8 ms·

Easy setup with: - traefik (nginx proxy with auto letscencrypt) - portainer (docker container management) - fail2ban (basic security) - logwatch (server / s

• kilroy123 5y ago
  This is _very_ close to my exact setup. Though, I never used portainer (just manage a big docker-compose file) is it worth it?
  • razemio 5y ago
    If you are comfortable with the cli you won't need it at all. It over complicates things in my opinion.
  • justin_oaks 5y ago
    Portainer does make certain tasks much easier. I use Portainer to clean up any Docker volumes, containers, and images I no longer need. Doing that for a lot of Docker resources using the command line gets old really fast. I say this as someone who uses docker and docker-compose extensively and I'm very comfortable with a CLI.
    • smallnamespace 5y ago
      Can't you: docker system prune with perhaps a filtering flag attached?
  • Jnr 5y ago
    I also put everything in docker containers, and docker-compose for each thing is a must. It usually pains me to see when popular projects have no decent docker-compose files available and I have to make them. For backups restic is a blessing. And so is Syncthing for getting things to the backup machine quickly (from mobile and non-unix machines).
    • yjftsjthsd-h 5y ago
      > I also put everything in docker containers, and docker-compose for each thing is a must. It usually pains me to see when popular projects have no decent docker-compose files available and I have to make them. On the bright side, it's a one-time cost and generally pretty simple, especially if they provide a sample `docker run` command. (Although yes, it would of course be better yet if projects would publish one so that it was easier)
• goodpoint 5y ago
  easy? Is this sarcasm?
  • progx 5y ago
    Easy in comparison to make everything yourself and configure every little service. This needs understanding of service and how they work and it needs much time. After 20 years doing this, my postet example is stupid simple, that works for 80% auf all equirements. For the rest 20% you need a good admin, or book a service with a good admin.
  • bryanrasmussen 5y ago
    I think just the typical evaluation of someone with expertise in doing something, it's easy if you're a real devops kind, then just put together a bunch of things, do some config files, write a make or two, take two or three hours to do something that the rest of use take a week to do. in the same way that I might set up a service to scrape XML files and fill up my ElasticSearch search instance, and take a couple hours to set up a working service that I can keep expanding and other people might be like - easy, is that a joke?
    • t-3 5y ago
      "Easy" is probably because it boils down to, install X, Y, Z, edit config for X, Y, Z, start daemons X, Y, Z. There's no complex math or thinking involved, just plugging stuff in.
      • bryanrasmussen 5y ago
        sure but you have to spend lots of time reading documentation and know stuff to figure out you need to put these things together.
        • sodality2 5y ago
          But once you have, it feels "easy" (and might even look easy to someone who doesn't know the work that was put into learning it)
• adflux 5y ago
  Wow so easy, only 9 different services. Then there's the underlying OS, managing hardware & network setup. Also need to make sure your network provider actually allows you to host (commercially?) in your own home. And ensuring that you have a static ip address for your server. So easy :')
  • cassianoleal 5y ago
    > need to make sure your network provider actually allows you to host (commercially?) in your own home If you're hosting something commercially, you should get a commercial ISP plan. If you can get it at home, why would the provider not allow you to host your services that way? That said, why would you do that? It would be very hard to scale this operation, so unless you're planning to be a tiny (and likely lossy) operation forever, get yourself a cheap VPS to start with, then migrate as needed. This post is about self-hosting services for yourself, and perhaps to a few close relatives and friends. Many of us do that (have a look at r/selfhosted and check out the Self Hosted podcast), and OP's set up is one of the simplest around. > ensuring that you have a static ip address There are many ways to access your services without one. A mesh network, like Tailscale, ZeroTier, Nebula, is my favourite, but a regular VPN also works, and so does dynamic DNS.
  • sokoloff 5y ago
    I think I’ve had the same IP address from my cable company for more than a decade now. (Regular old cable modem user with a dynamic, but unchanging, IP address.)
  • progx 5y ago
    Yes it is. Install e.g. ubuntu, install the services, done. Every other mentioned problem is a problem of your provider, not of your setup.
