6 ms·
How I built this website on a Raspberry Pi
- deleted 2y ago[deleted]
- hsshhshshjk 2y agoThank you, this is a wonderful step by step. Saved for the next time I get a chance to sit down and fiddle. Cheers!
- deleted 2y ago[deleted]
- mirawelner 2y agoGlad you enjoyed!
- rainonmoon 2y agoThis is a wonderful project and an even more wonderful write-up, I wish I came across more in this tone! I'll just add to anyone following in these footsteps: be careful what type of website you host on your Pi. Self-hosting is great, but if you expose services on your home network to the internet, expect people to try to hack you. What type of site you host will either make this very hard or very easy. The difference between compromising a VPS and compromising your home web server is now they have access to your actual LAN. Cloudflare has a pretty good WAF on the free tier, look at it as another learning opportunity.
- beeflet 2y agoI find that ufw is a pretty simple firewall interface for linux.
- rainonmoon 2y agoUFW is great at what it does, but it's not going to save you from web application attacks.
- 3np 2y agoI found that over time ufw becomes unwieldy and it's hard to make sure you keep the rules consistent - even (especially?) with configuration management. I highly recommend firewalld instead.
- samsquire 2y agoI would like to benefit from big tech's security teams by hosting web forms and those various different kinds of site you suggest behind them and their teams! WAF + captchas + defence against bots I would rather not do the server handholding and hardening myself.
- pipes 2y agoThanks for pointing this out. Do you know of any guides on securing a home pi web server, or less specifically, securing any Linux device exposed to the public internet?
- mirawelner 2y agoThank you very much and I'm glad you enjoyed it! I'll absolutely look into cloudlfare now that my site is getting more traffic - I need to learn more about security anyways so this is a great opportunity for me!
- xyst 2y agoAlready hugged to death, rip
- onli 2y agoLoads fine for me, even very fast - maybe it is fixed?
- reader9274 2y agoIt was 2am when you checked, and as mentioned in the article the Pi was rebooting after an update :)
- yustreparting 2y agoNice description, very helpful, thanks. IFAIK there’s a mixup between the words „permanent“ vs „temporary“ in the fail2ban section, you may want to check that.
- mirawelner 2y agofixed thank you!
- tracker1 2y agoCurious how well Caddy would run on an RPi. Not sure if it would come out ahead of Apache in practice. It's been my goto choice for a few years.
- Havoc 2y agoIf there is an arm image for it then it’ll run fine
- tracker1 2y agoIt's written in go so should work fine.
- Hamuko 2y agoI'm running a small Caddy + Rust (Actix Web) service on my Raspberry Pi 2B. Not the snappiest service ever but usable. Part of the slowness might also be the fact that it's online using Cloudflare Tunnels.
- tracker1 2y agoYeah, the tunnel is probably at least half the overhead.
- a1o 2y agoWhat is Cloudfare Tunnels? Is this for not applying a firewall rule in the home router?
- Hamuko 2y agohttps://developers.cloudflare.com/cloudflare-one/connections/connect-networks/ https://developers.cloudflare.com/cloudflare-one/connections... Basically, you can have a computer available online through Cloudflare without having to open any ports, as it makes the computer available through outbound connections. Should also make it possible to host behind CGNAT.
- compootr 2y ago[flagged]
- rainonmoon 2y agoWhat an odd thing for you to comment in response to someone obviously trying to obscure this information from this post.
- mikae1 2y agoAddress Not Found
- VBprogrammer 2y agoI really enjoyed this but at the same time find it completely perplexing - I can't place where the author is coming from - they are either really good at explaining things from the point of view of someone who knows almost nothing about this stuff or they genuinely started this without knowing most of it. I'm not sure which would be more impressive.
- chickenzzzzu 2y agoNeither is required to be true. Rather, this reads as a person who genuinely hopes for you to understand what they are attempting to teach you. Often times, technical documentation is written because the author desires to sound smart, not actually help you achieve whatever the topic at hand may be.
