4 ms·

One thing to be mindful of is security. The last you want is for your setup to be compromised, be used to send spam/botnets and then getting perma-banned from

One thing to be mindful of is security. The last you want is for your setup to be compromised, be used to send spam/botnets and then getting perma-banned from your ISP. I would argue it's a lot less risky just to put your static site on S3/Github etc.

michalwarda 4y ago
As mentioned in the post. I would probably not use this setup with my more "exposing" projects like full web apps.
layer8 4y ago
Yeah, I would decouple it from any residential ISP, but use a $4 VPS to still self-host. That also removes the need for a DDNS setup. Given some basic Linux skills, all you need is SSH plus nginx+certbot on Debian with unattended-upgrades or similar, that you can point your domain to.
- threeseed 4y ago
  Would recommend Tailscale over SSH. Really easy to setup/use and means you don't have to open up ports like 22 which are constantly being port scanned.
  - imgabe 4y ago
    You can move ssh to a different port.
    - indigodaddy 4y ago
      Anyone who thinks they need to move ssh to a different port likely doesn’t have their ssh security configuration setup optimally.
      - gnramires 4y ago
        Making it explicit: try to always use keys for ssh, avoid passwords. If you have to use passwords, make it very long (20+ chars) and random. Don't use dictionary words or reuse passwords from anywhere else.
        indigodaddy 4y ago
        Yep, and I always additionally just disable pw authentication altogether, and set PermitRootLogin to either No or without-password. You can also do things like firewalld off (or with hosts.allow) 22 to just an ssh bastion/jumphost src (or your house IP), but I find that’s usually not necessary (although an excellent further step if you are a bit paranoid) as long you do what was mentioned in first paragraph.
      - komali2 4y ago
        I don't get it, wouldn't you use ssh keys and also just move it to a different port anyway to save the annoyance of random scriptkiddy pokes all the time?
      - piaste 4y ago
        Moving the port away from 22 changed my fail2ban logs from hundreds of lines a day to one every few weeks at most. While you shouldn't skip on other security measures, there's no real downside to changing your SSH port and getting off the target list for a lot of botnets. (As opposed to e.g. port knocking, which is stronger but makes it easy to lock yourself out and may create issues with some SSH clients.)
      - cube00 4y ago
        There's other reasons to use a different port. I move it to cut down on the failed login attempts (yes they'll never succeed given I only allow keys) but they clutter the log so I can't tell if I'm actually being targeted or not. On an obscure port if I do see attempts I know something serious is going on.
  - saghm 4y ago
    I'm not familiar with Tailscale, but you can easily use a different port than 22 for ssh if you want to; put a different port number in `/etc/ssh/sshd_config` on the server, and then set your `~/.ssh/config` to use that port on your clients. If you're going to be opening it up externally, you also can map a different port to the local one (which is necessary if you want to be able to ssh into two different servers with the same ssh port from the outside anyhow).
doublepg23 4y ago
Indeed. My friend had a crypto miner put on his self-hosted server. This was merely weeks after telling him to switch to Tailscale, but it was a great learning experience.
sdan 4y ago
I was running a couple million page views/mo on a cluster of raspberry pis in my parents home a few years back. After some disruptions on my family's network I decided to setup a Wireguard VPN with Docker Swarm and a GCP instance to essentially route from GCP IP address -> Raspberry pi cluster such that my IP wouldn't get leaked and didn't have to worry about dynamic IP addresses Very hard to do and finicky to setup but at the time was suitable for my needs
- ed25519FUUU 4y ago
  Why not sure cloudflare?
superkuh 4y ago
Using a web browser with JS execution enabled is a lot more dangerous than running nginx showing .html files in directories.
ronsor 4y ago
If you're using a modern web server like nginx, then you have to really do something wrong to get hacked serving static files.
- cube00 4y ago
  That's not really fair, zero days will always exist.
  - conductr 4y ago
    What setup is immune to zero days?
    - threeseed 4y ago
      S3, Github, Netlify etc are going to be infinitely more secure than your home setup. And are basically free.
      - red-iron-pine 4y ago
        theyre not immune to 0-days tho. they just have more staff on hand to respond, run updates, and do the due diligence of checking and implementing patches.
      - aembleton 4y ago
        But no more immune to zero days
  - shxdow 4y ago
    In order to be fair, threat models should be taken into account. People seem to be conflating nation state operations using advanced capabilities worth at least hundreds of thousands of dollars to compromise high value targets/infrastructure with "my pet project may get 0 day'd" which is the exact opposite of being fair. Moreover, if the argument is "zero days will always exist" you may as well stop using technology entirely.
- 4y ago
kortilla 4y ago
You don’t get perma-banned from your ISP for getting malware. That’s pure FUD. Far more people (at least 2 orders of magnitude) end up infected with malware and become members of botnets from just clicking dumb shit. They don’t get banned from the ISP either.
- icedchai 4y ago
  I had my cable ISP call me a couple times about a business account a few times. I run my own mail server. A POP3/SMTP account got hacked and started sending out spam. They're very polite, professional, ask you to fix the problem and move on.
  - nubinetwork 4y ago
    I'm surprised you got a phone call, when I worked at a tier 2, we would just disconnect you and wait for you to call us instead.
  - red-iron-pine 4y ago
    running your own mail server is an exercise in pain. not sure if you're brave or dumb, but props to giving it a go.
    - icedchai 4y ago
      Heh. I've been running my own since the mid 90's. Originally I worked for some early ISPs, and continued it as a hobby of sorts. (My main personal email is on gmail.)
- threeseed 4y ago
  If you're running an email server that is running at full throughput to send spam (due to your clear negligence) from a residential ISP account then depending on what plan you've purchased it may violate your terms of service. I know of friends who have been banned for doing exactly this.
- fijiaarone 4y ago

michalwarda 4y ago

As mentioned in the post. I would probably not use this setup with my more "exposing" projects like full web apps.

