4 ms·

I've seen the other day people talking about Heimdall in a thread about self-hosted things. I do run a (distributed!) homelab, but it's not clear to me what pr

I've seen the other day people talking about Heimdall in a thread about self-hosted things. I do run a (distributed!) homelab, but it's not clear to me what problem these dashboards solve. I can split the things I run on my homelab in two categories: either "infrastructure", things like VPNs, routing, DB, etc, or "actual apps", like a wiki and whatnot. For the first category, I basically don't "do" anything to them once they're set up. For the second, I type directly the URL as I do with any other website. For my monitoring needs I have a bunch of Grafana dashboards connected to Prometheus. I check them from time to time because I like looking at the pretty colored graphs for some reason, but that's about it.

wutanc 5y ago
A lot of people don't have nice urls for their homelab services, having to memorize IP-numbers and ports is a lot harder. Personally I get a nice feeling of accomplishment from looking at a dashboard with all the services I've set up. It's maybe not super useful but it's nice.
- vladvasiliu 5y ago
  Fair point. It's true that in my case, one of the first things I did was set up DNS. My lab also has a public domain name that I manage through Cloudflare, which also gives me easy SSL [0] for my services. --- [0] "easy" as in I don't have to have an open port for Let's Encrypt. And I'm also uncomfortable with giving full DNS access to every service, because I haven't yet found a registrar with sane access control for zone management.
  - arjvik 5y ago
    I've never tried this before, but take a look at https://www.eff.org/deeplinks/2018/02/technical-deep-dive-securing-automation-acme-dns-challenge-validation https://www.eff.org/deeplinks/2018/02/technical-deep-dive-se..., specifically the CNAME and ACME-DNS methods.
    - vladvasiliu 5y ago
      I was familiar with the CNAME workaround, but it's not practical, since I'd have to manage X different zones, one for each redirection. I thought about abusing DuckDNS or something similar for this, but I figured it wouldn't be fair, so I never did. At one point I set up an internal Smallstep CA [0], which kinda worked but was pretty fragile, so I abandoned it. I didn't know about ACME-DNS. It looks interesting, but for the time being tunneling everything through Cloudflared works well enough for my needs. [0] https://smallstep.com/ https://smallstep.com/
  - Macha 5y ago
    So what I did was put acme-dns on a publicly accessible server I have, and use DNS zone delegation to that, as like you, my provider basically gives you an all or nothing API key as far as DNS access goes.
- xoa 5y ago
  >A lot of people don't have nice urls for their homelab services, having to memorize IP-numbers and ports is a lot harder. There isn't much excuse for that though. In a homelab setting in particular I think you should just run your own DNS and CA with your own domain. The Name Constraints option is handy there for containing scope (also useful for restricting the scope of any other internal CAs a business might ask you to run for example via cross signing).
  - greggsy 5y ago
    I don’t want to remember names either. I type in ‘hei-‘ in the browser, it autocompletes to Heimdall, then I click the shiny button of the thing I want.
    - SahAssar 5y ago
      Is that any different than me typing 'gite' and it autocompletes to my gitea DNS, or 'jell' and it autocompletes to my jellyfin? I'm guessing if you are self-hosting these things they are used often enough that they would be in the top of your autocomplete?
    - shaky-carrousel 5y ago
      Hah, I don't want to remember either. I have 18 services, so it's nice to have a catalog of what I have installed.
      - xoa 5y ago
