4 ms·

How about a wireguard tunnel from an ingress box? You still pay for one VPS, but can run everything locally and just load balance at the ingress. I just manuall

How about a wireguard tunnel from an ingress box? You still pay for one VPS, but can run everything locally and just load balance at the ingress. I just manually add configs to nginx, but there are automated tools too.

TZubiri 2y ago
Lol, kind of defeats the purpose
- yjftsjthsd-h 2y ago
  What defeats what purpose? I don't run k8s out of some love of ... managing external IPs?
  - _cenw 2y ago
    Are you even running a real homelab if you're not running MetalLB in BGP mode?! Sarcasm obviously, but it's a fun exercise, especially if you get a real (v6, probably) net to announce.
    - linuxdude314 2y ago
      Right?! Get some free IP space from he.net tunnel broker and build your own IPv6 AnyCast network using Quagga for BGP. Kidding about building your own AnyCast network (although you really could…), but he.net tunnel broker is GOAT.
      - _cenw 2y ago
        I wish Happy Eyeballs worked better or let me absolutely prefer IPv4, because every time I set up a free v6 tunnel I get banned about 2 days layer for pushing a few terrabytes over it, when all I wanted was to be able to SSH into every one of my containers on a cheap VPS separately. Or the tunnel is so slow, I'm degrading my entire internet connectivity.
        TZubiri 2y ago
        >free v6 tunnel There's your problem. You need some form of cost attached to some identity assets, anything under the IANA umbrella, ips/domain names. This is in order to prevent sybil attacks. This is all well studied under he hashcash bitcoin era as PoW. So yeah, you actually need to spend some money not in exchange of something here, but as the very thing you need, you need to distinguish yourself from those that spend 0$, not because they are cheap, but because they may do it 1000 times and ruin it your pooled reputation.
        _cenw 2y ago
        Unfortunately there's quite a market gap if you need bandwidth. I can't just pay HE 10 bucks a month, their service doesn't work that way. Hetzner would work, but their IP space is very often randomly blocked from lots of things.
        CoolCold 2y ago
        > because every time I set up a free v6 tunnel I get banned about 2 days layer for pushing a few terrabytes over it, when all I wanted was to be able to SSH into every one of my containers can you describe a bit more? I cannot connect the dots here on how terabytes are tied to free v6 tunnel - likely I'm missing some details. Thank you in advance.
        _cenw 2y ago
        If someone else provides IPv6 connectivity to you, you use their bandwidth. Some apps like Steam see IPv6 connectivity and use it regardless of what you'd prefer it to use, hinting mechanisms and all. So while I just wanted to use the tunnel for things that IPv4 does not provide, I always end up tunneling half my traffic over it, which free services don't like.
    - vegarde 2y ago
      It's on my bucket list. My Unifi Cloud Gateway Max doesn't (yet) support BGP, but other Unifi devices do, so I do hope that it'll come to my device to. If not, I'll have to think of other ways to test it. But in the meantime, there's plenty of other stuffs to learn. I have a real, ISP-routed IPv6 net to play with.
  - TZubiri 2y ago
    Tunneling through a single external node defeats the purpose of hosting k8s in home server. Maybe the external ingress node can be a load balancer controlled by the k8 cluster. But then you still have to communicate with the home server and it has no exposed ip address
    - winterqt 2y ago
