7 ms·

I reworked my servers a while ago to host literally everything through docker, managed via terraform. All web-services are reverse-proxied through traefik At

I reworked my servers a while ago to host literally everything through docker, managed via terraform. All web-services are reverse-proxied through traefik At home: loki + cadvisor + node-exporter + grafana + prometheus syncthing tinc vpn server jackett + radarr + sonarr + transmission jellyfin samba server calibre server On a remote server: loki + cadvisor + node-exporter + grafana + prometheus syncthing tinc vpn server dokuwiki firefox-sync firefox-send vscode server bitwarden freshrss znc bouncer + lounge irc client + bitlbee an httptunnel server (like ngrok) firefly iii monicahq kanboard radicale syncthing wallabag tmate-server

emit_time 7y ago
Have you considered moving from tinc to Wireguard?
- masterfooo 7y ago
  I use both, and one thing I found that is sucky about WG is that it does not work well with the Windows firewall. I need to give full permission to an app to be able to access ip addresses routed by WG. Tinc does not have this problem.
  - LinuxBender 7y ago
    WG also doesn't do dynamic mesh routing. With tinc, I can have a network path down, and my mesh will find it's way around it. Tinc is slower than WG, but I will take that hit for the benefit of availability. (my preference anyway) One thing I noticed with tinc is that it does not take advantage of sysctl network tuning. I had to increase the network buffers for that dynamic routing to not make as much of a noticeable slowdown. Cipher = aes-128-cbc ClampMSS = yes UDPRcvBuf = 81920000 UDPSndBuf = 81920000 Compression = 0
- mavidser 7y ago
  Yes, I've been meaning to give it a go for a while now. Couldn't use it initially because of (then) lack of availability on BSD.
captn3m0 7y ago
Or stacks look so similar, it’s creepy. Thankfully, not running sync thing now.
- drakenot 7y ago
  What do you use instead?
  - pickdenis 7y ago
    Not him, but I'm gonna use this as a chance to plug unison[1]. I've been using it for more than a year now to keep files synced across more than 3 computers and it works flawlessly. It gets a tad slow to start propogating changes if you have too many files and a weak server (around 150k files, server has an Atom N2800), but it's not more than 15 seconds. One nifty thing is that you don't need to run unison on the server ever, just have it installed. I have systemd units that I enable on my client machines and that does all of the syncing; unison connects to the server with ssh and does all the work there over that. [1]: https://www.cis.upenn.edu/~bcpierce/unison/index.html https://www.cis.upenn.edu/~bcpierce/unison/index.html
    - equalunique 7y ago
      I've been wanting to give Ocaml a try and Unison source code seems to be one of the most popular reference applications for it.
- mavidser 7y ago
  Yeah, I too have noticed that. Haven't seen a lot of terraform usage for personal services. What are the issues with syncthing?
  - captn3m0 7y ago
    Now running NextCloud
    - 7y ago
nerdponx 7y ago
Was it hard to set up Firefox-Sync/Send? Last I checked, self-hosting these was undocumented and difficult.
- sdan 7y ago
  It's not hard when you use Docker. Just spin it up and then use Traefik to route.
- mavidser 7y ago
