3 ms·

Follow-up question: Should someone interested in self-hosting do it from a literal PC in your basement, configured as a server? Or is self-hosting on AWS / Dr

Follow-up question: Should someone interested in self-hosting do it from a literal PC in your basement, configured as a server? Or is self-hosting on AWS / DreamHost / whatever good enough? I ask because I like self-hosting a lot, especially when market solutions don’t really do what I need them to. But security, man, that worries me. I can’t tell you what a three-way handshake truly is, or what a signed certificate really means: so self-hosting my own email / web server / etc. from my basement gives me a fear that someone, somewhere will take advantage of a vulnerability in some system component that I’ve never even heard of.

ozim 5y ago
Even better do you really need "self hosting" many people will be good enough with external drive. You can also setup something like Synology which is good enough for layman and if you keep it in your local network it is basically easier than configuring some old PC.
inetknght 5y ago
> Should someone interested in self-hosting do it from a literal PC in your basement, configured as a server? It's a good place to start/test. But don't open your firewall: do all of your testing on your internal network. You really don't want to open your network to the kind of problems that can occur while you're learning. When you're ready to really host things then you should rent a cheap shared instance, or maybe a low-priced dedicated server. You can pick up something decent for $10/mo. That's not much if you're skilled enough (eg, employable enough) to learn how to self-host. For your internal network you can use a pi-hole to set up all of your DNS entries so you can even visit "http://example.com http://example.com" and have it point to an IP on your LAN.
vbezhenar 5y ago
If you need mail, you need VPS with good reputation. Otherwise hosting from your basement is an option if you've got accessible IP address.
dna_polymerase 5y ago
For some things your local network is enough, like personal pictures and other private files. E-Mails I would suggest to host in a datacenter. Not necessarily in AWS but a local company offering hosting. For those who feel unable top securely self host I'd suggest looking into smaller providers of hosted E-Mail solutions. A large number of federated services is better than everyone being on Google Workspace or MS360.
alexk307 5y ago
Self-host in your basement, use nginx as your reverse proxy and add tls with letsencrypt. I'd argue this is more secure than most modern applications.
rpdillon 5y ago
I self-host entirely on a Dreamhost VPS, precisely because of the issues you mention. I'm fairly experienced with many of the more technical aspects, but Dreamhost is more diligent than I am, and they stay abreast of issues I'm unaware of. So I handle the app layer (Nextcloud, FreshRSS, Fossil, etc.) and they handle the OS, web server (Apache, PHP, etc.), and certs (through Lets Encrypt). This balance has worked really well for me. No affiliation, just a customer since 2004.
adrian_b 5y ago
I would not encourage someone who completely lacks experience in server/network management to do self-hosting, as it is easy to make mistakes. Nevertheless, if someone is willing to dedicate some time for study and experimentation in the beginning, this is not an insurmountable problem. I have been using self-hosting on "a literal PC in my basement" for about 20 years, without any problems whatsoever, and with negligible costs (the main cost being that I have a set of public IPv4 addresses and a fixed IPv4 address on my router connected to the ISP, which implied a more expensive monthly fee for the ISP). After the first few months, during which I have made frequent changes in the configuration, while I understood better and better how it should work, the time wasted with server management during the next years has been negligible, i.e. just a few hours per year, used mainly for software or hardware upgrades. Configuring and managing services just for personal needs or for the needs of a small number of users, e.g. a family, is much simpler than in an enterprise setting. For reliability, it is good to have a second spare computer and a second image of the root SSD/HDD used on your server, to be able to replace the active server in case of failure. As others have already mentioned, periodic backups should be done and they should preferably be stored in a different location. While I believe that self-hosting is not difficult, unless someone has already done such management work as a professional, it is necessary to learn many things. For security, the first thing needed is to understand well what a firewall does, which are the firewall rules needed by whatever services you want to host and how to configure and monitor whatever firewall program you choose. For this, some knowledge about how the main IP protocols for networking work is necessary. The management of keys and certificates is also important, as you have mentioned, but what you need to learn for this is much less than what you need to learn about networking protocols, in order to both make a correct server configuration in the beginning and to diagnose any problems that might appear later (usually because someone at your ISP makes some changes in their configuration, which break yours, but nobody who answers the support call has any idea that they have changed anything, so you should better be able to identify yourself what they might have done, if you want a quick solution).