      > Tunneling through a single external node defeats the purpose of hosting k8s in home server. How so? You can just rent a cheap server to tunnel through, while having the benefits of your home machine(s) for compute. > Maybe the external ingress node can be a load balancer controlled by the k8 cluster. But then you still have to communicate with the home server and it has no exposed ip address Do you mean that you wouldn’t be able to access the K8s control plane endpoint then (which you could if configured properly)? Or something else?
      - TZubiri 2y ago
        >how so? SPOF
        Daviey 2y ago
        And having a single IP address, with one ISP at home isn't a SPOF?
        TZubiri 2y ago
        You are adding a(nother) SPOF.
        Daviey 2y ago
        @TZubiri, Then if that is a risk you accept, you could have multiple VPS's and load balance back to your home network, eliminating the new SPOF. (@'ing because we reached the maximum reply limit)
        2y ago
- Aachen 2y ago
  I do this for email after I got a new IP address from the shit KPN pool instead of the clean XS4ALL pool. Outgoing email proxies through an IP address at Hetzner. It's not pointless because - I get specs from an old laptop (that I had laying around anyway) that would probably cost like 50€/month to rent elsewhere. Power costs are much lower (iirc some 2€/month) and it just uses the internet subscription I already had anyway - When I do hardware upgrades, I buy to own. No profit margin, dedicated hardware, exactly the parts I want - All data is stored at home so I'm in control of access controls - Gigabit transfer speeds at home, which is most of the time that I want to do bulk transfers I see various advantages that still exist when you need to tunnel for IP-layer issues Edit: got curious. At Hetzner, a shared cpu with 16GB RAM is 30€/month, but storage is way too little so an additional 53€/month just for a 1TB drive needs to be added (at that price, you could buy one of these drives new, every month again and again and still have enough money over to pay for the operating electricity; you'd have a fleet of 60 drives at the expected lifetime of 5 years, or even at triple redundancy you get 20TB for that price). I'll admit the uplink would be significantly better for this system, but then my downlink isn't faster than my uplink so at home I wouldn't even notice. Not sure how much of a difference a dedicated CPU would make At AWS, I have to guess things like iops (I put in 0 to have a best-case comparison), bandwidth (I guessed 1TB outbound, probably some months is five times more, some months half). It says the cheapest EC2 instance with these specs, shared/virtual again mind you so no performance guarantees, is t4g.xlarge. With storage and traffic, this costs 301$/month which I guess is nearly the same in euros after conversion fees. If I generously pay 3 years up front, it's only 190$ monthly + 2'156$ up front, so across 3 years that's 250$/month (and I'm out of over 2 grand which has an expected average return of 270€ at the typical 4% in an all-world ETF — I could nearly fund the electricity costs of the old laptop just from the money I lose in interest while paying for AWS! Probably 100% if I bought a battery and solar panel to the value of 2150€) I actually have more than 1TB storage but don't currently use all of it, so figured this is a fair comparison The proxy I currently have at Hetzner costs me 4€/month, so I save many multiples of my current total cost (including the at-home costs) by self hosting.
  - dddw 2y ago
    For cheap storage at hetzner you could add a storagebox (not fast, but fine), or now even objecstorage.

