Self Hosting: It's like being a prepper for the cloudpocalypse

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > Self Hosting: It's like being a prepper for the cloudpocalypse

«‹›2 »

Mr. Crow: May 22, 2008; Snap City mayor for life

FireTora posted:

This Awesome-Selfhosted github has a huge list of free, mostly opensource, software that you can host for a huge range of services.

You can set up PhotoPrism to sync new pictures from a WebDAV server like Nextcloud so you can sync your phone to Nextcloud and PhotoPrism will automatically fetch or backup new images to it.

I've tried 3 other photo hosts so far and PhotoPrism has been the best overall for features. I'm going to try damselfly sometime this week, it looks a little more poweruser in the interface, but supports multiple users, facial recognition and more.

Came here to post awesome-selfhosted, worth checking out.

# ¿ Nov 16, 2021 18:42

Adbot: ADBOT LOVES YOU

# ¿ May 25, 2025 06:18

Mr. Crow: May 22, 2008; Snap City mayor for life

Its really trivial to either setup your own PKI these days and just install your root self-signed cert where its needed or use let's encrypt, no reason not to use HTTPS

# ¿ Nov 27, 2021 23:05

Mr. Crow: May 22, 2008; Snap City mayor for life

Make sure you set up some dynamic DNS service too otherwise you'll lose access once your home IP address inevitably changes.

# ¿ Jun 1, 2022 16:19

Mr. Crow: May 22, 2008; Snap City mayor for life

Please don't try and selfhost your mail, just keep the proton sub

# ¿ Jan 14, 2023 00:09

Mr. Crow: May 22, 2008; Snap City mayor for life

Well Played Mauer posted:

I bought a lot of goodwill with the PiHole and Plex setups, actually.

I have a dumb switch question that I haven’t been able to find an answer for, and I’m pretty sure I’m overthinking it, but I’m trying to figure out the optimal setup for what gets plugged into the switch.

My router has 1 2.5 gbps port and 3 1 gbps ports. The unmanaged switch I’m grabbing has all 2.5 gbps ports. Most of my equipment has only 1 gbps NICs. My question is more about lan bandwidth than wan. Basically, do I lose anything if I plug the switch into the 2.5 gbps port, then plug everything into the switch, leaving the 1gbps ports on the router empty? Or would I be better off putting some of the machines on the 1gbps ports on the router to spread the distribution around?

Like I said, I’m thinking more about lan data transfer than anything else. Like, do two machines talking on separate 1gbps ports free up the stuff on the 2.5 gbps switch, since they wouldn’t be using overhead on the switch to talk, or does it not really work that way?

I think I’m conflating hubs and switches here, but what’s adding to my confusion is the router claims it can handle 6 gbps over WiFi. So does that mean the router can move that amount of data and the maximum capacity is limited per port(and thus there’s some benefit to using all the ports on the router), or is the WiFi maximum separate from the Ethernet ports, and it’s better to just throw everything into the switch that’s connected to the 2.5 gbps port on the router?

This really feels like a stupid question but I can’t quite turn it over in my head.

https://www.nvtphybridge.com/full-duplex/

Realistically you won't notice optimizing your switch layout unless your constantly sending large amounts of data around your house, which would be unusual for me at least. Like the other guy said just use it and if you notice issues then nerd out on it. For example 4k streaming bitrate is anywhere from 40-128 Mbps, so if you have issues its probably not the switch. Probably.

# ¿ Feb 4, 2023 16:55

Mr. Crow: May 22, 2008; Snap City mayor for life

Nextcloud is pretty worthless to be honest I wish it would stop being recommended in self hosting circles.

I use it for contact syncing because its about the only thing it does reliably and I'm too lazy to set something else up for it at this point.

# ¿ Apr 13, 2023 19:45

Mr. Crow: May 22, 2008; Snap City mayor for life

fletcher posted:

Is there anything else that's a viable Google Drive alternative for the selective sync that stores everything on the filesystem as normal files though? Nextcloud was the only thing I've come across that ticks those boxes. It's been working great for me.

