Selfhosted
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
-
No spam posting.
-
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
-
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
-
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
-
No trolling.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
view the rest of the comments
Not OP, but I'd like some more information about following good practices, please, especially in terms of "the best way" to make services available outside my lan (forwarding ports vs. a reverse proxy vs. a tunnel vs. a vpn -- assuming some of those terms aren't the same thing and I'm too much of a noob to realize).
You really should not directly expose services to the public internet. That opens up high levels of risk and anything you do expose needs to be monitored and isolated from everything else.
I would start by creating a separate subnet for your homelab. You should setup firewall rules to disallow traffic to pass between them. For exposing services to your internal lan you should set up basic port forwards.
For remote access you should setup a VPN. Wireguard is going to have the best performance and you can either host it at home or use a mesh VPN solution like netbird or Tailscale.
If you must expose something to the internet be very careful. You should follow least privilege always and restrict access to everything the exposed service doesn't need. Lastly you should assume that you system will be compromised so make sure you have backups.
For me I don't have a static IP so I created a VPS in Linode and then setup Wireguard with a reverse proxy to route traffic into my homelab. This approach is better than exposing your home IP in my option as it moves your Internet activity and hosted services to different IPs. Its not totally unheard of to have a shady website scan your IP for open services that can be exploited.
Another though: you also could set up a honeypot to see attacks in real time. There are tools to do this and it would show you what your up against.
I would start with a tailscale network.
Maybe take a look at this: https://tailscale.com/blog/docker-tailscale-guide