  Sync's docs were a bit outdated, yes. Had to spend some time to get it up and running. The config I ended up using - https://0bin.net/paste/gnWY4+Tn-jZ2UMZm#RgQfZ3uD7MIlK7nWKLLXEaO4fKHylhggB2YSQn+PE7b https://0bin.net/paste/gnWY4+Tn-jZ2UMZm#RgQfZ3uD7MIlK7nWKLLX... It's deployed on docker, proxied through traefik.
  - nerdponx 7y ago
    Thanks, hopefully I can get this working myself.
tnsittpsif 7y ago
How much do you spend on the remote server on a monthly basis? Also, what's the hardware you use for the home server?
- mavidser 7y ago
  Remote server's a 20USD/month DigitalOcean droplet with 4GB memory. Though even half of that would also have specified for these services. Home server's a Raspberry Pi 4.
  - mavidser 7y ago
    s/specified/sufficed
    - vaxman 7y ago
      ..and note rPis don't have error checking memory and have disk errors all the time
      - unixhero 7y ago
        Hmmm... With which filesystems?
        vaxman 7y ago
        it's an electrical issue (contacts on SD cards, voltage/thermal spikes, etc.)
        unixhero 7y ago
        Sure. I still wonder and it would be interesting to find out which filesystems is the most resilient under the conditions you describe there.
  - vaxman 7y ago
    Prefab system images From Russia With Love, including password managers and surfing proxies, spun up on a VPS operated by totally unknown people (probably remoted to the actual DC from some place with bad water)...security nightmare. When I see Statue of Liberty sticking up out of the water on the shoreline, imma scream like Charles Heston! Need Congress/FTC to set guidelines. In mean time, know that you don't get all the benefits of that stack for "free", you're burning down future hours that will be in disaster recovery mode.
dmos62 7y ago
I see you're using Bitwarden. Does anyone have recommendations for password+sensitive-data management? I'm currently using Keepass and git, but I have one big qualm. You cannot choose to not version-control that one big encrypted (un-diff-able) file.
- erulabs 7y ago
  Vault or Bitwarden are great for projects once they get serious - Unfortunately there isn't a one-size-fits all solution that doesn't suck in one way or another. Setting up vault is fairly non-trivial.
- monotux 7y ago
  Bitwarden can be self-hosted and it's server is open source (and security audited, for what it's worth). I've used it for a few years or so and I've had no issues this far. One other alternative to keepass is pass[1]. [1]: https://www.passwordstore.org/ https://www.passwordstore.org/
- johntash 7y ago
  You might like Pass [0] or GoPass [1] which had more features the last I looked at it. They both store passwords/data in gpg-encrypted files in a git repo. I'm not sure what the state of GUIs/browser plugins are for it, but I'm pretty sure there are some out there. You can also set up your git config to be able to diff encrypted .gpg files so that the files are diff-able even though they're encrypted. [0]: https://www.passwordstore.org/ https://www.passwordstore.org/ [1]: https://github.com/gopasspw/gopass https://github.com/gopasspw/gopass
  - dmos62 7y ago
    Yeah, I like Pass the most in this space, but it doesn't encrypt the index of logins/items that you're keeping. I.e. it's a folder tree of encrypted files, so you can see the sites, logins and other things that I'm using. That's kind of a deal breaker for me, though I'm pondering if I'm being practical, or just overly cautious.
ekianjo 7y ago
How do you like bitlbee?