I dunno cause it doesn't work. Leave a file untouched or don't open the app for a week and all of a sudden nothing is on your device anymore and lol if you were expecting to use it outside of cell service.

I gave up and use syncthing, it suits my needs much better and more importantly is reliable.

# ¿ Apr 13, 2023 20:09

Mr. Crow: May 22, 2008; Snap City mayor for life

CopperHound posted:

The cookbook app is good. That is all.

This is actually true.

# ¿ Apr 13, 2023 20:10

Mr. Crow: May 22, 2008; Snap City mayor for life

BlankSystemDaemon posted:

I desperately want a dtrace-backed monitoring system like Sun FishWorks.

For those of you who don't know it, it's famously featured in this video:
https://www.youtube.com/watch?v=tDacjrSCeq4

EDIT: There's more information about it in these slides by Cindi McGuire and Brendan Gregg as well as these slides by Bryan Cantrill and Brendan Gregg.

It's nothing short of amazing, because it ties together SMF (which is what System500, launchd for macOS, LaunchPad, and OpenRC all failed at being), FMA (a failure management framework, capable of dealing not just with hardware failures but also software failures - which every OS needs, and only Solaris has ever had), and dtrace (a tracing facility for use in production systems at production scale).

The most amazing thing about this video to me has always been that this guy presumably works in there without ear protection, holy poo poo

# ¿ Jul 18, 2023 21:35

Mr. Crow: May 22, 2008; Snap City mayor for life

Warbird posted:

Speaking of, the pattern “https to the reverse proxy and the http to the service” is largely fine, correct?

Depends entirely where the service is. And probably what it is. On the same server, sure. Same private network, maybe. Different server/network but same "datacenter"? Probably not.

# ¿ Sep 23, 2023 18:36

Mr. Crow: May 22, 2008; Snap City mayor for life

Quixzlizx posted:

So I don't need to change anything to increase my security then, because I want all connections not through the domain to fail. I just didn't know if there were any edge cases where a theoretical attacker could get around the lack of a certificate, which is why I was contemplating a catch-all rule to block everything else.

Anything exposed to the internet is going to get hammered in a variety of unexpected ways, security isn't a single big wall and iron gate, caddy and any other internet facing service shouldn't be your one security measure. The phrase "defense in depth" exists for a reason. Caddy is vulnerable to exploitation, either via misconfiguration or CVE, as is whatever its talking to. Unless there is some auth mechanism its likely at some point some bot or bored attacker (or upset user who previously had access) is going to bypass Caddy. What happens then?

Make sure your backend server / service is also hardened, ideally you would also have all of this on a separate DMZ and internal network, to limit the rest of your network. The goal is to limit the blast radius of a potential exposure, not make an impenetrable gate, because there is no such thing.

# ¿ Sep 23, 2023 19:47

Mr. Crow: May 22, 2008; Snap City mayor for life

Quixzlizx posted:

I do have fail2ban set up so someone can't get into Foundry directly by brute-forcing credentials.

But I think I'm either explaining myself very badly, or I can't do what I'm attempting to do. I was hoping I could configure Caddy to flat-out refuse all connections to my server that aren't explicitly from foundry.mywebsite.com, regardless of http or https or legitimacy of certificates. With the understanding that it wouldn't be a foolproof measure, since that wouldn't help if Caddy itself is exploitable.

I dont know about caddy specifically but you could do some sort of IP based whitelist using DNS lookups for foundary.com if thats what you're trying to say? To only allow communication between Caddy and foundary.com? You'd be better off using your firewall but with nginx, https://docs.nginx.com/nginx/admin-guide/security-controls/controlling-access-proxied-tcp/

Even so the points I made above are still valid, maybe its worth the risk to you, but foundary.com can be compromised, see it communicates a lot with caddy, then have an open door into whatever is behind caddy.

