4 ms·

It's worth mentioning https://YUNoHost.org https://YUNoHost.org. I've done plenty of manual self-hosting. I explored sandstorm for a year or two in the mid 201

by mcint 3y ago

It's worth mentioning https://YUNoHost.org https://YUNoHost.org. I've done plenty of manual self-hosting. I explored sandstorm for a year or two in the mid 2010s. It worked as promised, but the complexity of integrations, fraying, showed. I switched to yunohost 6 years ago. I almost entirely don't think about it. I use a few services, wallabag and Uptime Kuma. Tried Nextcloud, HedgeDoc /HackMD/CodiMD, and Monica PRM because it was so painless to give them a go. My initial motivation for exploring it, came from the hope it could install NextCloud. My attempts at installing OpenCloud and NextCloud, with scripts that would make non-idempotent changes that fail on a second run after first pass fixes, left me sensing an unfriendly forced upsell environment. I have had to do some manual fixing to complete an upgrade or two, but it has workflows for backups, and some stringent, but fully automated configuration, sanity checking. I don't worry about the complexity.

ocdtrekkie 3y ago
My understanding is YunoHost makes absolutely no attempt to isolate apps from one another, it just helps you install stuff on a Linux box. Unfortunately that means a single flaw in a single app compromises your entire server.
- rapnie 3y ago
  Yes, Yunohost makes installs very easy. But if something isn't working right then you got extra layers to deal with. I don't know how Sandstorm deals with this, but Yunohost taking care of the install and upgrade procedures means that you are bound to the Yunohost integration's version of the software. For instance when installing Discourse via Yunohost this version lags behind significantly. And also Yunohost disables the Discourse upgrade process, while it offers a superior experience.
- Gigachad 3y ago
  It’s was designed predocker and is a pretty old school setup. I remember they had issues updating Debian because the new Debian had a new php version which caused issues for some apps.
- navanchauhan 3y ago
  Some effort has been put into adding systemd hardening per unit basis. Every app is run by a special user created to do just that. This app user only has permissions for the app and data folder. (I don’t have much security/hardening experience)
cycomanic 3y ago
I tried out Yunohost and I do like it in principle, however what really started to annoy me was that they decided to roll their own sso, and my impression is that it's not very good (there are some threads on the forum criticising it for being quite a mess IIRC). The issue is that because of this it doesn't always play ball with apps which allow for SSO functionality, e.g. the seafile desktop app does not work with yunohosts SSO. I wish they would just switch to an established system like authentik, authelia or keycloak. There were some issues about this in the tracker but I think the suggestions were shut down pretty quickly.
- mcint 3y ago
  Dang. That's good to know, thank you.

by mcint 3y ago

ocdtrekkie 3y ago

My understanding is YunoHost makes absolutely no attempt to isolate apps from one another, it just helps you install stuff on a Linux box. Unfortunately that means a single flaw in a single app compromises your entire server.

rapnie 3y ago
Yes, Yunohost makes installs very easy. But if something isn't working right then you got extra layers to deal with. I don't know how Sandstorm deals with this, but Yunohost taking care of the install and upgrade procedures means that you are bound to the Yunohost integration's version of the software. For instance when installing Discourse via Yunohost this version lags behind significantly. And also Yunohost disables the Discourse upgrade process, while it offers a superior experience.
Gigachad 3y ago
It’s was designed predocker and is a pretty old school setup. I remember they had issues updating Debian because the new Debian had a new php version which caused issues for some apps.
navanchauhan 3y ago
Some effort has been put into adding systemd hardening per unit basis. Every app is run by a special user created to do just that. This app user only has permissions for the app and data folder. (I don’t have much security/hardening experience)

cycomanic 3y ago

I tried out Yunohost and I do like it in principle, however what really started to annoy me was that they decided to roll their own sso, and my impression is that it's not very good (there are some threads on the forum criticising it for being quite a mess IIRC). The issue is that because of this it doesn't always play ball with apps which allow for SSO functionality, e.g. the seafile desktop app does not work with yunohosts SSO. I wish they would just switch to an established system like authentik, authelia or keycloak. There were some issues about this in the tracker but I think the suggestions were shut down pretty quickly.

mcint 3y ago
Dang. That's good to know, thank you.