5 ms·
> You need to take care of security Easiest solution is to just host stuff on a local network without access to the wider internet. E.g. running on an old lapt
by dcchambers 5y ago
> You need to take care of security
Easiest solution is to just host stuff on a local network without access to the wider internet. E.g. running on an old laptop/raspberry pi/server in your basement.
Sure, that means you can no longer access your self-hosted stuff when you're out of the house, but the tradeoff is peace of mind about your data leaking or worse.
- ngcc_hk 5y agoHow about add a remote apple host. Not for the world but just you?
- nirvdrum 5y agoSetting up a VPN is pretty easy these days. If you don't want to run it on your router, you can look at something like Tailscale for remote access.
- chaxor 5y ago*headscale If you care about privacy or self hosting, use headscale instead. You have no idea what tailscale is really doing.
- bbu 5y ago>You have no idea what tailscale is really doing. please elaborate...
- chaxor 5y agoWhat I mean is just the general statement that can be applied to any company or server. Even if they release all of their code as free and open source (not entirely true, as I understand it - their public servers that handle connecting your devices is not), there is no gaurantee that they are actually using that specific, unmodified code on their servers. They could add or remove whatever they like to the software before deploying it on their servers without you knowing. You have to trust whatever they may write on their blogs. Some people may not care, but the winds these days are shifting away from trusting companies with their private data.
- jjnoakes 5y agoThat helps for external threats breaking into buggy network services, but it doesn't help for compromised apps/images/dependencies exfiltrating your secrets.
- asdff 5y agoA compromised app on a local network has no one to phone home to.
- jjnoakes 5y agoIf it's an air-gapped local network, then sure, but how useful is that? Are you disconnecting your phone/laptop from the internet when you access the air-gapped network, or do you use two network interfaces on every device? I assumed the GP was talking about a typical home "local network", one behind a NAT - so no incoming traffic, but usually, it allows any outgoing traffic.
- spiffytech 5y ago> Sure, that means you can no longer access your self-hosted stuff when you're out of the house, but the tradeoff is peace of mind about your data leaking or worse. Lots of things I'd consider self-hosting are functionally useless if I can't access them from my phone while out and about. I could put my phone on a VPN, but that's just another layer of complexity to add to the self-hosting process.
- mynameisvlad 5y agoI do a split approach -- Most services are available internally only, some are reverse proxied out. It used to be caddy2, but after a recent issue and switching to TrueNAS, I just use Traefik with k8s Ingresses and only set it on the few containers I would like accessible.
- fiddlerwoaroof 5y agoTailscale solves the “a vpn is annoying to setup” problem pretty nicely.
- pixiemagic 5y agoIt does, but I found it to drain a lot of battery on mobile (iOS). I'd say that for a simple setup you're likely to be accessing your services via their LAN IPs or their TailScale IPs, so if you have these bookmarked etc. on your phone then it means you either: 1) Have separate bookmarks for accessing services via the LAN or the VPN, and need to remember to turn on and off the VPN when you need to access things out of the house; or 2) Always access services via the TailScale IP, which means you need to be connected to the VPN on your phone even to access them from your LAN, which in turn either means toggling the VPN on and off even when at home or leaving it connected all the time and letting it drain 20% of your battery every day. It's a great service but I didn't find it to make accessing self-hosted services from out of the home on a phone to be as nice as using them at home, or using a managed service.
- fiddlerwoaroof 5y agoYou could also configure dns via Tailscale so that the same host name resolves to different IPs if you’re connected to the VPN.
- simonw 5y agoTailscale makes accessing a Raspberry Pi in your basement from outside of the house genuinely easy, including from mobile devices. I think Tailscale opens up all kinds of new opportunities for self-hosting.
- chaxor 5y agoYou should probably use headscale instead of you care about self hosting. If you don't trust Google drive with your passwords, why would you trust a company's server that manages access to all of your devices?
- mateuszf 5y agoNever heard of headscale before. Doesn't it require the control server to be accessible publicly?
- Handytinge 5y agoYes, that's the trade off. Let someone else manage the control server, or manage it yourself - not self hosted vs self hosted
- denton-scratch 5y agoThat's not really a solution if you want to self-host mail, or a blog; those services only work if the wider internet can see you.