5 ms·

I host a bunch of docker containers plus Traefik to route everything. It runs on a cheap GCP instance (more on this here: https://sdan.xyz/sd2 https://sdan.xyz/

by sdan 7y ago

I host a bunch of docker containers plus Traefik to route everything. It runs on a cheap GCP instance (more on this here: https://sdan.xyz/sd2 https://sdan.xyz/sd2) Overleaf: https://sdan.xyz/latex https://sdan.xyz/latex A URL Shortener: https://sdan.xyz https://sdan.xyz All my websites (https://sdan.xyz/drf https://sdan.xyz/drf, https://sdan.xyz/surya https://sdan.xyz/surya, etc.) My blog(s) (https://sdan.xyz/blog https://sdan.xyz/blog, https://sdan.xyz/essays https://sdan.xyz/essays) Commento commenting server (I don't like disqus) Monitoring (https://sdan.xyz/monitoring https://sdan.xyz/monitoring, etc.) Analytics (using Fathom Analytics) and some more stuff!

_emacsomancer_ 7y ago
how difficult is overleaf to self host?
- sdan 7y ago
  Super easy, here's the docker compose file I used: https://github.com/dantuluri/sd2/blob/master/docker-compose.yml https://github.com/dantuluri/sd2/blob/master/docker-compose.... You'll need Mongo and Redis (last I remember) as well (which I believe are the two images that follow the sharelatex image.
RulerOf 7y ago
It’s a relatively popular choice but I’ll ask you about it... I see a lot of people putting their home stuff behind CloudFlare, but when I reviewed their free tier, I didn’t actually see any security benefit to outweigh the privacy loss, and I didn’t see that covered on your blog post.
- sdan 7y ago
  Thanks for the read! 1. This is hosted on GCP. Actually was thinking of using Cloudflare Argo once my GCP credits expire so that I can truly self host all this (although all I have is an old machine). 2. For me, Cloudflare makes my websites load faster on pages. Security wise, I have pretty much everything enabled... like always on HTTPS, etc. and I some strict restrictions on SSHing into my instance (also note that none of my ip addresses are exposed thanks to Cloudflare), so really I'm not sure what security risk there may be. 3. How am I losing privacy loss? Just curious, not really understanding what you're saying there.
  - oarsinsync 7y ago
    You lose the end to end encryption that you’d get by HTTPS directly to your home instead of proxying via CF, as CF will MITM all of your sessions. Browser <> CF, CF<> source server. Two distinct TCP sessions. Both potentially encrypted, but there’s no E2E encryption anymore.
    - deleted 7y ago
      [deleted]
    - asdkhadsj 7y ago
      > HTTPS directly to your home Can you elaborate on this? Maybe I misunderstand you, but is there a good way to get HTTPS from your home?
      - notkaya 7y ago
        Don't use CF. Route everything directly to a reverse proxy on your home server.
    - sdan 7y ago
      I get what you're saying, but here's some benefits of using CF: 1. Been using it for 3+ years. Whenever I'm making a site, there's nothing better than easily making some DNS records and making sure they're all always-on HTTPS. 2. A little bit of the first part: It's a hassle to setup my own certs, etc.. I feel that Cloudflare "protecting" my IP from DDOS and other attacks is far better than anything that I can setup easily (at least from my experience, I think they know what they're doing) 3. Maybe in the future when I have some time and money I'll do everything on my own and ensure I have E2E encryption. At the moment, anything I'm running isn't mission-critical and isn't used by hundreds of people; I'm not making a SaaS startup. I understand your concern, but the ease of use of Cloudflare is something I value. 4. Analytics. I've come not to trust Google Analytics at all. I'm not sure what they're doing, but most if not 100% of tech-savy people have adblock, which blocks GA. My VPN from AlgoVPN blocks GA and anything related to GA, FB, Twitter, etc. So I'm not really sure how much I can trust GA's analytics opposed to Cloudflare giving me the exact numbers on how many people requested or visited my site. (I'm going to make my own analytics soon since Fathom has turned to profit only and not open source).
- tbyehl 7y ago
  > I didn’t actually see any security benefit to outweigh the privacy loss The main thing is being able to hide your origin IP address. That turns many types of DDoS attacks into CloudFlare's problem, not yours, and it doesn't matter that you're on the free tier[0]. If you firewall to only allow traffic from CF[1], then you can make your services invisible to IP-based port scans / Shodan. CloudFlare isn't a magic-bullet for security, but, used correctly, they greatly reduce the attack surface. Whether any of that is worth the privacy / security risk of letting CloudFlare MITM your traffic is up to you. [0] https://news.ycombinator.com/item?id=21170847 https://news.ycombinator.com/item?id=21170847 [1] https://www.cloudflare.com/ips/ https://www.cloudflare.com/ips/
djsumdog 7y ago
I run netdata too, but I keep that behind my VPN. I'd suggest the same for you. No reason to have that exposed to the entire world. I wrote this to setup my web server, mail server and VPN server, and auto-generate all my VPN keys. https://github.com/sumdog/bee2 https://github.com/sumdog/bee2
- rovr138 7y ago
  Any reason to have it behind a VPN?
  - AdamGibbins 7y ago
    Reduces surface area of attack, you never know when a 0day is going to be found. Exposing monitoring/metrics is particularly interesting as it exposes a lot of information to an attacker, if they're trying to starve your machine of a resource or whatever.
    - sdan 7y ago
      Exactly. They have direct access to your vitals and can push certain buttons to figure out how your system is running to brute-force that attack, ultimately ruining whatever they intended to do. I'm probably going to change how publicly accessible my monitoring view is soon, but for now, it seems pretty cool for everyone to see.
      - lma21 7y ago
        Indeed it was cool. Would love to get a link to a screenshot of your system's resource monitoring. The description of each panel & eache metric was quite useful!
        pm7 7y ago
        It's still public as of now.
- sdan 7y ago
pm7 7y ago
You may want to consider adding netdata user to docker group. It will allow checking Docker names of containers instead of numeric id. Of course, it would simplify privilege escalation if someone successfully attack netdata service. If you want public dashboard, streaming is supposed to be quite safe (no way to send instruction to streaming instance of netdata).