ozim 5y ago

Even better do you really need "self hosting" many people will be good enough with external drive. You can also setup something like Synology which is good enough for layman and if you keep it in your local network it is basically easier than configuring some old PC.

inetknght 5y ago

> Should someone interested in self-hosting do it from a literal PC in your basement, configured as a server? It's a good place to start/test. But don't open your firewall: do all of your testing on your internal network. You really don't want to open your network to the kind of problems that can occur while you're learning. When you're ready to really host things then you should rent a cheap shared instance, or maybe a low-priced dedicated server. You can pick up something decent for $10/mo. That's not much if you're skilled enough (eg, employable enough) to learn how to self-host. For your internal network you can use a pi-hole to set up all of your DNS entries so you can even visit "http://example.com http://example.com" and have it point to an IP on your LAN.

vbezhenar 5y ago

If you need mail, you need VPS with good reputation. Otherwise hosting from your basement is an option if you've got accessible IP address.

dna_polymerase 5y ago

For some things your local network is enough, like personal pictures and other private files. E-Mails I would suggest to host in a datacenter. Not necessarily in AWS but a local company offering hosting. For those who feel unable top securely self host I'd suggest looking into smaller providers of hosted E-Mail solutions. A large number of federated services is better than everyone being on Google Workspace or MS360.

alexk307 5y ago

Self-host in your basement, use nginx as your reverse proxy and add tls with letsencrypt. I'd argue this is more secure than most modern applications.

rpdillon 5y ago

I self-host entirely on a Dreamhost VPS, precisely because of the issues you mention. I'm fairly experienced with many of the more technical aspects, but Dreamhost is more diligent than I am, and they stay abreast of issues I'm unaware of. So I handle the app layer (Nextcloud, FreshRSS, Fossil, etc.) and they handle the OS, web server (Apache, PHP, etc.), and certs (through Lets Encrypt). This balance has worked really well for me. No affiliation, just a customer since 2004.

adrian_b 5y ago

I would not encourage someone who completely lacks experience in server/network management to do self-hosting, as it is easy to make mistakes. Nevertheless, if someone is willing to dedicate some time for study and experimentation in the beginning, this is not an insurmountable problem. I have been using self-hosting on "a literal PC in my basement" for about 20 years, without any problems whatsoever, and with negligible costs (the main cost being that I have a set of public IPv4 addresses and a fixed IPv4 address on my router connected to the ISP, which implied a more expensive monthly fee for the ISP). After the first few months, during which I have made frequent changes in the configuration, while I understood better and better how it should work, the time wasted with server management during the next years has been negligible, i.e. just a few hours per year, used mainly for software or hardware upgrades. Configuring and managing services just for personal needs or for the needs of a small number of users, e.g. a family, is much simpler than in an enterprise setting. For reliability, it is good to have a second spare computer and a second image of the root SSD/HDD used on your server, to be able to replace the active server in case of failure. As others have already mentioned, periodic backups should be done and they should preferably be stored in a different location. While I believe that self-hosting is not difficult, unless someone has already done such management work as a professional, it is necessary to learn many things. For security, the first thing needed is to understand well what a firewall does, which are the firewall rules needed by whatever services you want to host and how to configure and monitor whatever firewall program you choose. For this, some knowledge about how the main IP protocols for networking work is necessary. The management of keys and certificates is also important, as you have mentioned, but what you need to learn for this is much less than what you need to learn about networking protocols, in order to both make a correct server configuration in the beginning and to diagnose any problems that might appear later (usually because someone at your ISP makes some changes in their configuration, which break yours, but nobody who answers the support call has any idea that they have changed anything, so you should better be able to identify yourself what they might have done, if you want a quick solution).