        I don't suppose either of you have considered, you know, bookmarks in your browser ;)? And for tons of services a dashboard wouldn't be my first choice for cataloging/planning anyway, there are other tools for more or less automated planning/deployment/herding. One still often needs to actually know some addresses too just to make use of services in non-web contexts, and a way to have things not break if IPs need to be adjusted. And you still need some way to make sure everything is talking securely. More than one way to do that too but CAs scale pretty well and have decent general support even amongst end devices. But for a homelab whatever one wants ultimately is fine, whole point is to experiment after all!
- lillecarl 5y ago
  If you don't have DNS you can't have publicly trusted certificates, I'm very doubtful homelabbers go through the effort of getting servers, configuring services and the lot without the most rudimentary protocol in place. Self-managed or not, it's VERY essential with functional DNS
doubled112 5y ago
I've got about 15 of those "actual apps", and my family and friends use some of them too. I can share one homepage to all of them, and only update one place if there are changes. Dashy also has status lights for services, which isn't a replacement for real monitoring, but has been useful.
m-app 5y ago
Regarding your second point: When I initially configured my Cloudflare Tunnels + Access setup, I spent way too much time getting the App Launcher [0] nice and pretty. Seemed really useful seeing as I came from a setup with VPNs and internal IPs, but did not realize that because Cloudflare Access gives you free pretty URLs, I would never look at it again… 0: https://developers.cloudflare.com/cloudflare-one/applications/app-launcher/ https://developers.cloudflare.com/cloudflare-one/application...
- tra3 5y ago
  That’s really neat. I want to expose some self hosted services externally. Is this a good option? I see that there’s a free plan. How’s it working for you?
  - vladvasiliu 5y ago
    I'm also doing this and I like it. One of the most useful things for my case is the access control. Basically, I want my services to be accessible from anywhere, but only by me. This allows me set up authentication before the requests even hit my server. If you want your services to be world accessible, that works well, too. They even have an agent that initiates the connection from the server, so it works well behind ISP CG-NAT, dynamic IPs, etc, and you don't have to mess around with incoming connection filtering.
    - tra3 5y ago
      This is really cool. So I just exposed an instance of next cloud, but it requires an email verification before being accessible. Super cool. Is the cloudflared smart enough to route connections locally? Hm, not sure how that would work. I'm sitting at home, but accessing my nextcloud through the cloud flare. Is there a way to get it to talk to nextcloud locally or is it going through the net?
      - vladvasiliu 5y ago
        > Is the cloudflared smart enough to route connections locally? Hm, not sure how that would work. Do you mean have cloudflared expose your local server locally? No. It's just a reverse proxy of sorts between cloudflare's network and your local server. What you want can be achieved with local DNS, so that nc.tra3.com resolves to <cloudflare-ip> from outside and to 192.168.1.2 from inside. But you should probably also have a local certificate for this to be fully transparent.
greggsy 5y ago
Yeah it’s the typing bit I can’t bothered doing. Heimdall has all the IPs and ports with an easy to recognise icon. Save’s me remembering things when I want to do things. It is my ‘job to be done’, and it does it well. That is the problem these things solve.
- Macha 5y ago
  I guess the distinction for my setup and the parent poster's is having an actual DNS setup? Typing foo and letting it autocomplete to foo.xyz.com in my address bar is faster than going to a dashboard and then clicking a link on the dashboard.
  - yencabulator 5y ago
    Some people like clicking at things. For me, if I have the browser already open, it's control-L type a few characters enter to get to most of my usual destinations.