Unless you are unlucky or very popular its probably not going to happen having these basic security measures in place its just wise to be aware of the risks and have some additional protections in place for it. You do find blogs all the time of people getting owned like this.

# ¿ Sep 23, 2023 21:10

Mr. Crow: May 22, 2008; Snap City mayor for life

Personally I would just drop the connection without responding if its not asking for foundry.mysite.com, in nginx you can

code:


return 444;

to do this. Caddy probably has something similar.

http://nginx.org/en/docs/http/ngx_http_rewrite_module.html#return

# ¿ Sep 23, 2023 22:03

Mr. Crow: May 22, 2008; Snap City mayor for life

Quixzlizx posted:

Yes, this is what I wanted to accomplish, but I wasn't able to figure it out by searching Google results or the Caddy documentation. I'll keep reading and hopefully I'll eventually figure it out.

Ahh, right. To be clear what other people are saying is you can subvert that with

code:


curl --header 'Host: foundry.mysite.com' https://caddy.mysite.com

# ¿ Sep 23, 2023 22:23

Mr. Crow: May 22, 2008; Snap City mayor for life

If your server isn't on a separate network (subnet) its not going to matter, traffic is gonna bypass it at layer 2 (unless it also acts as your switch), but otherwise thats how DMZs work yes.

# ¿ Sep 29, 2023 00:17

Mr. Crow: May 22, 2008; Snap City mayor for life

Nitrousoxide posted:

If you're doing all this in docker containers you can setup docker networks between your containers and NPM so they have seperate subnets from your LAN. It also has the benefit of letting the docker network act as a dns server so you can point NPM to an internal domain rather than an IP.

An example couple of compose files would be:

code:

version: "3"
services:
  5etools-docker:
    container_name: 5etools-docker
    image: jafner/5etools-docker
    volumes:
      - /home/server/5etools:/usr/local/apache2/htdocs
#    ports:
#     - 5555:80/tcp
    networks:
      - 5etools_backend
    environment:
     - SOURCE=GITHUB
    restart: unless-stopped
networks:
  5etools_backend:
    name: 5etools_backend

code:

version: '3'
services:
  app:
    image: 'jc21/nginx-proxy-manager:latest'
    restart: unless-stopped
    ports:
      - '80:80'
      - '81:81'
      - '443:443'
    networks:
      - npm_private_network
      - 5etools_backend
    environment:
      DB_MYSQL_HOST: "db"
      DB_MYSQL_PORT: 3306
      DB_MYSQL_USER: ${SQLURS}
      DB_MYSQL_PASSWORD: ${SQLPASS}
      DB_MYSQL_NAME: ${SQLURS}
    volumes:
      - /home/server/NGINX/data:/data
      - /home/server/NGINX/letsencrypt:/etc/letsencrypt
  db:
    image: 'jc21/mariadb-aria:latest'
    restart: unless-stopped
    networks:
      - npm_private_network
    environment:
      MYSQL_ROOT_PASSWORD: ${SQLROOTPASS}
      MYSQL_DATABASE: ${SQLURS}
      MYSQL_USER: ${SQLURS}
      MYSQL_PASSWORD: ${SQLPASS}
    volumes:
      - /home/server/nginxdb:/var/lib/mysql

networks:
  npm_private_network:
    name: npm_private_network
  5etools_backend:
    name: 5etools_backend

Pretty sure this doesnt do what you think it does, unless you're also doing some external firewall iptables magic you didn't list. Docker networks are basically just a NAT, the containers still have full RFC 1918 access. The host acts as a gateway.

# ¿ Sep 29, 2023 01:45

Mr. Crow: May 22, 2008; Snap City mayor for life

Depends entirely what you're comfortable with and what the services are. I wouldn't with just what we've talked about so far but I probably wouldn't have much of a problem if I was running SELinux + Podman + configured the host to block local network access from the container network. Also making sure the containers are hardened sonewhat.

