Hacker News Reader

Comment by ktpsns | Hacker News Reader

If you don't need all that cloud operations/deployment infrastructure, self hosting a website from home in 2023 is as easy as it was in 2003. Get a DDNS, do the NAT port forwarding, run some apache/nginx/whatever and push your files with sftp or similar to the server. In contrast to 2003, upstreams got better -- even Germany has average upstream speeds of 20mbit/second nowadays [1]. With 20mbit/sec you can do quite something with a page-only website and contemporary event based webservers. And thanks to SoC systems, energy consumption is a no brainer.

[1] https://www.statista.com/statistics/1338657/average-internet...

View on HN

Honestly a basic VPS is a lot easier to me than running a physical home server. Dirt cheap, never have to worry about power failures, dust, heat, home ISP being shitty, etc.

I do both. I run a home server with several services that are used by me when I'm not home, and by my close friends.

I also use a VPS for services intended for the general public.

Doing both makes a lot of sense for development as well... you don't want to pay for a VPS for something that isn't going to be developed to completion or run full time, save that for the real projects.

I run vpcs and homeserver I avoid all the DNS and port forwarding issues by having a wireguard Server in obenbsd that also runs unbound, so i habe some internal DNS entrys for stuff i host at home linke Cale der and co tacts

I have only a static website with not too much content or traffic, I even use the free oracle VPS that they offer. It took some while to get the hang of ingress rules and opening ports in their interface in addition to the CLI but now it works and I’m not paying anything. Out of curiosity: where do you get your VPS?

> self hosting a website from home in 2023 is as easy as it was in 2003. Get a DDNS, do the NAT port forwarding

Did they have CGNAT in 2003? Because that breaks everything.

Even from the client side, CGNAT can break a lot of things. I'm very glad that my mobile provider gives me IPv6 as well - that allows me to get to my home systems without any NAT in the way. Even hotspot clients get an IPv6.

Of course, IPv6 is its own can of worms, but (cross my fingers) it's working for me.

I wish I could get both. Alas, I’m not behind a CGNAT and getting IPv6 would require giving that up :/

Use 6in4.

also tailscale could be an option.

CGNAT is both amazing and shocking. Amazing in that it kinda works. And shocking because the average person will never know why their shit is broken.

For me it broke online gaming. Luckily my ISP simply gives a static-ish IP to anyone who has an issue with CGNAT. But some ISPs force you to pay for a static IP, and some don’t even offer static IPs. I mean, I’d pay, but soon that won’t even be an option. It’s scary.

For me 2023 is exactly like 2003 from this point of view: a dynamic DNS account with inadyn/ddclient to refresh it when the IP changes, and it's almost like having a static IP.

Even better if you have e.g. a Linode or any server with a public IP that can run Wireguard or OpenVPN. Then you can run your own VPN server, configure your DNS, and connect to anything from anywhere.

Yggdrasil (https://yggdrasil-network.github.io/) is also another interesting IPv6-based solution - I have played with it a bit, but I still prefer to use my VPN, and do nginx reverse proxy from my Linode to my network over VPN when needed.

I'm in the US so I pay over $100/mo. for 15mbps upstream, but at least no NAT.

I would argue it is much easier now. There are a ton of distributions who are catering for this use case, yunohost is probably the most well known one, but there are a lot more if you look on the awesome selfhosted list.

I would also say that if you only want a static site the OPs setup is almost overkill. Just install caddy and a dyndns service. Takes care of the certificate for you and is super simple to setup.

FYI, Caddy has a DDNS plugin https://github.com/mholt/caddy-dynamicdns. Works with any DNS provider that has a Caddy DNS plugin which you'd typically use to solve ACME challenges, but instead it will set A/AAAA records.

This is new to me. I was going to run a separate DDNS for my homeserver, but given that the domain is only used in Caddy anyway, this reduce 1 place to configure stuff. Thanks

Thanks for your work on Caddy!

Also, for those that don't know, Caddy also automates SSL certs (unlike nginx) and can render markdown files using templates [0].

[0]: https://caddyserver.com/docs/caddyfile/directives/templates

Yeah, cloudron is a other distro for this use case.

My problem is that I have never been able to purchase residential internet that allowed me to open port 443 or port 80.

Use Cloudflare. Or, rent the cheapest machine you can with a public IP and use something like Rathole. I like Cloudflare because it’s fast and free, but they do MITM you.