layer8 4y ago

Yeah, I would decouple it from any residential ISP, but use a $4 VPS to still self-host. That also removes the need for a DDNS setup. Given some basic Linux skills, all you need is SSH plus nginx+certbot on Debian with unattended-upgrades or similar, that you can point your domain to.

threeseed 4y ago
Would recommend Tailscale over SSH. Really easy to setup/use and means you don't have to open up ports like 22 which are constantly being port scanned.
- imgabe 4y ago
  You can move ssh to a different port.
  - indigodaddy 4y ago
    Anyone who thinks they need to move ssh to a different port likely doesn’t have their ssh security configuration setup optimally.
    - gnramires 4y ago
      Making it explicit: try to always use keys for ssh, avoid passwords. If you have to use passwords, make it very long (20+ chars) and random. Don't use dictionary words or reuse passwords from anywhere else.
      - indigodaddy 4y ago
        Yep, and I always additionally just disable pw authentication altogether, and set PermitRootLogin to either No or without-password. You can also do things like firewalld off (or with hosts.allow) 22 to just an ssh bastion/jumphost src (or your house IP), but I find that’s usually not necessary (although an excellent further step if you are a bit paranoid) as long you do what was mentioned in first paragraph.
    - komali2 4y ago
      I don't get it, wouldn't you use ssh keys and also just move it to a different port anyway to save the annoyance of random scriptkiddy pokes all the time?
    - piaste 4y ago
      Moving the port away from 22 changed my fail2ban logs from hundreds of lines a day to one every few weeks at most. While you shouldn't skip on other security measures, there's no real downside to changing your SSH port and getting off the target list for a lot of botnets. (As opposed to e.g. port knocking, which is stronger but makes it easy to lock yourself out and may create issues with some SSH clients.)
    - cube00 4y ago
      There's other reasons to use a different port. I move it to cut down on the failed login attempts (yes they'll never succeed given I only allow keys) but they clutter the log so I can't tell if I'm actually being targeted or not. On an obscure port if I do see attempts I know something serious is going on.
- saghm 4y ago
  I'm not familiar with Tailscale, but you can easily use a different port than 22 for ssh if you want to; put a different port number in `/etc/ssh/sshd_config` on the server, and then set your `~/.ssh/config` to use that port on your clients. If you're going to be opening it up externally, you also can map a different port to the local one (which is necessary if you want to be able to ssh into two different servers with the same ssh port from the outside anyhow).

doublepg23 4y ago

Indeed. My friend had a crypto miner put on his self-hosted server. This was merely weeks after telling him to switch to Tailscale, but it was a great learning experience.

sdan 4y ago

I was running a couple million page views/mo on a cluster of raspberry pis in my parents home a few years back. After some disruptions on my family's network I decided to setup a Wireguard VPN with Docker Swarm and a GCP instance to essentially route from GCP IP address -> Raspberry pi cluster such that my IP wouldn't get leaked and didn't have to worry about dynamic IP addresses Very hard to do and finicky to setup but at the time was suitable for my needs

ed25519FUUU 4y ago
Why not sure cloudflare?

superkuh 4y ago

Using a web browser with JS execution enabled is a lot more dangerous than running nginx showing .html files in directories.

ronsor 4y ago

If you're using a modern web server like nginx, then you have to really do something wrong to get hacked serving static files.

cube00 4y ago
That's not really fair, zero days will always exist.
- conductr 4y ago
  What setup is immune to zero days?
  - threeseed 4y ago
    S3, Github, Netlify etc are going to be infinitely more secure than your home setup. And are basically free.
    - red-iron-pine 4y ago
      theyre not immune to 0-days tho. they just have more staff on hand to respond, run updates, and do the due diligence of checking and implementing patches.
    - aembleton 4y ago
      But no more immune to zero days
- shxdow 4y ago
  In order to be fair, threat models should be taken into account. People seem to be conflating nation state operations using advanced capabilities worth at least hundreds of thousands of dollars to compromise high value targets/infrastructure with "my pet project may get 0 day'd" which is the exact opposite of being fair. Moreover, if the argument is "zero days will always exist" you may as well stop using technology entirely.
4y ago

kortilla 4y ago

You don’t get perma-banned from your ISP for getting malware. That’s pure FUD. Far more people (at least 2 orders of magnitude) end up infected with malware and become members of botnets from just clicking dumb shit. They don’t get banned from the ISP either.

icedchai 4y ago
I had my cable ISP call me a couple times about a business account a few times. I run my own mail server. A POP3/SMTP account got hacked and started sending out spam. They're very polite, professional, ask you to fix the problem and move on.
- nubinetwork 4y ago
  I'm surprised you got a phone call, when I worked at a tier 2, we would just disconnect you and wait for you to call us instead.
- red-iron-pine 4y ago
  running your own mail server is an exercise in pain. not sure if you're brave or dumb, but props to giving it a go.
  - icedchai 4y ago
    Heh. I've been running my own since the mid 90's. Originally I worked for some early ISPs, and continued it as a hobby of sorts. (My main personal email is on gmail.)
threeseed 4y ago
If you're running an email server that is running at full throughput to send spam (due to your clear negligence) from a residential ISP account then depending on what plan you've purchased it may violate your terms of service. I know of friends who have been banned for doing exactly this.
fijiaarone 4y ago