Selfhosted

63437 readers

455 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Detailed Rules Post

Be civil.
No spam.
Posts are to be related to self-hosting.
Don't duplicate the full text of your blog or readme if you're providing a link.
Submission headline should match the article title.
No trolling.
Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details. Tags [CBH] or [AIP] are required, see the links in Rule 8 for details.
AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post, and find example disclosures here.

Resources:

selfh.st Newsletter and index of selfhosted software and apps
awesome-selfhosted software
awesome-sysadmin resources
Self-Hosted Podcast from Jupiter Broadcasting

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 3 years ago

MODERATORS

curbstickle@anarchist.nexus

curbstickle_lw@lemmy.world

It's self hosting Sunday! What's up? (lemmy.nocturnal.garden)

submitted 13 hours ago by tofu@lemmy.nocturnal.garden to c/selfhosted@lemmy.world

77 comments fedilink hide all child comments

Let's do another round of this. What's going on on your servers, any cool things? How'd the recent CVE flood tangent you and did it change how you see/do stuff?

you are viewing a single comment's thread
view the rest of the comments

[–] Rin@lemmy.zip 5 points 7 hours ago (1 children)

Finally took the leap and wiped my NUC to start doing things over. Originally had a family member who works in IT set everything up, but he did the absolute bare minimum and I screwed some stuff up along the way the first time around, so I figured now was as good at time as any to teach myself to set things up from scratch!

I also have moved from Portainer, to Dokploy, to Arcane for docker management, and I actually really like Arcane. I've also accomplished something I'm really damn proud of, which is getting HTTPS working on Tailscale (so, for example, arcane.(my subdomain).ts.net but with HTTPS!) alongside Pocket ID for all of it. Maybe it's just me, but I had trouble finding clear documentation on how to do this, no matter how much I searched. But I documented it for myself, at least. And it's probably that I lack a lot of knowledge in this field, too.

I have some questions, and although I know there's a chance this gets buried, I figured I'd try asking anyway. Little skittish about making a thread myself.

My NUC is running Debian 13, and I was wondering some security things. Everything is behind Tailscale and I don't plan on exposing anything to the internet (even through Tailscale Funnel, I'm using Tailscale Serve for the HTTPS.)

How valuable is a firewall in this case? I've never used one, and I'm wondering if it'll just make adding services more of a hassle than it's worth for the security since everything is staying local.
Similarly, what about Fail2Ban? I have it on my RPi and it's not a big deal to set up, but I was reading a firewall is more important?
Is it okay to run unattended updates for security OS stuff on the NUC? I don't always check updates, admittedly I'm easily distracted and forgetful. I'm a little worried about auto restarting it to finish the updates up just because I utilize a NAS and sometimes it's annoying to get them to reconnect to each other (even with the fstab edited) when there's a restart for either of them.
Thoughts on auto updates on docker containers? I know this is pretty personal preference, but I mostly ask because I'm forgetful and distractable. I know this is kinda my own problem, but I want to know other people's thoughts if possible.

Thank you for reading my very long update! And any answers to my questions are very appreciated. Hope everyone else is doing well!

[–] tofu@lemmy.nocturnal.garden 2 points 6 hours ago (1 children)

F2B/FW: If it's only available locally/via VPN, I think your threat model is your LAN. People in your wifi or rogue smart home stuff. I think a firewall makes more sense here, but if it's just 1 machine, you should be fine with ufw or the like. If you have several VMs that are supposed to be separated, the solution would depend on the virtualization software.

Unattended upgrades are way better than none at all, both for system and docker. Of course it depends on how important it is that your services are "always" available and I get the NAS struggle though.

[–] Rin@lemmy.zip 2 points 5 hours ago (1 children)

Hey, thank you for the comment!

That makes sense, that I would be tightening security on the LAN. It's not just one machine, I have a Raspberry Pi 4 as well running a flavor of Debian (and the Synology NAS), so I would assume a firewall on both the Raspberry Pi and my NUC would make sense? I don't have any VMs that I'm aware of, and I've heard of VLANs but don't know anything about those.

Services don't always have to be available! It's just me and my partner who are accessing them, so nothing like a lot of people who need media playback. I'll have to weigh if it's worth fighting with the NAS over auto reboots, but I'm leaning towards yes as an experiment. I'll have to actually look into how to do unattended Debian security updates, though.

[–] tofu@lemmy.nocturnal.garden 2 points 4 hours ago

I think for that use case, Firewalls on the hosts make sense. VLAN is not a bad idea either, though you'd need a managed switch (hardware) for that.