4 ms·

NextCloud, Home Assistant, Paperless NGX, Minecraft, Caddy for some Hugo sites/blogs, Unify Controller, Vaultwarden, Traefik, Sabnzbd. Used to do WireGuard but

NextCloud, Home Assistant, Paperless NGX, Minecraft, Caddy for some Hugo sites/blogs, Unify Controller, Vaultwarden, Traefik, Sabnzbd. Used to do WireGuard but now I use Tailscale, AdGuard home and FoundryVTT. It's all docker-compose. I'm thinking of taking some services off the internet using TailScale, some already are just on the Tailnet (Home Assistant and Paperless NGX), all my SSH ports are now only open to the tailnet as well. I love Tailscale, except for the battery drain on my iPhone (which wasn't an issue with plain WireGuard)... Btw, this is my hardware: https://blog.hmrt.nl/posts/personal-cloud-infrastructure/#hardware https://blog.hmrt.nl/posts/personal-cloud-infrastructure/#ha... (beware, the rest of the post is somewhat dated). Oh, I moved Paperless and Home Assistant to a NUC, mainly because I'm working on the house a lot and I really need those online, those were also set up with Tailscale in mind, and the advantage is that whether that NUC is plugged in, on WiFi or at my parent's place, all services (inc ssh) are still available at the same IP address (of course sensors drop when I move the NUC out of my network, there is no Tailscale for the Shelly plugs etc :)). I'm thinking of a similar setup for my NextCloud now. Always innovating, it's a nice hobby.

cassianoleal 4y ago
> I love Tailscale, except for the battery drain on my iPhone Same, I hope they can fix this soon. :(
- edsimpson 4y ago
  Yah it really does destroy my battery on iOS.
- avnigo 4y ago
  I've run into this too, and there's been an open issue on this for some time now: https://github.com/tailscale/tailscale/issues/3363 https://github.com/tailscale/tailscale/issues/3363
sithadmin 4y ago
>I love Tailscale, except for the battery drain on my iPhone (which wasn't an issue with plain WireGuard). Netmaker is a good self-hosted alternative that utilizes Wireguard.
jnovek 4y ago
“It's all docker-compose.” Are you using a utility to manage docker-compose or just setting it up on the CLI (e.g. started with a systemd service)? I run docker-compose via CLI on my server but it’s not always convenient to ssh in to check on something.
- teekert 4y ago
  Since it's all a yaml file I just use vscode's remote-ssh to check (files opens in vscode, one click opens a shell at the bottom (ie for docker-compose ps), nice thing is that remote-ssh also allows dragging and dropping files to the server without needing anything else, rarely need that though). If you add the `restart: unless-stopped` line, all containers just come up again after crashes/reboots. On Arch I just `sudo systemctl enable docker` (after `sudo pacman docker docker-compose`), I wrote a bit about it here: [0]. This starts docker automatically, and docker automatically starts any containers with the above mentioned line in their service entry. [0]" https://blog.hmrt.nl/posts/wordpress_using_swag/ https://blog.hmrt.nl/posts/wordpress_using_swag/
- grepfru_it 4y ago
  Look into portainer
jckahn 4y ago
Very cool! Since this is all exposed to the internet, how do you keep it secure? I’ve got a spare laptop and a static IP, but I’m concerned about exposing my home server to attacks. Right now I’ve just got it all running in Tailscale, but I’d like to safely host public-facing apps too.
- teekert 4y ago
  I religiously keep everything up to date, for anything exposed to the public I use https (Traefik does let's encrypt, caddy as well) and set 2FA for Nextcloud for example, there is also a brute-force protection app for NC. Some services, like HA, my minecraft servers, Paperless, in fact most of them, I would indeed feel less comfortable exposing, and I don't, but for NextCloud I also use it to share large files with friends so it needs to be internet facing, as do the blogs, but Hugo generates static sites, so that is quite secure (like earlier mentioned blog).
  - jckahn 4y ago
    Thank you for the explanation! It sounds like a pretty solid system.
- GTP 4y ago
  In addition to the other comment, look into fail2ban: it's a bruteforce protection that isn't application-specific, it can be configured to protect form bruteforce any service that logs login attempts somewhere.
- DrPhish 4y ago
  One extra layer I put on my externally facing sites is a simple auth prompt (after redirect to https!) as an unlikely-to-have-a-compromise gate before any logon for a self-hosted service. You can make it a fairly easy to remember username/password for anyone you want to share your self-hosted apps with, since its a mostly irrelevant extra step just to guard against exploits in more complicated software stacks
  - grepfru_it 4y ago
ornornor 4y ago
> docker-compose How do you deal with backups? That’s my main struggle with docker.
- LilBytes 4y ago
  I use Borg (https://borgbackup.readthedocs.io/en/stable/ https://borgbackup.readthedocs.io/en/stable/) with some Python and Bash scripts. All my containers write to the same volume mount (e.g., /mnt/docker_share/$service_name), the scripts shutdown the LVM, run the backups from Borg, sync the files to rsync.net and turn the LVM back on when the backups finish.