Can you set up Cloudflare as a blind pipe? Just forward the packets with rewritten return address

Cloudflared is what I believe they are referring to and it proxies HTTP/S, although maybe it can do more.

Cloudflare Tunnel is great for NAT traversal.

Why do ISPs do this? Is there a legitimate reason or they just feel that their clients don’t host these services so they might as well block the ports for safety?

Not sure but probably some security thing - if you don't need it why leave it open to abuse.

An ISP I've used in the past hasn't allowed self hosting on a standard plan but has allowed on a plan you need to ask for specifically.

Not necessarily security. Maybe just not having to deal with reports for self hosted illegal content. They might be more than happy to let other companies deal with that. Their competitors are probably doing the same thing.

Spam reduction from botnetted machines, and selling business lines, are the reasons I have seen given.

ISPs are media companies. They do not want regular people publishing content or having a voice unless they can get their commission. The world would not have become just 5 websites with identical content if everybody had a server at their house.

I believe this to be true because in the usa they really are media companies, aka Comcast, and I don't have this problem in other countries where I lived where ISPs were ISPs and nothing else. They delivered internet and maybe also phone.

In Taiwan I get 1gbps down, no caps, and a bunch of weird networky config stuff I don't quite understand but apparently you don't get in the usa, for like 30 usd/month. It's awesome.

Plus I'm torrenting basically 24/7 and my isp just doesn't give a fuck. When I did that in the usa Comcast sent me an email for every single torrent lol. My download is in the tens of terabytes a month and uploads are at least a terabyte a month. ISP doesn't care. Love it.

Major reason will always be support burden. For http to work reliably you need to put clients into DMZ anyway. If you let computer illiterate end users operate in DMZ you will end up supporting them anyway, because in the your network will be at risk of depeering/blacklisting. Supporting http behind NAT is again significant support burden that costs actual money while your competitors offer service access cheaper. It makes sense to not only not support http behind nat but block ports altogether for retail and offer proper liability waived DMZ access under enterprise plans.

You can setup a wireguard network then proxy pass from a cheapie VPS if that’s helpful. Probably only worth it if you have multiple services though.

You can try https://pinggy.io

Do isps still do this? I've been using a business cable account for years, but when our local telco went fiber and wanted me to switch, they told me they didn't have such restrictions. I haven't made the switch because configuring pppoe is more complicated than plugging in a network cable and asking for an ip.

Definitely. I'm just so used to the git pipeline flow that it would break my usual flow a bit too much :). That's why those new tools just make it so amazing! Especially combined with better and better ISP

Not _exactly_ as easy, you also need a valid https cert, and set up a cronjob to renew it. And for some other reply here, "as easy as it was in 2003" really doesn't mean "easy" :v

You don't have to have that. Expectations have just increased since 2003.

iOS won't let websockets work without https so I think you can't do things like self-host jitsi meet. Many appliance type devices won't allow adding self-signed certificates either.

To be fair, you couldn't self host jitsi meet in 2003 either

Websockets didn't exist in 2003, so that's just a case of higher expectations.

Back to plain sites and not websockets, browsers didn't go through a missing https warning process in 2003 either so there are higher barriers and not just expectations.

> Not _exactly_ as easy, you also need a valid https cert, and set up a cronjob to renew it.

Web servers like Caddy automate this for you: you just indicate that you want HTTPS for a particular site and the rest is taken care of for you (in the case of public sites and HTTP-01 challenges, at least). Link: https://caddyserver.com/docs/quick-starts/https

Even Apache2 has mod_md which does pretty much the same thing (sans DNS-01 provider integrations, at least out of the box), so it's going to be good enough for most cases and similarly easy to Caddy. Link: https://httpd.apache.org/docs/2.4/mod/mod_md.html#mdomain

Nginx integrates well with certbot, which does take a bit more work and configuration, but even that is passable: https://certbot.eff.org/

Things can get a bit tricky when you want to run your own CA or ensure mTLS, but in most cases neither will be necessary.

As for whether you even need HTTPS in the first place, I'd say that it won't hurt in most cases and will guard against MitM, the ISP included.

Can't do http challenges because my ISP blocks port 80 inbound.

You configure Caddy to disable certain challenge types[0], which in this is the HTTP challenge, like so:

    example.com {
     tls {
      issuer acme {
       disable_http_challenge
      }
     }
     file_server
    }

[0] https://caddyserver.com/docs/caddyfile/directives/tls#acme

> Can't do http challenges because my ISP blocks port 80 inbound.