- throwaway290 2y agoWe could have some words for this paradoxical phenomenon. I suggest "humility" and "patience":) Maybe even "kindness"
- mirawelner 2y agoHaha I think the latter assumption is more correct. I really know next to nothing about web design. I do data science and machine learning, which is quite different really. I started this project as a Freshman in undergrad and it was originally on WordPress. I have been gradually itterating over it for the past few years and now I'm 2 years out of college. I just have issues and then fix them and learn via that proccess. So for example when my router was hacked I installed fail2ban, when a friend told me my mobile view was terrible I read about CSS, I have just been working on it gradually but I have never worked in webdev. Just today, a commenter here suggested I implement an RSS feed so I had to look up how to do that and now I have an RSS feed! I'm just learning things on the fly. I'm glad you find it impressive, I just find it as being the lazy way to learn.
- jpc0 2y agoRegarding private keys and computers going in for repairs... I know it's not strictly best practice but store your private key in your password manager. That way if the worst happens you aren't up a creek...
- zipy124 2y agoAt least encrypt your private key and store it somewhere private, and then store the decryption key in your password manager. Then if either one is compromised you are still safe.
- jpc0 2y agoI mean if my password manger is compromised I'm pretty screwed anyway but this is a good idea too.
- zipy124 2y agoThe whole idea behind 2FA is that if your password manager is compromised, you will still be fine, thats why its so damn important. (also please please please don't use SMS 2FA, it's not secure, it's expensive and there's no reason why I should need mobile phone signal to login to a service.
- jpc0 2y agoThere's more than just passwords in my password manager. 2FA cannot help you in all cases.
- yjftsjthsd-h 2y agoYou can also just have multiple keys? Most of my devices have an authorized_keys that gives access to a couple laptops and my phone (which runs the normal openssh client in termux), which solves a lot of these access problems.
- rednafi 2y agoI like how the author didn’t try to be overly clever with it. They could’ve used Docker to install and isolate dependencies, Caddy or Traefik to serve the site and manage SSL automatically, maybe even k3s to run a mini cluster for HA, Tailscale to avoid manual port forwarding, Terraform for future auto-provisioning without hassle, or Ansible to prepare the machine and all that jazz. Instead, they took the simplest possible route that works: installing the web server on bare metal, serving plain HTML and CSS, and using direct port forwarding via the router. This was a delightful read.
- hoppp 2y agoIf its for you there is no need to overcomplicate it. Complexity is just for job security :)
- ekianjo 2y ago> installing the web server on bare metal, On top of a Linux distro is not what people usually call bare metal
- reassess_blind 2y agoI've heard it called bare metal as opposed to a docker container or VM.
- ekianjo 2y agoThis is the Wikipedia definition which is the same thing as I said. If it's on top of an OS, it's not bare metal. https://en.m.wikipedia.org/wiki/Bare_machine https://en.m.wikipedia.org/wiki/Bare_machine
- reassess_blind 2y agoYeah, you're correct by the original definition - but in the modern context of Docker/k8s and web servers, "bare metal" is being colloquially used to refer to installing directly on the bare OS, and people understand that.
- BoredPositron 2y agoAfter using nginx and caddy for some time I can't fathom going back to apache config files.
- ekianjo 2y agoAgree. Much less maintenance with Caddy
- KronisLV 2y agoCaddy is pretty good! Nginx does feel quite similar to Apache2 if you don’t try to do too much mod_rewrite. To be honest, you can have both good and bad configuration in either. I recently migrated one stack from Nginx to Apache2 (where an Nginx container would refuse to start when it was a reverse proxy for say 10 services and one of those took longer to start meaning that it had no DNS records, so Nginx would be in a restart loop and the other 9 would be unavailable) and it was fine.
- reassess_blind 2y agoAny DDoS protection? Doesn't really matter with a small personal site, but I run a few solo production apps and they get hit multiple times a month by >100k rps DDoS attacks.