TZubiri 2y ago

Lol, kind of defeats the purpose

yjftsjthsd-h 2y ago
What defeats what purpose? I don't run k8s out of some love of ... managing external IPs?
- _cenw 2y ago
  Are you even running a real homelab if you're not running MetalLB in BGP mode?! Sarcasm obviously, but it's a fun exercise, especially if you get a real (v6, probably) net to announce.
  - linuxdude314 2y ago
    Right?! Get some free IP space from he.net tunnel broker and build your own IPv6 AnyCast network using Quagga for BGP. Kidding about building your own AnyCast network (although you really could…), but he.net tunnel broker is GOAT.
    - _cenw 2y ago
      I wish Happy Eyeballs worked better or let me absolutely prefer IPv4, because every time I set up a free v6 tunnel I get banned about 2 days layer for pushing a few terrabytes over it, when all I wanted was to be able to SSH into every one of my containers on a cheap VPS separately. Or the tunnel is so slow, I'm degrading my entire internet connectivity.
      - TZubiri 2y ago
        >free v6 tunnel There's your problem. You need some form of cost attached to some identity assets, anything under the IANA umbrella, ips/domain names. This is in order to prevent sybil attacks. This is all well studied under he hashcash bitcoin era as PoW. So yeah, you actually need to spend some money not in exchange of something here, but as the very thing you need, you need to distinguish yourself from those that spend 0$, not because they are cheap, but because they may do it 1000 times and ruin it your pooled reputation.
        _cenw 2y ago
        Unfortunately there's quite a market gap if you need bandwidth. I can't just pay HE 10 bucks a month, their service doesn't work that way. Hetzner would work, but their IP space is very often randomly blocked from lots of things.
      - CoolCold 2y ago
        > because every time I set up a free v6 tunnel I get banned about 2 days layer for pushing a few terrabytes over it, when all I wanted was to be able to SSH into every one of my containers can you describe a bit more? I cannot connect the dots here on how terabytes are tied to free v6 tunnel - likely I'm missing some details. Thank you in advance.
        _cenw 2y ago
        If someone else provides IPv6 connectivity to you, you use their bandwidth. Some apps like Steam see IPv6 connectivity and use it regardless of what you'd prefer it to use, hinting mechanisms and all. So while I just wanted to use the tunnel for things that IPv4 does not provide, I always end up tunneling half my traffic over it, which free services don't like.
  - vegarde 2y ago
    It's on my bucket list. My Unifi Cloud Gateway Max doesn't (yet) support BGP, but other Unifi devices do, so I do hope that it'll come to my device to. If not, I'll have to think of other ways to test it. But in the meantime, there's plenty of other stuffs to learn. I have a real, ISP-routed IPv6 net to play with.
- TZubiri 2y ago
  Tunneling through a single external node defeats the purpose of hosting k8s in home server. Maybe the external ingress node can be a load balancer controlled by the k8 cluster. But then you still have to communicate with the home server and it has no exposed ip address
  - winterqt 2y ago
    > Tunneling through a single external node defeats the purpose of hosting k8s in home server. How so? You can just rent a cheap server to tunnel through, while having the benefits of your home machine(s) for compute. > Maybe the external ingress node can be a load balancer controlled by the k8 cluster. But then you still have to communicate with the home server and it has no exposed ip address Do you mean that you wouldn’t be able to access the K8s control plane endpoint then (which you could if configured properly)? Or something else?
    - TZubiri 2y ago
      >how so? SPOF
      - Daviey 2y ago
        And having a single IP address, with one ISP at home isn't a SPOF?
        TZubiri 2y ago
        You are adding a(nother) SPOF.
        Daviey 2y ago
        @TZubiri, Then if that is a risk you accept, you could have multiple VPS's and load balance back to your home network, eliminating the new SPOF. (@'ing because we reached the maximum reply limit)
        2y ago
Aachen 2y ago
I do this for email after I got a new IP address from the shit KPN pool instead of the clean XS4ALL pool. Outgoing email proxies through an IP address at Hetzner. It's not pointless because - I get specs from an old laptop (that I had laying around anyway) that would probably cost like 50€/month to rent elsewhere. Power costs are much lower (iirc some 2€/month) and it just uses the internet subscription I already had anyway - When I do hardware upgrades, I buy to own. No profit margin, dedicated hardware, exactly the parts I want - All data is stored at home so I'm in control of access controls - Gigabit transfer speeds at home, which is most of the time that I want to do bulk transfers I see various advantages that still exist when you need to tunnel for IP-layer issues Edit: got curious. At Hetzner, a shared cpu with 16GB RAM is 30€/month, but storage is way too little so an additional 53€/month just for a 1TB drive needs to be added (at that price, you could buy one of these drives new, every month again and again and still have enough money over to pay for the operating electricity; you'd have a fleet of 60 drives at the expected lifetime of 5 years, or even at triple redundancy you get 20TB for that price). I'll admit the uplink would be significantly better for this system, but then my downlink isn't faster than my uplink so at home I wouldn't even notice. Not sure how much of a difference a dedicated CPU would make At AWS, I have to guess things like iops (I put in 0 to have a best-case comparison), bandwidth (I guessed 1TB outbound, probably some months is five times more, some months half). It says the cheapest EC2 instance with these specs, shared/virtual again mind you so no performance guarantees, is t4g.xlarge. With storage and traffic, this costs 301$/month which I guess is nearly the same in euros after conversion fees. If I generously pay 3 years up front, it's only 190$ monthly + 2'156$ up front, so across 3 years that's 250$/month (and I'm out of over 2 grand which has an expected average return of 270€ at the typical 4% in an all-world ETF — I could nearly fund the electricity costs of the old laptop just from the money I lose in interest while paying for AWS! Probably 100% if I bought a battery and solar panel to the value of 2150€) I actually have more than 1TB storage but don't currently use all of it, so figured this is a fair comparison The proxy I currently have at Hetzner costs me 4€/month, so I save many multiples of my current total cost (including the at-home costs) by self hosting.
- dddw 2y ago
  For cheap storage at hetzner you could add a storagebox (not fast, but fine), or now even objecstorage.