• PinguTS 5y ago
  Just to add one single point from my side: • Backup is not to some cloud service, which I cannot control but done to a small server at home with a NAS attached in the basement. • some smaller service during development I run simply from home from an small and old ALIX based on AMD Goede. Only probleme here, I need to upgrade at some point because some SSE2 instructions are not supported, which makes now problems with newer packeges including some self-compiled packages.
• laydn 5y ago
  A few months ago, I made an offer of $100 in one of the freelancing websites, for someone to set-up something like your configuration on one of my Digital Ocean instances. I asked for a few more apps to be installed (git, svn, etc). There were no takers :-) I think a web site/service which lets you choose "apps" and spawns a VPS instance would be very useful and profitable (Think "ninite for VPS"). I started to work on this but never had the time to continue. With an Ansible/Chef/Puppet recipe, this should be relatively easy to do.
  • throwaway984393 5y ago
    A lot of VPS providers have a catalog of apps to install for you and dump you in a web management console. Sometimes it's handy but usually the security is awful. Back in the day, Webmin was the go-to way to do that and configure your server in general from a web interface
  • sillycube 5y ago
    You can choose apps and spawn a VPS on DO already.
    • stjohnswarts 5y ago
      But can you install multiple apps on one instance?
  • osivertsson 5y ago
    Seems like https://sandstorm.io/ https://sandstorm.io/ could be what you are looking for.
    • js4ever 5y ago
      Probably not, sandstorm is abandoned, most softwares are broken and unmaintained, gitlab version is from 2016 and full of vulnerabilities, same for WordPress version from 2018. Project is dead. I think the guy behind the project was hired by Cloudflare few years ago
• djangelic 5y ago
  Love this, I have a similar setup but had never heard of fail2ban or logwatch. Looking forward to checking these out
  • rascul 5y ago
    CrowdSec may interest you. https://crowdsec.net/ https://crowdsec.net/ (No affiliation)
• ornornor 5y ago
  How do you deal with backing up the data/“disaster” recovery? (I out disaster in quotes because we’re talking a about home servers so not mission critical data but still pretty annoying to lose.
  • slickdork 5y ago
    Not OP, but I've been tinkering with the idea of having a raspberry pi w/ an ext hdd stashed at a friends or parents place and do something like an rsync over wireguard for super important stuff.
    • tlavoie 5y ago
      I'm not doing it remotely, but have an Odroid HC2 set up as a sort of single-drive personal NAS on my home network. Restic backing up to there is absolutely stellar, including being able to mount a snapshot for selective recovery if needed. The HC2 is discontinued now, but the HC4 looks like a nice, current option. https://www.hardkernel.com/shop/odroid-hc4-oled/ https://www.hardkernel.com/shop/odroid-hc4-oled/ Maybe I should get one of these to take to my daughter's place.
  • SturgeonsLaw 5y ago
    If you have OP's level of control over the hardware (ie; you have a dedicated server on which you can access the hypervisor), then taking incremental backups of the entire VM is the best way to ensure you can hit the big undo button if anything goes wrong. The most important, and neglected, part of backup & restore, is the restore. If resources permit, this is where I like to use a battle tested solution instead of rolling my own with scripts. For my self hosted servers I use Veeam, but there are many good alternatives. It's nice having the option to restore the entire VM to a specific state, and to also be able to mount backups and pull files if only a few need to be restored. It's also handy to be able to spin up a backup into its own virtual machine.
    • fivea 5y ago
      > (...) taking incremental backups of the entire VM is the best way to ensure you can hit the big undo button if anything goes wrong. What if your server is already compromised? Doesn't that approach ensure your server remains compromised after you pressed the big undo button?
• slenk 5y ago
  Have you ever looked at nginx proxy manager? I find it much easier to use than traefik since everything can be done through a UI. https://nginxproxymanager.com/ https://nginxproxymanager.com/
  • thrashh 5y ago
    Yeah but once you figure out Traefik, it’s just 3 extra lines in your deployment files for every new service. And I inevitably have to redeploy again, and I hate doing the same boring thing twice, so it’s nice being able to bake complete orchestration into a repo. (And it’s also nice for being able to try things because your repo has a complete full snapshot of your setup that you can diff.)
    • slenk 5y ago
      The thing I like about nginxproxymanager is that it's easy to add non-docker hosts. There are some services that I route that I don't have in the same docker cluster as everything else. That requires static files changes for traefik itself somewhere.