cassianoleal 4y ago

> I love Tailscale, except for the battery drain on my iPhone Same, I hope they can fix this soon. :(

edsimpson 4y ago
Yah it really does destroy my battery on iOS.
avnigo 4y ago
I've run into this too, and there's been an open issue on this for some time now: https://github.com/tailscale/tailscale/issues/3363 https://github.com/tailscale/tailscale/issues/3363

sithadmin 4y ago

>I love Tailscale, except for the battery drain on my iPhone (which wasn't an issue with plain WireGuard). Netmaker is a good self-hosted alternative that utilizes Wireguard.

jnovek 4y ago

“It's all docker-compose.” Are you using a utility to manage docker-compose or just setting it up on the CLI (e.g. started with a systemd service)? I run docker-compose via CLI on my server but it’s not always convenient to ssh in to check on something.

teekert 4y ago
Since it's all a yaml file I just use vscode's remote-ssh to check (files opens in vscode, one click opens a shell at the bottom (ie for docker-compose ps), nice thing is that remote-ssh also allows dragging and dropping files to the server without needing anything else, rarely need that though). If you add the `restart: unless-stopped` line, all containers just come up again after crashes/reboots. On Arch I just `sudo systemctl enable docker` (after `sudo pacman docker docker-compose`), I wrote a bit about it here: [0]. This starts docker automatically, and docker automatically starts any containers with the above mentioned line in their service entry. [0]" https://blog.hmrt.nl/posts/wordpress_using_swag/ https://blog.hmrt.nl/posts/wordpress_using_swag/
grepfru_it 4y ago
Look into portainer

jckahn 4y ago

Very cool! Since this is all exposed to the internet, how do you keep it secure? I’ve got a spare laptop and a static IP, but I’m concerned about exposing my home server to attacks. Right now I’ve just got it all running in Tailscale, but I’d like to safely host public-facing apps too.

teekert 4y ago
I religiously keep everything up to date, for anything exposed to the public I use https (Traefik does let's encrypt, caddy as well) and set 2FA for Nextcloud for example, there is also a brute-force protection app for NC. Some services, like HA, my minecraft servers, Paperless, in fact most of them, I would indeed feel less comfortable exposing, and I don't, but for NextCloud I also use it to share large files with friends so it needs to be internet facing, as do the blogs, but Hugo generates static sites, so that is quite secure (like earlier mentioned blog).
- jckahn 4y ago
  Thank you for the explanation! It sounds like a pretty solid system.
GTP 4y ago
In addition to the other comment, look into fail2ban: it's a bruteforce protection that isn't application-specific, it can be configured to protect form bruteforce any service that logs login attempts somewhere.
DrPhish 4y ago
One extra layer I put on my externally facing sites is a simple auth prompt (after redirect to https!) as an unlikely-to-have-a-compromise gate before any logon for a self-hosted service. You can make it a fairly easy to remember username/password for anyone you want to share your self-hosted apps with, since its a mostly irrelevant extra step just to guard against exploits in more complicated software stacks
- grepfru_it 4y ago

ornornor 4y ago

> docker-compose How do you deal with backups? That’s my main struggle with docker.

LilBytes 4y ago
I use Borg (https://borgbackup.readthedocs.io/en/stable/ https://borgbackup.readthedocs.io/en/stable/) with some Python and Bash scripts. All my containers write to the same volume mount (e.g., /mnt/docker_share/$service_name), the scripts shutdown the LVM, run the backups from Borg, sync the files to rsync.net and turn the LVM back on when the backups finish.