I don't think docker can do that with any flags, podman might but you can just do it with your hosts firewall https://stackoverflow.com/questions/72037768/how-to-prevent-docker-containers-from-accessing-my-local-network

Also I wouldn't trust some ISP or consumer router, they rarely patch out vulnerabilities and even when they do many have laughably short support cycles, but I'm also paranoid. See e.g. https://www.tomsguide.com/news/router-attack-netusb-flaw you can use something like opnsense or openwrt or pfsense and with some basic maintenance have a secure gateway basically for the life of the hardware.

Mr. Crow fucked around with this message at 03:09 on Sep 29, 2023

# ¿ Sep 29, 2023 03:04

Mr. Crow: May 22, 2008; Snap City mayor for life

dweepus posted:

Makes sense. Currently for what I want externally accessible (eventually) it's just jellyfin and navidrome. Internally I will want access to pihole, *arrs, Heimdall, etc. All of these are in containers on the same box. If I put auth in front of Nginx, how would that affect app clients connecting to those services, notably smart tv apps?

Just use a VPN

# ¿ Sep 30, 2023 22:01

Mr. Crow: May 22, 2008; Snap City mayor for life

tried memories. nextcloud is still utter dog doodoo. photos has no way to select multiple folders and/or exclude folders, how is this feature complete in 2023? also memories app doesn't work with self signed certs. lol

its actually incredible how bad nextcloud and its ecosystem is.

anyway i finally tried Immich and its basically bulletproof. some minor quirks still but they seem to be actively developing it and it more or less works ootb

# ¿ Oct 12, 2023 19:02

Mr. Crow: May 22, 2008; Snap City mayor for life

You could just run a linux VM for linux needs?

Photoprisms lack of mobile app / integration was its main downside for me. Single user is also dumb but may not matter to some.

# ¿ Oct 14, 2023 07:42

Mr. Crow: May 22, 2008; Snap City mayor for life

Hughlander posted:

Maybe it's a poor expectation of mine, but I don't think I've ever had a docker pull nextcloud && docker restart nextcloud actually work. To me table stakes for a container is that it handles the janitor work in the background.

You have to specify a major version as nextcloud only supports major version upgrades. So nextcloud:26-apache and you can just pull and restart to get the latest point release. Pull 27-apache when you're ready to pull the next major version and so on.

Its definitely the worst OSS community out there though as far as quality and usability and reliability, not sure why. PHP is rear end maybe? Never used it, no desire to either, maybe thats true for lots of other devs who might otherwise be willing to contribute and fix stuff.

# ¿ Oct 16, 2023 18:08

Mr. Crow: May 22, 2008; Snap City mayor for life

Ive been using pfsense for like 8 years and its been great, I don't see this changing :confused:

I don't know why anybody is surprised or gives a poo poo about this, why would I pay a $130 a year for a loving SLA on my home router?

# ¿ Oct 27, 2023 03:28

Mr. Crow: May 22, 2008; Snap City mayor for life

My wife has been raving about Immich, its very nice at this point and if you haven't tried it, or recently, give it a look.

Nextcloud is terrible tbh and you should only use it as a last resort

# ¿ Oct 31, 2023 22:27

Mr. Crow: May 22, 2008; Snap City mayor for life

cruft posted:

Immich seems cool, I'm just still not prepared to swallow 8 new services so I can run one thing.

Yea... they provide a compose file that isnt insane like most oss projects so i just threw it under a service account and run it under systemd with podman-compose, works well.

I normally ignore install instructions and roll my own container specs, amd if you tried to do that with immich yea it would be a chore. Their compose is well made, unusually, so it was way easier to setup than most by just using the provided defaults.