- hoppp 2y agoMe too, I need to use cloudflare... I think if he gets hit by a ddos, the pi can go down but since its a simple website and not monetized, the downtime is fine
- reassess_blind 2y agoYeah. Though I get that it would defeat the purpose of the article, as running it on a Pi as a novelty is the whole point, and if you need to add DDoS protection you'd might as well just throw it on Cloudflare Pages instead.
- KronisLV 2y ago> Step 5: Getting an HTTPS Certificate If you’re using Apache2 you might also want to look at mod_md, not just certbot: https://httpd.apache.org/docs/2.4/mod/mod_md.html https://httpd.apache.org/docs/2.4/mod/mod_md.html Also, if you want to minimize the amount of JS, then just drop jQuery and use fetch, it’s reasonably pleasant too: https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API Lovely article!
- mirawelner 2y agoThank you very much I’m glad you liked it! I’ll look into fetch and mod_mt - they seem helpful!
- coolThingsFirst 2y agoThe caveat: only is possible if your ISP permits incoming connections.
- a1o 2y agoHey, if one is only using apache and serving static files, is there any security issue one needs to be in the lookout? I was surprised fail2ban was the only thing installed there and it seems reliably working.
- Izmaki 2y agoIf you keep Apache itself up-to-date then typically speaking no. There is always a reason to be on the lookout and <insert generic speech about security concerns here>, but static files are - well - static. Not much to mess with there. If you choose to do smart things like caching and such, that opens a whole new can of worms, but basic "this is my HTML page" stuff is typically "not-unsafe" (as opposed to "safe").
- InMice 2y agoSurpised he does not have a step for a assigning a permanent address for the local network. He mentions it but skips it like it's not needed. a lot of routers like those from att do not allow port forwarding to addresses that have finite lease times.
- mirawelner 2y agoI didn't know that was a thing you could do! I appreciate the comment and I have added creating a permanent address for the local network in the post and given you credit. I give your HackerNews username credit please let me know if you want your actual name listed. Also I can tell this post was a good post because people are using he/him pronouns for me in the comments lol. What a world we live in :)
- InMice 2y agoThanks for replying no credit needed but I do not object LOL. It's a good walk through that you wrote. I have quite a few generations of Pis including the original. They're great for so many things. And they're so reliable I think in part because the community around software/hardware relationship feels so strong and robust.
- richylarue 2y agoI was looking for something like this article. Thanks for the post. Neat.
- mirawelner 2y agoglad you enjoyed!
- generichuman 2y agohttps://archive.md/cvzgy https://archive.md/cvzgy (was down for me, this fixed it)
- hcheung 2y agoI did something similar in 2016 https://www.e-tinkers.com/2016/11/hosting-wordpress-on-raspberry-pi-a-complete-approach/ https://www.e-tinkers.com/2016/11/hosting-wordpress-on-raspb.... Instead of having Apache, I use Nginx. Instead of serving webpage from SD card, I setup a 512MB hard disk except booting still done via the SD card. The site is still running on a Raspberry Pi 3 till this day from my living room.
- mirawelner 2y agoI checked out your tutorial, its very cool! Do you think the 512MB harddisk makes your site more robust for when there are many queries? My site was crashed last night because of the hackernews hug of death and I may have to upgrade.
- hcheung 2y agoAs most of my website are static content (blog with html/css), plus the implementation of cache and having a nginx (instead of Apache) help to serves most of the content from cache instead of access to the hard disk. Use of hard disk is trying to avoid the wear-off of SD card, I did in such as way where the boot is still done by the SD card, only the storage are in hard disk.
- freetonik 2y agoNice work, thanks for sharing! Do you plan to implement an RSS feed?
