4 ms·

If you don't mind me asking, how do you have your own infrastructure configured? I just recently set up my own blog on a DO droplet, which is fairly vendor-por

If you don't mind me asking, how do you have your own infrastructure configured? I just recently set up my own blog on a DO droplet, which is fairly vendor-portable if I need to change cloud providers. I had always assumed that serving content over a non-commercial connection would have some issues, although this was more of a vague doubt in the back of my mind. Do you worry about having greater exposure to (possibly malicious) outside traffic on your home network? Does your private ISP plan provide enough resources for hosting content?

digitallyfree 4y ago
I talked a bit about this in another comment (https://news.ycombinator.com/item?id=31686615#31687589 https://news.ycombinator.com/item?id=31686615#31687589), but let me provide a quick runthrough. I have 443 port forwarded on my Ubi Edgerouter, which sends those to a container on my server with SSLH. SSLH forwards OpenVPN packets to my pfSense VM and SSL packets to NGINX which directs the web traffic to other containers hosting the actual web services. I have a subdomain with DDNS that is routed to my public dynamic IP. The above is for services that don't go through the CDN like Matrix. For my public web site which uses Cloudflare, I use an Argo tunnel directly from the webserver container to the CDN itself. Due to the CDN and the static site it barely affects my connection. Honestly what slows down my connection is if several people use full-tunnel VPN at once due to my limited upload speed. I run enterprise equipment and know how to use it, and my provider allows me to connect my own equipment to their network. They also permit home hosting within reason. The line is also very stable, so uptime is good and things are reliable when everything is properly set up. I also have a backup server to run my VMs if the main one fails, have a spare modem, etc. The idea is that if anything happens on my end it can be fixed in a couple hours. Security wise the VPN is locked down and so is Matrix (access for family members only, no public account creation permitted). Bots do occassionally connect to my public IP but its nothing to worry about. For the website CF takes care of traffic spikes. Since everything is in seperate containers and VMs in a worst case scenario the damage done will be limited.
- heywoodlh 4y ago
  Fun rundown to read, thanks for sharing!

digitallyfree 4y ago

I talked a bit about this in another comment (https://news.ycombinator.com/item?id=31686615#31687589 https://news.ycombinator.com/item?id=31686615#31687589), but let me provide a quick runthrough. I have 443 port forwarded on my Ubi Edgerouter, which sends those to a container on my server with SSLH. SSLH forwards OpenVPN packets to my pfSense VM and SSL packets to NGINX which directs the web traffic to other containers hosting the actual web services. I have a subdomain with DDNS that is routed to my public dynamic IP. The above is for services that don't go through the CDN like Matrix. For my public web site which uses Cloudflare, I use an Argo tunnel directly from the webserver container to the CDN itself. Due to the CDN and the static site it barely affects my connection. Honestly what slows down my connection is if several people use full-tunnel VPN at once due to my limited upload speed. I run enterprise equipment and know how to use it, and my provider allows me to connect my own equipment to their network. They also permit home hosting within reason. The line is also very stable, so uptime is good and things are reliable when everything is properly set up. I also have a backup server to run my VMs if the main one fails, have a spare modem, etc. The idea is that if anything happens on my end it can be fixed in a couple hours. Security wise the VPN is locked down and so is Matrix (access for family members only, no public account creation permitted). Bots do occassionally connect to my public IP but its nothing to worry about. For the website CF takes care of traffic spikes. Since everything is in seperate containers and VMs in a worst case scenario the damage done will be limited.

heywoodlh 4y ago
Fun rundown to read, thanks for sharing!