17 ms·
Dank-selfhosted: automated deployment of email, web, DNS, XMPP, ZNC on OpenBSD
- judge2020 8y agoLooks good for moving away from the widely used centralization services (CF/aws for DNS, google for email, etc), my only question is how this is #1 on HN with 12 points.
- SamWhited 8y agoTheir default Prosody config looks pretty nice; having an easy way to deploy a local chat service that has reasonable defaults like stream management, carbons (messages you sent are mirrored across all your clients), history, and HTTP-based file sharing is really nice.
- ge0rg 8y agoIndeed, it would be great to have a standalone recipe / how to for setting that up. From the scripts there is no black magic involved, except a tiny bit for the integration with LE certificates.
- toomuchtodo 8y ago> it would be great to have a standalone recipe / how to for setting that up. You could probably distill that from their scripts. Be the change you want to see in the world!
- indigodaddy 8y agoImagine could get away with running this on 1G with light usage/load? Also don't see webmail here, but imagine shouldn't be too difficult to add (I don't have much exposure to the OpenBSD landscape).
- rasengan 8y agoFor webmail you could use rainloop or squirrel which can use the web server and the email server for example!
- sn 8y agoPlease do not recommend squirrelmail. It is not really being maintained. https://www.openwall.com/lists/oss-security/2018/07/26/2 https://www.openwall.com/lists/oss-security/2018/07/26/2 https://www.openwall.com/lists/oss-security/2018/03/17/2 https://www.openwall.com/lists/oss-security/2018/03/17/2 https://squirrelmail.org/index.php https://squirrelmail.org/index.php https://blog.cpanel.com/the-death-of-squirrelmail/ https://blog.cpanel.com/the-death-of-squirrelmail/
- tecleandor 8y agoYep, Roundcube seems to work this days, I've been using it for a while (lightly, only once a week)
- lwansbrough 8y agoHeads up you should probably never host your own email on the same server as your web/worker servers if you’re worried about IP leakage. Your IP is exposed on outbound mail. Using SMTP services like SendGrid won’t help, either.
- ge0rg 8y agoWhat's the problem with leaking your IP address? If you host a website or any kind of API there, your IP is public anyway?
- zaxquit 8y agoI was going to ask this as well, surely there shouldn't be a problem with this?
- dddw 8y agomaybe the commenter has the scenario of bare metal server at home in mind?
- SturgeonsLaw 8y agoNot if it's behind a CDN, if you were to host a website that someone might consider a DDoS target (frankly anything can be these days), then it can be wise to keep the host's true IP off the record
- gsich 8y agoIf your security is only achieved by hiding your IP I have bad news for you.
- lwansbrough 8y agoObfuscating your IP is a foundational part of strong security for websites in certain industries. For example: the video game industry has a lot of wannabe hackers and script kiddies, DDoSes are cheaper and larger than ever, which makes running services in that industry extremely expensive without proper IP security. I know the purists think the internet should be open and transparent, but some of us also build services in reality.
- mcny 8y agoProbably is trivial but I figured I'd ask anyway. A one click "email" server which allows you to receive emails from anywhere but only send emails to addresses on the current server. If I don't send emails, I don't need to worry about people not being able to receive my emails, right?
- matthewaveryusa 8y agoThat's correct. For outgoing, assuming you setup certs and DNS correctly, the main challenge is your IP that's in an ISP CIDR which gets marked as spam. I have a small instance on AWS that forwards my outgoing email and it works great.
- mcny 8y agoI was thinking of a mail server for not very technical people that is easy to install and update. The use case I'm thinking is let's say I have a domain like foo.bar. Each user gets a sub domain like user1.foo.bar. User 1 can send emails to anyone with an email address of .foo.bar but nobody else. User 1 can get emails from anyone at anything* at user 1 dot foo dot bar For example, facebook at user 1 dot foo dot bar The main benefit this project would have is zero customization. No setting is customizable and the whole thing is an appliance that keeps itself up to date. Thoughts?
- ge0rg 8y agoLooks like this is similar to other self hosting projects like FreedomBone and NextCloud. It's great to see more tools to take back control over our data.
- secfirstmd 8y agoSimilarly Cloudron.io and Sandstorm.io are very impressive and easy to use projects.
- indigodaddy 8y agoSandstorm is great but apps really don't get updated anymore sadly. The founders also now have day jobs with CF, so probably don't get oodles of time to work on it. Cloudron I've heard is excellent, completely dockerizes and automates everything with a slick webui, has lots of apps, however I just am unwilling to pay $15 a month for it. Will likely roll my own apps/services with Rancher/haproxy/LE (or traefik as the reverse proxy/SSL term) on my sufficiently beefy Netcup rootserver KVM instance (at 8G should handle everything I want to do, but will likely use up most of it's resources which is fine).
- bellinom 8y agoI've been using Cloudron.io for months now and have nothing but good things to say. Actively developed, good support, large selection of apps.
- zaroth 8y agoThe situation with that first thing you talk about, pretty sure it’s a direct result of the situation with that second thing you mention.
- marmaduke 8y agoYep funny to see such a A/B test situation play out and people want neither
- rasengan 8y agoI would not put all of this on the same machine. Edit: To clarify - if one line of code is fd in any of the daemons you’re running you’ll lose everything. Practice defense in depth. Minimize the damage possible.
- im3w1l 8y agoI can see how that kind of makes sense. But if you ask people to run it from multiple machines chances are they will throw their hands up and say too hard and not self host at all?
