this post was submitted on 07 Sep 2026
298 points (98.1% liked)

Selfhosted

62026 readers
923 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Detailed Rules Post

  1. Be civil.

  2. No spam.

  3. Posts are to be related to self-hosting.

  4. Don't duplicate the full text of your blog or readme if you're providing a link.

  5. Submission headline should match the article title.

  6. No trolling.

  7. Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details. Tags [CBH] or [AIP] are required, see the links in Rule 8 for details.

  8. AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post, and find example disclosures here.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 3 years ago
MODERATORS
ruud@lemmy.world
Loki@lemmy.world
CannaVet@lemmy.world
devve@lemmy.world
ayyy@sh.itjust.works
curbstickle@anarchist.nexus
curbstickle_lw@lemmy.world
298
My Homelab Got Hacked - A Postmortem – Phunky Cafe (phunky.cafe)
submitted 3 days ago by michaelharley@infosec.pub to c/selfhosted@lemmy.world
51 comments fedilink hide all child comments
 

Welp. My Forgejo instance got popped with an RCE two days ago by CVE-2026-60004. Luckily, I noticed the following morning and had the day free to figure out what happened. Let's dive in!

As a homelab enthusiast, I found this a very interesting post. Here are my take aways from the post that I'm implementing myself:

  • Miner detection. I've updated monitoring rules to now watch the CPU on my hosts. If the same thing happened to me I would not have been alerted at all as I'm doing simple up / down monitoring. Fixed.
  • Access logging. I turned on access logging for my homelab Caddy instances.
  • Log retention. I have increased the amount and retention of my logging. The hope is this will help me reconstruct what happened after a breach.
  • Logs offsite. The VPS access logs now ride along with the normal backup process, which runs hourly. The homelab side still only gets caught by the weekly VM backup, so that's next.
  • Closed an open signup. My webtrees instance (genealogy) had self registration enabled, which is the same door this guy got hit through. Oops. Fixed.
  • Built a tool. log-inventory.sh, so "could I actually reconstruct what happened" is a command I run instead of a thing I assume.
you are viewing a single comment's thread
view the rest of the comments
[–] tofu@lemmy.nocturnal.garden 7 points 3 days ago (1 children)

Good write up! Since you're using Komodo already, are your compose stacks in git? Because if they are, check the renovate bot. It will read your files with their pinned image tags, check upstream for newer tags, and creates MRs (can also be set to auto merge) to update. Can be configured per stack.

[–] ExperimentalGuy@programming.dev 3 points 3 days ago (1 children)

What's komodo? I'm thinking of starting a home server so learning how to harden/automate updates (which is what it sounds like you're saying) is what I want to learn.

[–] tofu@lemmy.nocturnal.garden 1 points 2 days ago

It's a tool to manage docker stacks, e.g. by reading them from git repos. You can configure your git forge in a way to ping Komodo when something in a repo changed, Komodo then deploys the new version. You'd need your own git forge, e.g. forgejo. This is a good guide:

https://nickcunningh.am/blog/how-to-automate-version-updates-for-your-self-hosted-docker-containers-with-gitea-renovate-and-komodo

You can start without Renovate to get going, but you'll want it sooner or later to automate checks for updates.