My ISP also put me behind CGNAT, which effectively meant that all of the inbound traffic got dropped. I worked around that by getting the cheapest VPSes that I could find and then setting up WireGuard and simply forwarding the traffic to my homelab servers. So I got all of the compute that I have available locally, all of the RAM and all of the cheap HDD storage, but a static IP address.

I actually wrote about the process a few years ago: https://blog.kronis.dev/tutorials/how-to-publicly-access-you...

(note that you probably would only want to forward 80 and 443 ports in most cases, not everything; outside of testing boxes)

Personally, I opted for Time4VPS in the end, which I use for the rest of my hosting as well: https://www.time4vps.com/linux-vps/?affid=5294#annually (affiliate link, they do have good discounts at the moment for yearly billing, though)

Then again, something like Scaleway Stardust instances could also be a really good fit, when they are available: https://www.scaleway.com/en/stardust-instances/

For those not chasing after the savings of a few Euros, Hetzner is also going to be more than enough: https://www.hetzner.com/cloud (or DigitalOcean, or Vultr, or any other VPS provider out there)

I don't need port 80 now that DNS challenges are easily automated. Port 443 is open, so that's fine.

Also, if I have a VPS, why not just serve from the VPS?

"Not _exactly_ as easy, you also need a valid https cert, and set up a cronjob to renew it. And for some other reply here, "as easy as it was in 2003" really doesn't mean "easy" :v"

Took me 15 minutes.

https://developers.cloudflare.com/cloudflare-one/connections...

Super easy with the right DNS provider and something like go-acme/Lego. Add a crom job and done. Yeah, not zero effort but compared to early Let's Encrypt with HTTP-01 and such it's quote easy.

https://github.com/go-acme/lego

> even Germany has average upstream speeds of 20mbit/second nowadays [1]

Is it common for EU countries to not have symmetric gigabit fiber?

At least in France, it's very common. I'd say symmetric is the exception.

Same in Australia. I don’t believe you can get a symmetrical residential connection. Business, sure. But residential, no.

On that note: with our (Australian) National Broadband Network (NBN), residential connections don't always have the best uptime.

For example, at my last house (Melbourne), a 100/40 FTTC connection... the NBN company kept on having multi-hour outages (booked ahead of time) every 2-3 months. Note that's not my ISP, it's the NBN itself. For "upgrades" in the area and similar.

So very much "not business grade". Not even startup grade really. :(

Note: Europe, but outside EU/EEA.

Yup. I have a gigabit fibre right up to my home, but the best speed available to me as an individual is 400/40. Gets really annoying from time to time when I need to upload like a couple of gigabytes.

On the bright side it's like €30/month, which also gets me cable and some streaming service subscriptions (HBO Max, Tidal, shit like that), which from what I can tell is a pretty good deal compared to more western countries.

Going from 1000/50 to 1000/1000 would cost me an 860€ premium right now (Germany) and this is a good offer, it can get more expensive without special promotion.

It got better with fiber in my area. Now 1G symmetric is available for 199€ per month.

I use DDNS with Cloudflare, which offers free DNS. I built an open source Windows client for this (could be cross-platform, just haven't bothered yet).

https://github.com/drittich/DnsTube

What is the worst case scenario for security on your network, in the above self hosted setup ?

No idea where they got that data but I call bullshit. Most people I know are still on DSL which means 20mbit upstream is the usual maximum (sometimes 40), so not sure where this even amount of fibre users would live.

In the US this is almost always prohibited by the residential internet terms of service, and can subject you to account cancellation.

Is it really? Which part is prohibited? Isn't that part of what you sign up for when you specify upload speed with your service contract?

I'm in the US and have never not had something or other being served on public facing ports

"servers" are the part that is prohibited per ToS, even if the ports aren't blocked.

In many places in the US 20mbit/s up is either very expensive, or not an option.

True if you ignore certs and the possibility of CG-NAT.

That is not "easy". If it was, no one would be using cloud hosted sites like carrrd or squarespace or wix or whatever

Those are not solutions to “I don’t know how to host”, those are solutions to “I don’t know or want to know anything about how websites work below the GUI layer”. The hosting (in terms of dns and serving the bits) is almost incidental to their business model of designing and managing.

Reply on news.ycombinator.com