Selfhosted
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
-
No spam posting.
-
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
-
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
-
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
-
No trolling.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
view the rest of the comments
how do you unlock the encrypted disks? is it manual, or did you automate it?
One of the best uses of encryption is that you can pull drives that die and not have to try to wipe them as they die or smash them. They’re encrypted so it’s just gibberish. Mostly the reason to encrypt.
I auto-unlock with two things: a USB drive I put in the computer that it looks for and another computer on the network that hosts an unlock file. I’m not defending against nation-states or the Gestapo, regular rubes won’t notice the pi zero hidden that hosts the network file. USB drive is for just-in-case so I don’t have to type that long ass password ever.
I didn’t try hard, but I’m not sure how to make auto-unlocking more secure.
Especially if you stripe the data across multiple drives too
I have automated it with a small initramfs script which has half password and download the other half from internet. My threat model is to protect from a random thief. So they should connect it to a network similar to mine (same netmask and gateway) and boot it before I can remove the half key from internet.
some security which is on my TODO list is: allow fetching the half key only from my home IP and add some sort of alert for when it is fetched.
Dropbear. You can run a small SSH server in initd that allows you to SSH in and type the encryption password. It doesn't run a shell, just cryptsetup.
Linux with LUKS can be configured to decrypt at boot
ok, but where does it get the decryption key from. my real question is how did you implement automatic unlock securely
you type it in on boot
That kind of defeats the purpose then doesn't it
shut down and its encrypted? ofc you also have to have a decrypt password. I use luks so if my computer gets stolen my files arent readable, which is true because they cant leave my house without unplugging it
Oh, if there's a password then that's different.
But they certainly can take it without unplugging it, if they really want to. For example: https://cdsg.com/products/hotplug-field-kit
good to know! thankfully I legit don't have much sensitive stuff in my computer but will try to keep a good habit of shutting down lol