3 ms·

You also need stuff like networking, TLS/certs, and DNS which aren't easily packaged, at least not in a way that doesn't require you to make sketchy changes on

You also need stuff like networking, TLS/certs, and DNS which aren't easily packaged, at least not in a way that doesn't require you to make sketchy changes on every client device.

pkulak 5y ago
Something like Cloudflare Argo tunneling would work great for this. No certs at all for the user to mess around with, it terminated on the public internet, not in your house.
- throwaway894345 5y ago
  I guess I’m assuming at least some things are on a private network, in which case things are much more complicated.
  - pkulak 5y ago
    No, not at all. You can tunnel traffic from any machine, anywhere to be terminated at a public IP.
    - throwaway894345 5y ago
      I think you're misunderstanding the objective. I don't want most of my services (e.g., personal finance, photos, Plex, etc) to terminate at a public IP, that's the whole point of the private network in the first place. So for those explicitly private services, we now need DNS and TLS and in the latter case ideally something like LetsEncrypt so you don't have to manually rotate your certs (but the normal verification methods don't work because your service isn't accessible to LE in the first place--maybe you can run some bastion/proxy?).
southerntofu 5y ago
> You also need stuff like networking, TLS/certs, and DNS which aren't easily packaged The only thing that cannot be packaged is changing your home network settings. For this you need to click buttons on your modem/router. Fortunately, many selfhosted programs (eg. prosody for XMPP chat) and distros (eg. yunohost) have check commands or panels to figure out what's not configured well on your network and guide you through the process. Also worth pointing out, Yunohost distro is also intended to be used over a VPN precisely so you don't have to deal with networking setup. Yunohost was bred in the non-profit ISP scene here in France and so your local ISP will provide you with an "internet cube" (SBC) and a VPN access giving you real public IPv4/IPv6 so that: - you don't have to configure the network - you don't have to change DNS settings when you change connection (your server works if you take it with you over 3G/4G/whateverG) - your ISP doesn't get to filter the network (unless it filters VPN access but that's rather uncommon) See also https://internetcu.be/ https://internetcu.be/

You also need stuff like networking, TLS/certs, and DNS which aren't easily packaged, at least not in a way that doesn't require you to make sketchy changes on every client device.

pkulak 5y ago

Something like Cloudflare Argo tunneling would work great for this. No certs at all for the user to mess around with, it terminated on the public internet, not in your house.

throwaway894345 5y ago
I guess I’m assuming at least some things are on a private network, in which case things are much more complicated.
- pkulak 5y ago
  No, not at all. You can tunnel traffic from any machine, anywhere to be terminated at a public IP.
  - throwaway894345 5y ago
    I think you're misunderstanding the objective. I don't want most of my services (e.g., personal finance, photos, Plex, etc) to terminate at a public IP, that's the whole point of the private network in the first place. So for those explicitly private services, we now need DNS and TLS and in the latter case ideally something like LetsEncrypt so you don't have to manually rotate your certs (but the normal verification methods don't work because your service isn't accessible to LE in the first place--maybe you can run some bastion/proxy?).

southerntofu 5y ago

> You also need stuff like networking, TLS/certs, and DNS which aren't easily packaged The only thing that cannot be packaged is changing your home network settings. For this you need to click buttons on your modem/router. Fortunately, many selfhosted programs (eg. prosody for XMPP chat) and distros (eg. yunohost) have check commands or panels to figure out what's not configured well on your network and guide you through the process. Also worth pointing out, Yunohost distro is also intended to be used over a VPN precisely so you don't have to deal with networking setup. Yunohost was bred in the non-profit ISP scene here in France and so your local ISP will provide you with an "internet cube" (SBC) and a VPN access giving you real public IPv4/IPv6 so that: - you don't have to configure the network - you don't have to change DNS settings when you change connection (your server works if you take it with you over 3G/4G/whateverG) - your ISP doesn't get to filter the network (unless it filters VPN access but that's rather uncommon) See also https://internetcu.be/ https://internetcu.be/