- mirawelner 2y agoGlad you enjoyed it! Here you go: https://mirawelner.com/rss.xml https://mirawelner.com/rss.xml
- freetonik 2y agoCool! I’ve added it to my blog directory and search engine https://minifeed.net/blogs/df1XlG https://minifeed.net/blogs/df1XlG
- bryancoxwell 2y agoVery cool, very accessibly written. Thanks for sharing. Curious how you handle your router’s public IP changing as (I believe?) this is pretty common depending on the ISP, no?
- mirawelner 2y agoI am glad you like it! Theoretically, routers have public IPs that change often and you have to buy something to make sure they don't. In practice, this has only ever happened once to me when my router got hacked and I had to get firmware replaced. So while its a major issue if you have a huge site that needs to be reliable, if it is just a personal site it can be okay to just assume it will never change, and if it does you can always just get your domain name to point to the new IP. It may be worth it to look into something to make it more stable, but right now it just isn't worth the extra fee.
- rawandriddled 2y agoYou can use Dynamic DNS[0]. Your server contacts a remote server and if the IP address has changed the DNS is automatically updated. You can use a free subdomain[1] and CNAME/ANAME/ALIAS[2] your domain's DNS to point to it. Edit: Njalla supports dynamic DNS records natively[3]. [0] https://en.wikipedia.org/wiki/Dynamic_DNS https://en.wikipedia.org/wiki/Dynamic_DNS [1] https://freedns.afraid.org/ https://freedns.afraid.org/ [2] https://en.wikipedia.org/wiki/CNAME_record https://en.wikipedia.org/wiki/CNAME_record [3] https://njal.la/docs/ddns/ https://njal.la/docs/ddns/
- tzury 2y agoTo the OP: Make sure you have updated firmware to latest, plus added active protection against the following known vulnerabilities. https://nvd.nist.gov/vuln/search/results?form_type=Basic&results_type=overview&query=R6020&search_type=all&isCpeNameSearch=false https://nvd.nist.gov/vuln/search/results?form_type=Basic&res...
- mirawelner 2y agoThank you! I will look into that - it's linked to my home wifi so secruity vulnerabilities would be really bad for me. Much appreciated!
- LarryMade2 2y agoI had set one (Pi 3B+)up to do both a website as well as a public service announcement slideshow display for a local Community TV. Used PHP/CMSimple for the site and wrote a custom slider. Things I learned: - set the pi to reboot on poweroff - Given this was TV used the AV output on the PI displaying in NTSC 4:3 (to support customers with older TVs), so had to be aware of overscan margins - Added a startup script to start chromium in kiosk mode and open the slider page for the show side. worked 95% of the time, if not just power off then on. - part of the troubleshooting was just unplug and replug - but SD cards will choke on too many power cycles, so instead of SD use a USB->SATA cable and a regular spinning rust HDD - slower but VERY reliable, the journaling file system can recover after power-outage. - Get the right USB->SATA cable, USB-3 models seem to be more responsive and the PI can boot from them, there are some are too slow and the Pi will fail to boot. - Slider had it's own login page (outside of CMSimple) to remotely manage the slideshow. - Also changed the SSH Port to something uncommon to thwart bad guys.
- ewalk153 2y agoI use Kamal[1] to host all my side projects on a Raspberry Pi. It works for more than just Rails apps. I’ve tried a few other approaches in the past and this seems like the simplest, given a familiarity with git. [1] https://kamal-deploy.org/ https://kamal-deploy.org/
- Oanid 2y agoGreat article—thanks for sharing! I did something similar nine years ago with a Raspberry Pi 3 Model B. It stayed online for nearly a decade until it went offline at the end of 2024, following Google's decision to sunset my OnHub router. Initially, I used it as a CUPS server to turn a non-networked Brother printer (HL-2240) into a wireless printer after Google discontinued Google Cloud Print. The printing project was a lot of fun and inspired me to dive into another challenge: self-hosting. Along the way, I learned a great deal about Apache, SSL certificates, security, and just how fragile SD cards can be! The print server still works well, though I’ve since downsized to a Raspberry Pi Zero W.
- LtWorf 2y agoIsn't this the normal way?