who are completely unfamiliar with bash/Linux, Docker will be impossible to grok. For the average HN engineer sitting at their Mac, it makes a lot more sense to get nginx/apache from Brew and tinker with it natively.
I'm not fucking interested in "tinkering" with nginx/apache to host my own software, I'm interested in herding dozens of open source applications that replace paid/shitty ad driven SaaS companies.
The contract with docker is incredibly simple - you give me the path you're saving data to, a couple of ports to point at, and some ENV vars to provide config - I do the rest.
Boom - suddenly I can easily host literally hundreds of dollars per month worth of recurring subscription SaaS products using my own hardware and networks. All without having to see ads, or risk external data breaches, or deal with user tracking.
Which is the point, when the goal is to self-host someone else's application.
If you're just interested in learning how networks work, or what http is, or how to write software - then sure, go tinker with apache or nginx.
If you're trying to self host, containers are great. They do exactly what you've said - applications become (mostly) pushbutton components where the contract is simple and clear (data/ports/env).
And yes - there certainly is a bit of a learning curve for containers, but I'd much rather learn containers once than have to learn the ins & outs of the 25 apps I self host. For the most part, I neither want nor care to learn how they were put together. There simply isn't enough time, and the value is low.
Again - the goal here is NOT to host a blog/website I've made. It's to self-host applications other folks have put together, and that seems to be where this reference can be valuable.
As someone who enjoys self hosting my own applications like Nextcloud, Ghost, Matrix/ Element and others, I think using Docker containers does actually makes sense here. I'm also a big fan of the KISS approach, as you are saying. However if you are trying to orchestrate multiple apps on a small home server or SBC, the installation and maintenance can become a huge headache very quickly. Especially if some of those apps have conflicting dependencies.
This entire thread reminds me of the inverse relationship between actually blogging and messing around with blogging setups, https://rakhim.org/honestly-undefined/19/
As for hosting your own Matrix homeserver, sure, that's such a heavy and over-complex protocol that changes rapidly and uses libs that change even faster. You'd want to containizer that.... and probably give it it's own computer instead of your desktop or an SBC since it's going to take a lot of system resources. Or even better, don't use protocols that are so unstable you can't run them natively.
Did you try anything else before slapping cloudflare in front of your setup?
To fully automate, you can use a premade tool like autossh, or just replicate it using standard ssh with keepalive option + a custom sysd unit file.
If you want to self-host a solution, few things to keep in mind:
- Rate-limit "heavy" (RAM, CPU, I/O) processes that can be externally triggered via HTTP calls or similar (if you have a HTTP endpoint for regenerating a cache or something like that, make sure it can only be called max once per hour, and so on)
- Setup fail2ban, and things like mod_evasive if you're using Apache (I'm sure Caddy/nginx have similar solutions)
- Only expose what you really want to with iptables
Ultimately, unless you're hosting something really popular or controversial, you don't really need to be scared about being ddosed. People don't spend resources just ddosing random stuff without a reason for it, and unless it's popular/controversial, you just won't get hit by anything but random port scans/vulnerability scans.
That’s what made ddos so effective when it first came on the scene. Stopping or mitigating one took a lot of time, phone calls, and coordination between service providers.
Edit: another thing, a large scale ddos on a residential IP address will for sure get the attention of your ISP. If you’re running something that may get that kind of attention check your TOS :)
It's not great, but it's not the end of the world either, and doesn't actually incur any risk to your data or home network. Hell, if you want to learn mitigating this yourself, open Wireshark on your WAN interface, get the attacking IPs and send out abuse reports to their respective hosts. You can clear most script-kiddie "booter" style attacks like this in a day, dismantling their botnet in the process.
I would still be hosting at home but where I live it's nearly impossible to get a static, routable IP.
That's a big problem for servers on residential IP ranges.
Do you have any resources you can share about this subject?
I'd like to see some of those scripts that use CF API to detect and update IP in dynamics public IP environment.
https://gist.github.com/thedanbob/df4cc49aa3e60581e010f443ac...
I actually use this to announce my internal address, even without a web server, just by accessing a locked port on the server, where the firewall logs this access.
I've been using it with NameCheap pretty successfully for a while now, here's an example of some of the integrations it supports: https://ddclient.net/protocols.html (sadly no DigitalOcean integration as of yet, but this might be of use to others)
For actual reachability, a lot of people use VPNs, network meshes (Tailscale, ZeroTier, Nebula, etc) or secure proxies (Cloudflare Argo Tunnels).
You can also self-host software on VPSs or cloud servers.
A personal website is something you do for fun. If this personal website is serving as your resume to get hired or sell stuff, it's not a personal website. It's more commercial/profit crap. At that point, yeah, use all the cargo cult you want. Business want to see the tools and technologies they use demonstrated.
I've been hosting superkuh.com from my home PC for 20 years. When my IP changes (maybe once per year) I just log into my registrar when I notice it (it's okay if I don't notice for a day or two, no big deal) and update it.
Recently I've been looking through them including the self hosted one and I suspect about 10-20% are in fact ads basically paid product placement. Usually can't even be self hosted just a paid service for an instance. That's not self hosting.
A decent chunk are not practically selfhostable. I mean not for a mere mortal. Like those guys who seem to run synapse on a rpi3. Everyone else needs dual core with 6gb RAM. Again I wonder if those people actually even used the self hosted version?
Am I still ranting? Guess I had more to say than I realised.
This guide lacks the most important tools: fail2ban and tripwire. I block on the order of 5,000 malicious requests a day (mostly recon bots) from Russian and China.
As long as you aren't doing silly shit (like exposing password based ssh, or running your containers as root, or failing to make backups) then they can knock all they'd like.
They'd have to first find the app you're running, then attack the application to get an exploit, then manage to find a privilege escalation from the container, all for what, exactly?
Send more requests from my network? Break a couple of my services that I don't derive revenue from? I'm just literally not worth the trouble in almost all cases.
It's like 10 minutes to recreate my whole cluster from clean images (20 if we include wiping the OS on the machines).
If you're really concerned - shove the cluster behind tailscale/cloudflare/vps.
The guide was missing this which I think cheapens the guide a little to me because security can be a large portion of the cost of a SaaS service you might pay for.
I feel like this is confusion on your part - do you have a service/port that they are actually making real requests against where there is risk? Ex: Password based ssh access, or something like phpmyadmin running and exposed?
Basically - if they're just hitting ssh on port 22... as long as your auth is cert based (or better yet, just not exposed publicly at all) who cares?
If they're requesting random paths for wordpress admin sites or something like phpmyadmin... again - who cares? You really don't have to do anything unless you're running those services.
I agree you should keep an eye on the logs - but mostly this isn't as big an issue as people tend to make it out to be. Proper auth on your services (ex: keycloak behind mfa) means the risk is just really, really low - and you really aren't worth the serious effort it takes.
Basically - A malicious request is NOT equivalent to malware. They can make lots of malicious requests - in practice, all of them just fail.