3 ms·

I value this, which is why I use Cloudflare. It’s the only reasonable economical way to self-host my site in the current time while following security best pra

I value this, which is why I use Cloudflare. It’s the only reasonable economical way to self-host my site in the current time while following security best practices. With TLS it’s arbitrarily easy to overwhelm a target site that’s hosted on the smallest instance types at $provider due to the compute requirements of terminating TLS. Thankfully Cloudflare + LetsEncrypt makes it economical to host a personal site with good security without arbitrarily and suddenly high bills, constantly high bills, or my site arbitrarily disappearing off the web. Bad actors poisoned the well (thanks China), and now here we are. I, for one, appreciate greatly what Cloudflare has done for the indieweb.

Vecr 4y ago
Could you connect a bigger server at your house or wherever using Wireguard to a small VPS, and then don't terminate the TLS at the VPS, use haproxy in TCP mode or similar to copy the still TLS-encrypted TCP connections down the Wireguard pipe back to your house. In that case no one can DOS/DDOS your house (because they don't know your IP), and you can throttle the connections down the Wireguard pipe as well, see CAKE[0], with "Outbound, General Case" but with wg0 instead of eth0 done on the VPS. https://www.bufferbloat.net/projects/codel/wiki/CakeRecipes/ https://www.bufferbloat.net/projects/codel/wiki/CakeRecipes/
- tristor 4y ago
  > Could you Yes. I could. This is one of several possible solutions available to me as an alternative. All alternative solutions to this problem either: 1. Are more expensive to implement, for various values of "more expensive". 2. Are more complicated to implement, for various values of "more complicated". 3. Are less resilient to the problem space, for various values of "less resilient". In some cases, they are all three. The proposal you made happens to be all three. If I were to do things all over again from scratch /today/, I might do things differently, simply because I'm more well off and have a more stable physical location than when I set up the last iteration of my personal site (which is still running), but none of the possibilities I can think of are strictly "better" than what I have already done, leveraging Cloudflare.

Vecr 4y ago

Could you connect a bigger server at your house or wherever using Wireguard to a small VPS, and then don't terminate the TLS at the VPS, use haproxy in TCP mode or similar to copy the still TLS-encrypted TCP connections down the Wireguard pipe back to your house. In that case no one can DOS/DDOS your house (because they don't know your IP), and you can throttle the connections down the Wireguard pipe as well, see CAKE[0], with "Outbound, General Case" but with wg0 instead of eth0 done on the VPS. https://www.bufferbloat.net/projects/codel/wiki/CakeRecipes/ https://www.bufferbloat.net/projects/codel/wiki/CakeRecipes/

tristor 4y ago
> Could you Yes. I could. This is one of several possible solutions available to me as an alternative. All alternative solutions to this problem either: 1. Are more expensive to implement, for various values of "more expensive". 2. Are more complicated to implement, for various values of "more complicated". 3. Are less resilient to the problem space, for various values of "less resilient". In some cases, they are all three. The proposal you made happens to be all three. If I were to do things all over again from scratch /today/, I might do things differently, simply because I'm more well off and have a more stable physical location than when I set up the last iteration of my personal site (which is still running), but none of the possibilities I can think of are strictly "better" than what I have already done, leveraging Cloudflare.