by sdan 7y ago

_emacsomancer_ 7y ago

how difficult is overleaf to self host?

sdan 7y ago
Super easy, here's the docker compose file I used: https://github.com/dantuluri/sd2/blob/master/docker-compose.yml https://github.com/dantuluri/sd2/blob/master/docker-compose.... You'll need Mongo and Redis (last I remember) as well (which I believe are the two images that follow the sharelatex image.

RulerOf 7y ago

It’s a relatively popular choice but I’ll ask you about it... I see a lot of people putting their home stuff behind CloudFlare, but when I reviewed their free tier, I didn’t actually see any security benefit to outweigh the privacy loss, and I didn’t see that covered on your blog post.

sdan 7y ago
Thanks for the read! 1. This is hosted on GCP. Actually was thinking of using Cloudflare Argo once my GCP credits expire so that I can truly self host all this (although all I have is an old machine). 2. For me, Cloudflare makes my websites load faster on pages. Security wise, I have pretty much everything enabled... like always on HTTPS, etc. and I some strict restrictions on SSHing into my instance (also note that none of my ip addresses are exposed thanks to Cloudflare), so really I'm not sure what security risk there may be. 3. How am I losing privacy loss? Just curious, not really understanding what you're saying there.
- oarsinsync 7y ago
  You lose the end to end encryption that you’d get by HTTPS directly to your home instead of proxying via CF, as CF will MITM all of your sessions. Browser <> CF, CF<> source server. Two distinct TCP sessions. Both potentially encrypted, but there’s no E2E encryption anymore.
  - deleted 7y ago
    [deleted]
  - asdkhadsj 7y ago
    > HTTPS directly to your home Can you elaborate on this? Maybe I misunderstand you, but is there a good way to get HTTPS from your home?
    - notkaya 7y ago
      Don't use CF. Route everything directly to a reverse proxy on your home server.
  - sdan 7y ago
    I get what you're saying, but here's some benefits of using CF: 1. Been using it for 3+ years. Whenever I'm making a site, there's nothing better than easily making some DNS records and making sure they're all always-on HTTPS. 2. A little bit of the first part: It's a hassle to setup my own certs, etc.. I feel that Cloudflare "protecting" my IP from DDOS and other attacks is far better than anything that I can setup easily (at least from my experience, I think they know what they're doing) 3. Maybe in the future when I have some time and money I'll do everything on my own and ensure I have E2E encryption. At the moment, anything I'm running isn't mission-critical and isn't used by hundreds of people; I'm not making a SaaS startup. I understand your concern, but the ease of use of Cloudflare is something I value. 4. Analytics. I've come not to trust Google Analytics at all. I'm not sure what they're doing, but most if not 100% of tech-savy people have adblock, which blocks GA. My VPN from AlgoVPN blocks GA and anything related to GA, FB, Twitter, etc. So I'm not really sure how much I can trust GA's analytics opposed to Cloudflare giving me the exact numbers on how many people requested or visited my site. (I'm going to make my own analytics soon since Fathom has turned to profit only and not open source).
tbyehl 7y ago
> I didn’t actually see any security benefit to outweigh the privacy loss The main thing is being able to hide your origin IP address. That turns many types of DDoS attacks into CloudFlare's problem, not yours, and it doesn't matter that you're on the free tier[0]. If you firewall to only allow traffic from CF[1], then you can make your services invisible to IP-based port scans / Shodan. CloudFlare isn't a magic-bullet for security, but, used correctly, they greatly reduce the attack surface. Whether any of that is worth the privacy / security risk of letting CloudFlare MITM your traffic is up to you. [0] https://news.ycombinator.com/item?id=21170847 https://news.ycombinator.com/item?id=21170847 [1] https://www.cloudflare.com/ips/ https://www.cloudflare.com/ips/

djsumdog 7y ago

I run netdata too, but I keep that behind my VPN. I'd suggest the same for you. No reason to have that exposed to the entire world. I wrote this to setup my web server, mail server and VPN server, and auto-generate all my VPN keys. https://github.com/sumdog/bee2 https://github.com/sumdog/bee2

rovr138 7y ago
Any reason to have it behind a VPN?
- AdamGibbins 7y ago
  Reduces surface area of attack, you never know when a 0day is going to be found. Exposing monitoring/metrics is particularly interesting as it exposes a lot of information to an attacker, if they're trying to starve your machine of a resource or whatever.
  - sdan 7y ago
    Exactly. They have direct access to your vitals and can push certain buttons to figure out how your system is running to brute-force that attack, ultimately ruining whatever they intended to do. I'm probably going to change how publicly accessible my monitoring view is soon, but for now, it seems pretty cool for everyone to see.
    - lma21 7y ago
      Indeed it was cool. Would love to get a link to a screenshot of your system's resource monitoring. The description of each panel & eache metric was quite useful!
      - pm7 7y ago
        It's still public as of now.
sdan 7y ago

pm7 7y ago

You may want to consider adding netdata user to docker group. It will allow checking Docker names of containers instead of numeric id. Of course, it would simplify privilege escalation if someone successfully attack netdata service. If you want public dashboard, streaming is supposed to be quite safe (no way to send instruction to streaming instance of netdata).