emit_time 7y ago

Have you considered moving from tinc to Wireguard?

masterfooo 7y ago
I use both, and one thing I found that is sucky about WG is that it does not work well with the Windows firewall. I need to give full permission to an app to be able to access ip addresses routed by WG. Tinc does not have this problem.
- LinuxBender 7y ago
  WG also doesn't do dynamic mesh routing. With tinc, I can have a network path down, and my mesh will find it's way around it. Tinc is slower than WG, but I will take that hit for the benefit of availability. (my preference anyway) One thing I noticed with tinc is that it does not take advantage of sysctl network tuning. I had to increase the network buffers for that dynamic routing to not make as much of a noticeable slowdown. Cipher = aes-128-cbc ClampMSS = yes UDPRcvBuf = 81920000 UDPSndBuf = 81920000 Compression = 0
mavidser 7y ago
Yes, I've been meaning to give it a go for a while now. Couldn't use it initially because of (then) lack of availability on BSD.

captn3m0 7y ago

Or stacks look so similar, it’s creepy. Thankfully, not running sync thing now.

drakenot 7y ago
What do you use instead?
- pickdenis 7y ago
  Not him, but I'm gonna use this as a chance to plug unison[1]. I've been using it for more than a year now to keep files synced across more than 3 computers and it works flawlessly. It gets a tad slow to start propogating changes if you have too many files and a weak server (around 150k files, server has an Atom N2800), but it's not more than 15 seconds. One nifty thing is that you don't need to run unison on the server ever, just have it installed. I have systemd units that I enable on my client machines and that does all of the syncing; unison connects to the server with ssh and does all the work there over that. [1]: https://www.cis.upenn.edu/~bcpierce/unison/index.html https://www.cis.upenn.edu/~bcpierce/unison/index.html
  - equalunique 7y ago
    I've been wanting to give Ocaml a try and Unison source code seems to be one of the most popular reference applications for it.
mavidser 7y ago
Yeah, I too have noticed that. Haven't seen a lot of terraform usage for personal services. What are the issues with syncthing?
- captn3m0 7y ago
  Now running NextCloud
  - 7y ago

nerdponx 7y ago

Was it hard to set up Firefox-Sync/Send? Last I checked, self-hosting these was undocumented and difficult.

sdan 7y ago
It's not hard when you use Docker. Just spin it up and then use Traefik to route.
mavidser 7y ago
Sync's docs were a bit outdated, yes. Had to spend some time to get it up and running. The config I ended up using - https://0bin.net/paste/gnWY4+Tn-jZ2UMZm#RgQfZ3uD7MIlK7nWKLLXEaO4fKHylhggB2YSQn+PE7b https://0bin.net/paste/gnWY4+Tn-jZ2UMZm#RgQfZ3uD7MIlK7nWKLLX... It's deployed on docker, proxied through traefik.
- nerdponx 7y ago
  Thanks, hopefully I can get this working myself.

tnsittpsif 7y ago

How much do you spend on the remote server on a monthly basis? Also, what's the hardware you use for the home server?

mavidser 7y ago
Remote server's a 20USD/month DigitalOcean droplet with 4GB memory. Though even half of that would also have specified for these services. Home server's a Raspberry Pi 4.
- mavidser 7y ago
  s/specified/sufficed
  - vaxman 7y ago
    ..and note rPis don't have error checking memory and have disk errors all the time
    - unixhero 7y ago
      Hmmm... With which filesystems?
      - vaxman 7y ago
        it's an electrical issue (contacts on SD cards, voltage/thermal spikes, etc.)
        unixhero 7y ago
        Sure. I still wonder and it would be interesting to find out which filesystems is the most resilient under the conditions you describe there.
- vaxman 7y ago
  Prefab system images From Russia With Love, including password managers and surfing proxies, spun up on a VPS operated by totally unknown people (probably remoted to the actual DC from some place with bad water)...security nightmare. When I see Statue of Liberty sticking up out of the water on the shoreline, imma scream like Charles Heston! Need Congress/FTC to set guidelines. In mean time, know that you don't get all the benefits of that stack for "free", you're burning down future hours that will be in disaster recovery mode.

dmos62 7y ago

I see you're using Bitwarden. Does anyone have recommendations for password+sensitive-data management? I'm currently using Keepass and git, but I have one big qualm. You cannot choose to not version-control that one big encrypted (un-diff-able) file.

erulabs 7y ago
Vault or Bitwarden are great for projects once they get serious - Unfortunately there isn't a one-size-fits all solution that doesn't suck in one way or another. Setting up vault is fairly non-trivial.
monotux 7y ago
Bitwarden can be self-hosted and it's server is open source (and security audited, for what it's worth). I've used it for a few years or so and I've had no issues this far. One other alternative to keepass is pass[1]. [1]: https://www.passwordstore.org/ https://www.passwordstore.org/
johntash 7y ago
You might like Pass [0] or GoPass [1] which had more features the last I looked at it. They both store passwords/data in gpg-encrypted files in a git repo. I'm not sure what the state of GUIs/browser plugins are for it, but I'm pretty sure there are some out there. You can also set up your git config to be able to diff encrypted .gpg files so that the files are diff-able even though they're encrypted. [0]: https://www.passwordstore.org/ https://www.passwordstore.org/ [1]: https://github.com/gopasspw/gopass https://github.com/gopasspw/gopass
- dmos62 7y ago
  Yeah, I like Pass the most in this space, but it doesn't encrypt the index of logins/items that you're keeping. I.e. it's a folder tree of encrypted files, so you can see the sites, logins and other things that I'm using. That's kind of a deal breaker for me, though I'm pondering if I'm being practical, or just overly cautious.

ekianjo 7y ago

How do you like bitlbee?