wutanc 5y ago

A lot of people don't have nice urls for their homelab services, having to memorize IP-numbers and ports is a lot harder. Personally I get a nice feeling of accomplishment from looking at a dashboard with all the services I've set up. It's maybe not super useful but it's nice.

vladvasiliu 5y ago
Fair point. It's true that in my case, one of the first things I did was set up DNS. My lab also has a public domain name that I manage through Cloudflare, which also gives me easy SSL [0] for my services. --- [0] "easy" as in I don't have to have an open port for Let's Encrypt. And I'm also uncomfortable with giving full DNS access to every service, because I haven't yet found a registrar with sane access control for zone management.
- arjvik 5y ago
  I've never tried this before, but take a look at https://www.eff.org/deeplinks/2018/02/technical-deep-dive-securing-automation-acme-dns-challenge-validation https://www.eff.org/deeplinks/2018/02/technical-deep-dive-se..., specifically the CNAME and ACME-DNS methods.
  - vladvasiliu 5y ago
    I was familiar with the CNAME workaround, but it's not practical, since I'd have to manage X different zones, one for each redirection. I thought about abusing DuckDNS or something similar for this, but I figured it wouldn't be fair, so I never did. At one point I set up an internal Smallstep CA [0], which kinda worked but was pretty fragile, so I abandoned it. I didn't know about ACME-DNS. It looks interesting, but for the time being tunneling everything through Cloudflared works well enough for my needs. [0] https://smallstep.com/ https://smallstep.com/
- Macha 5y ago
  So what I did was put acme-dns on a publicly accessible server I have, and use DNS zone delegation to that, as like you, my provider basically gives you an all or nothing API key as far as DNS access goes.
xoa 5y ago
>A lot of people don't have nice urls for their homelab services, having to memorize IP-numbers and ports is a lot harder. There isn't much excuse for that though. In a homelab setting in particular I think you should just run your own DNS and CA with your own domain. The Name Constraints option is handy there for containing scope (also useful for restricting the scope of any other internal CAs a business might ask you to run for example via cross signing).
- greggsy 5y ago
  I don’t want to remember names either. I type in ‘hei-‘ in the browser, it autocompletes to Heimdall, then I click the shiny button of the thing I want.
  - SahAssar 5y ago
    Is that any different than me typing 'gite' and it autocompletes to my gitea DNS, or 'jell' and it autocompletes to my jellyfin? I'm guessing if you are self-hosting these things they are used often enough that they would be in the top of your autocomplete?
  - shaky-carrousel 5y ago
    Hah, I don't want to remember either. I have 18 services, so it's nice to have a catalog of what I have installed.
    - xoa 5y ago
      I don't suppose either of you have considered, you know, bookmarks in your browser ;)? And for tons of services a dashboard wouldn't be my first choice for cataloging/planning anyway, there are other tools for more or less automated planning/deployment/herding. One still often needs to actually know some addresses too just to make use of services in non-web contexts, and a way to have things not break if IPs need to be adjusted. And you still need some way to make sure everything is talking securely. More than one way to do that too but CAs scale pretty well and have decent general support even amongst end devices. But for a homelab whatever one wants ultimately is fine, whole point is to experiment after all!
lillecarl 5y ago
If you don't have DNS you can't have publicly trusted certificates, I'm very doubtful homelabbers go through the effort of getting servers, configuring services and the lot without the most rudimentary protocol in place. Self-managed or not, it's VERY essential with functional DNS

doubled112 5y ago

I've got about 15 of those "actual apps", and my family and friends use some of them too. I can share one homepage to all of them, and only update one place if there are changes. Dashy also has status lights for services, which isn't a replacement for real monitoring, but has been useful.

m-app 5y ago

Regarding your second point: When I initially configured my Cloudflare Tunnels + Access setup, I spent way too much time getting the App Launcher [0] nice and pretty. Seemed really useful seeing as I came from a setup with VPNs and internal IPs, but did not realize that because Cloudflare Access gives you free pretty URLs, I would never look at it again… 0: https://developers.cloudflare.com/cloudflare-one/applications/app-launcher/ https://developers.cloudflare.com/cloudflare-one/application...

tra3 5y ago
That’s really neat. I want to expose some self hosted services externally. Is this a good option? I see that there’s a free plan. How’s it working for you?
- vladvasiliu 5y ago
  I'm also doing this and I like it. One of the most useful things for my case is the access control. Basically, I want my services to be accessible from anywhere, but only by me. This allows me set up authentication before the requests even hit my server. If you want your services to be world accessible, that works well, too. They even have an agent that initiates the connection from the server, so it works well behind ISP CG-NAT, dynamic IPs, etc, and you don't have to mess around with incoming connection filtering.
  - tra3 5y ago
    This is really cool. So I just exposed an instance of next cloud, but it requires an email verification before being accessible. Super cool. Is the cloudflared smart enough to route connections locally? Hm, not sure how that would work. I'm sitting at home, but accessing my nextcloud through the cloud flare. Is there a way to get it to talk to nextcloud locally or is it going through the net?
    - vladvasiliu 5y ago
      > Is the cloudflared smart enough to route connections locally? Hm, not sure how that would work. Do you mean have cloudflared expose your local server locally? No. It's just a reverse proxy of sorts between cloudflare's network and your local server. What you want can be achieved with local DNS, so that nc.tra3.com resolves to <cloudflare-ip> from outside and to 192.168.1.2 from inside. But you should probably also have a local certificate for this to be fully transparent.

greggsy 5y ago

Yeah it’s the typing bit I can’t bothered doing. Heimdall has all the IPs and ports with an easy to recognise icon. Save’s me remembering things when I want to do things. It is my ‘job to be done’, and it does it well. That is the problem these things solve.

Macha 5y ago
I guess the distinction for my setup and the parent poster's is having an actual DNS setup? Typing foo and letting it autocomplete to foo.xyz.com in my address bar is faster than going to a dashboard and then clicking a link on the dashboard.
- yencabulator 5y ago
  Some people like clicking at things. For me, if I have the browser already open, it's control-L type a few characters enter to get to most of my usual destinations.