Mr. Crow fucked around with this message at 00:23 on Nov 1, 2023

# ¿ Nov 1, 2023 00:19

Mr. Crow: May 22, 2008; Snap City mayor for life

Motronic posted:

Does it have a working (fully functional) web app yet? Or an android client? Those were the deal killers for me the last time I looked at it.

Yes to both.

# ¿ Nov 3, 2023 18:41

Mr. Crow: May 22, 2008; Snap City mayor for life

Neslepaks posted:

The wife and I share a common library so the user separation stuff is more in my way than helpful as well.

We just share an account and it works as you'd expect across multiple devices.

I haven't noticed performance but I'm also running it on my "beefy" media server so it may very well be a hog. I'll check a bit later.

# ¿ Nov 3, 2023 21:36

Mr. Crow: May 22, 2008; Snap City mayor for life

Anybody got recommendations on a self hosted digital picture frame? preferably like a rasbery pi i can just put a browser on and point to something in fullscreen mode?

I have seen a few digital signage options that work with Pi but they seem kinda clunky and/or low res.

May just end up getting one with an SD Card or USB but if I dont have to update a flash drive periodically that would be great

# ¿ Dec 15, 2023 00:02

Mr. Crow: May 22, 2008; Snap City mayor for life

Hughlander posted:

I mean I do think that naturally there's going to be huge over lap towards:

I like watching media in Plex
That I store on my NAS
that I selfhost the software
to get things from Usenet

And you're going to see the same people talking in those threads

i keep wanting to try usenet and see what the hubub is about then they want you to pay for access and im just like EHHHHHHHH Ill stick to private sites

# ¿ Jan 12, 2024 20:51

Mr. Crow: May 22, 2008; Snap City mayor for life

Anyone happen to be running an Arc GPU with Jellyfin? Does the hardware encoding work well?

edit on linux to be clear. I just realized my nvidia card won't transcode anymore for some reason and im not sure when it broke, but im kind of tired of dealing with nvidia so

Mr. Crow fucked around with this message at 05:02 on Jan 21, 2024

# ¿ Jan 21, 2024 04:41

Mr. Crow: May 22, 2008; Snap City mayor for life

Anyone use kanidm? I remember checking it out years ago and it looked good but was still very much early development. I remembered it today for some reason and checked it out and seems like maybe its a bit stable now?

# ¿ Jan 27, 2025 03:46

Mr. Crow: May 22, 2008; Snap City mayor for life

SEKCobra posted:

I am once more trying to finally replace Google Keep. I have tried a lot of solutions over the years, but none felt like "it" enough to make me actually switch. I am trying what I can find, but maybe someone here has an idea. My requirements:

Checkbox style todos, preferably with subtasks, link to specific notes would be cool
A way to easily reorder tasks (not cut+paste)
Note bookmarks
Web and/or Desktop+Android client
Some sort of sync, either a server or some sort of webdav or filesync compatible solution is fine, doesn't need to be instant.
Cleanish UI preferred, I dont need to see every option at a glance, I want as much space for my content as possible.
Dark mode (or everything else)

I've also started conaidering going for separate todo and note solutions, but honestly it feels silly that this poo poo wouldnt be possible in a single note solution.

I just use syncthing and a markdown editor

# ¿ Feb 1, 2025 20:13

Mr. Crow: May 22, 2008; Snap City mayor for life

Aware posted:

Transmission lacks a bunch of nice quality of life stuff in the webUI that deluge has. That's why I recall switching years ago. Transmission looks like an original iOS app lol.

Transmission is great if you have hundreds/thousands of torrents, deluge gets bogged down after a point and runs like rear end.

I was sad dropping it cause I like it a lot but it became a nightmare to use, for me.

# ¿ Feb 17, 2025 07:15

Mr. Crow: May 22, 2008; Snap City mayor for life

Aware posted:

Really? I have 4 years of torrents seeding (like 3.5k?) in deluge without issues. Though if it's chewing CPU I wouldn't notice, it's all on a semi modern 6core i7.