- rasengan 8y agoAgreed and that would be a reason not to self host at all, if security is critical, because it IS difficult. For example, driving is convenient. That doesn’t mean someone who has never driven before should just drive. It’s definitely better for them to taxi. It’s a hard problem - we have to make things easier for people. When King Sejong saw that people were illiterate, he didn’t try to force everyone to suddenly learn a difficult language - he just made an easier one. Now korea is 99.9% literate.
- yellowapple 8y agoOpenBSD's standard practice is for all daemons to run as unprivileged users in chroots (after using pledge and - nowadays - unveil to restrict themselves further). If one line of code is fd in any of the daemons, it will by default be constrained to that daemon.
- HugoDaniel 8y ago"You're crazy enough to run your own mail server :-)"
- raprp 8y agoGreat project!
- surferbayarea 8y agoSelf hosted email, chat, messaging, calls is the future. Individuals will own host and run their own services for these on public clouds. There is no reason for giant corporations to own these services.
- icedchai 8y agoFuture? Self hosting was common place in the 90’s.
- dymk 8y agoAnd it's far less common nowadays per capita.
- mrpippy 8y agoCommon? For organizations yes (much more so than today), but most users only had dialup at home even in the late 90s
- icedchai 8y agoYou could get dedicated dialup lines with static IP's. Also, real hard core users, of which I knew several, had dedicated ISDN and 56k lines for much of the 90's. There were also people who self hosted off their university residential network. This was very, very common.
- wskinner 8y agoI admire your enthusiasm, but most users don’t want to think about or manage these things. Convenience and consistency of experience is the reason for giant corporations to own these services, and unless there is a compelling shift in consumer preferences, that seems unlikely to change.
- toomuchtodo 8y agoA million upvotes. $50/year for FastMail to host my email is worth more to me than spending even one hour a year debugging mail server issues on my own hosted instance. Not even once!
- sashk 8y agoThis reminds me another OpenBSD-based project, but just for hosting emails — caesonia[1], which was recently discussed here[2]. [1]: https://github.com/vedetta-com/caesonia https://github.com/vedetta-com/caesonia [2]: https://news.ycombinator.com/item?id=16392096 https://news.ycombinator.com/item?id=16392096 edit: formatting
- chrisweekly 8y agoThis is wonderful. Bravo, and thank you!
- ttul 8y agoMailChannels offers five free inbound filtering domains with each outbound mail relay account. If you’re self hosting your mailboxes, this could be an easy way to handle the inbound and outbound spam control and delivery part.
- seanvk 8y agoHosted our family email server and Wordpress blog running OpenBSD on an Old World Mac using DynamiC DNS from home back in 2003. Specifically, I ranOpenBSD 3.4 on my G3 Blue & White with a Sonnet Tempo ATA 133 PCI Card. That was about 15 years ago. I was self-hosting. :-)
- nimbius 8y agohttps://github.com/cullum/dank-selfhosted/blob/master/roles/smtpd/templates/smtpd.conf.j2 https://github.com/cullum/dank-selfhosted/blob/master/roles/... No RBLs? I see cullum hasn't spent any time running a mail server.
- guiomie 8y agoCould there or is there also be a self-hosted version of a facebook clone? For exemple, you'd configure others server and they would all talk to each other, giving access to someones shared album, wall and profile.
- ahriman 8y agoDiaspora is what you're thinking of. Mastodon is a federated twitter clone.
- qznc 8y agoRummage in here: https://github.com/Kickball/awesome-selfhosted#social-networks-and-forums https://github.com/Kickball/awesome-selfhosted#social-networ...
- indigodaddy 8y agogetaether.net is kinda sorta what you might be looking for. There was a recent HN post on it.
- stevenicr 8y agowordpress plus buddypress - both free / open source. I've been wanting to find someone that could package those together with a few other plugins and settings to shore them up (added security and anti-spam settings) and make it a one click deploy for people via the popular services like DO, vultr, etc. I think it would be easy to get one person in a family to pay for hosting while another person keeps an eye on updates and backups. Same with groups of friends, even if most are broke / not willing to pay, if just one would pay it would be trivial to host a few hundred friends on one install and a few hundred family members on another. Buddypress is mature enough with enough plugins to do most of what fbook and similar offer all for free. Only thing I don't really know is what kind of mobile notifications options are out there and people would expect or need, as I don't use fbk the same way others do. But groups, pics, vids, messaging, profiles, privacy settings, these things are fairly easy with BP really.
- reilly3000 8y agoEmail delivery issues usually come up in discussions around self-hosting. If there was a credible collective email delivery relay, I would pay to be a part of it. Is there anything like that today?
- reilly3000 8y ago^^^ self-hosted email that can still legally circumvent ISP restrictions and enjoy gmail like deliverability/whiltelisting, by freedom minded sysadmins that self-police abuse in their network.
- reilly3000 8y agoHere I am talking with myself... I suppose hosted SMTP from a hosted service like SES or Mandrill could work, as long as inbound email was handled directly by my own server. There is also the matter of spam, but it appears there are many battletested solutions for that. The last thing I need is wondering if my emails hit the spam folder or not. I worked for a company with email delivery issues associated with the corporate domain once... it was difficult to do business.
- pickpuck 8y agoAwesome Self-Hosted vs Dank Self-Hosted Ha. I'm not sure of the intent, but I like this as a naming pattern for different kinds of projects. Maybe awesome is friendly and optimistic. Whereas dank is a little more "Really not suited for the general public, no automated password reset, no web GUIs..."
- deleted 8y ago[deleted]
- vinay_ys 8y agoIsn't DJB's Qmail, djbdns etc was exactly this? But at least it was small codebase. Is anyone still running qmail? Wonder if someone has thought of running email entirely on their smartphone.
- Jenz 8y agoAs usual from OpenBSD folks, quality README.