Its been more years than that since I've used it, maybe they improved it :shrug:

# ¿ Feb 19, 2025 03:31

Mr. Crow: May 22, 2008; Snap City mayor for life

Well Played Mauer posted:

I don’t think it’s an either/or. I use promox to segment my docker stuff based on purpose. So I have a VM for my Linux iso needs, one for my pihole and reverse proxy, one for general purpose home infra stuff, etc.

I like doing it this way just in case something goes wonky somewhere, I have easy backups and some segmentation.

Same, except containers and other built in linux things and I don't have to think about partitioning hardware resources etc.

I agree though there's no right or wrong way, just whatever you like.

# ¿ Feb 20, 2025 17:43

Mr. Crow: May 22, 2008; Snap City mayor for life

Is there any app that supports like, "secure" image sharing? Something like a secure webserver that only listens to randomly generated share links and just drops everything else?

My wifes grandmother is tech illiterate and has a dumbphone, trying to share pictures and videos with her is tedious, would be convenient to just be able to share a link that expires or something and sends her to my server.

Also shes on the other side of the planet so its not feasible to set up her computer to do tailscale or whatever

# ¿ Feb 28, 2025 18:54

Mr. Crow: May 22, 2008; Snap City mayor for life

hogofwar posted:

Could look into using this in conjunction with immich? https://github.com/alangrainger/immich-public-proxy

This looks perfect, thanks.

# ¿ Mar 2, 2025 05:06

Mr. Crow: May 22, 2008; Snap City mayor for life

TheOneVader posted:

Moving off of Google Photos is my next project but I'm not sure I can given things like this. My wife and I have partner sharing set up and automatically sync all our baby photos and such. I would need something that passes the wife test, where it just works I don't have to teach her something confusing.

Immich owns and my wife loves it, I've never had issues since i started a year or two ago.

# ¿ Mar 29, 2025 02:02

Mr. Crow: May 22, 2008; Snap City mayor for life

Well Played Mauer posted:

Yeah as a user it's solid. Better than the latest UI in Apple Photos. I imagine google photos is still better but I haven't used it in quite a while.

They compressed the poo poo out of all my photos once upon a time so I wouldn't take that bet.

# ¿ Mar 29, 2025 02:16

Mr. Crow: May 22, 2008; Snap City mayor for life

Chas McGill posted:

As for how I broke it: I used the new docker compose file and I guess there's some incompatibility with how it was set up a few weeks ago. I'm getting an error that the redis service isn't available, although everything shows as running. Might start afresh or try ente.

FWIW I've also beeb using the compose file. They have a couple times made breaking changes but its usually pretty obvious in the patch notes. Did you skip versions? I haven't been since relatively immature project, assuming you can't.

# ¿ Mar 29, 2025 20:22

Adbot: ADBOT LOVES YOU

# ¿ May 25, 2025 06:18

Mr. Crow: May 22, 2008; Snap City mayor for life

TraderStav posted:

Tdarr has been running a little less than 48 hours on my 1080p Movies library and it's chugging along at a decent pace. Going to take months to a year to get through my entire library. Maybe will look at loading up a node on my Windows PC with a 3060 to help. Currently running 3 at a time and eyeballing it around 200fps across the three transcodes with my quicksync (intel i7 12700K)

non-4K Movie Library:
Files: 1,014 (8.9TB)
Number of transcodes: 193 (4.3/hr)
Space saved 651.4 GB (14.8GB/hr)

Not yet added to Tdarr:
non-4K TV Shows: 22.8TB
4K Movies: 6.8TB
non-4K Movies: 9.1TB

My lovely math (based on 15gb transcodes an hour) says that your gonna pay 1400 in electricity, assuming 250w just to save several hundred GB? Just buy another hard drive.

# ¿ Apr 26, 2025 02:32

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > Self Hosting: It's like being a prepper for the cloudpocalypse

«‹›2 »