Selfhosted
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil.
-
No spam.
-
Posts are to be related to self-hosting.
-
Don't duplicate the full text of your blog or readme if you're providing a link.
-
Submission headline should match the article title.
-
No trolling.
-
Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details. Tags [CBH] or [AIP] are required, see the links in Rule 8 for details.
-
AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post, and find example disclosures here.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
I keep all my services in one docker-compose yml, and run it from a normal user account added to the docker group.
I am really conscious of what I expose to the internet though, since I already almost had a security incident.
I used to run non-standard ssh port to my machine with password authentication enabled.
Turns out I didn't know the sonarr/radarr containers came with default users, and a bruteforce attack managed to login to one of them (or something like that anyway,it's been awhile). Fortunately they have a default home of /sbin/nologin so crisis averted there, but it definitely was a big lesson for me.
Years later, the current setup is only plex, tautulli, and ombi open to the internet, and to reach everything else I use tailscale. And of course,only key-based authentication.
Oh and for updates, I run apt upgrade once in a while on the box (Ubuntu server 18.04 LTS) and for the containers, I use watchtower.
Kubernetes, but I’m getting a bit tired of dealing with it. I might try using microVMs for what I’m currently using Pods, and hopefully make the whole system easier to maintain. The overhead for kubernetes is a heck of a lot more than I anticipated, I had to set up a whole second machine for what I used to be able to do on a single one.
k3s with rancher. I was using k8s before but redid everything. K3s is overkill for what I do an causes millions of headaches but I enjoy learning through brute force.
I use k8s at work so it's good experience to run my own k3s
Podman managed through Quadlet container files and Systemd. Rootless where easily possible but often that requires a bit more work. Auto updates only when it is unlikely to break.
Rootful Podman & podman-compose. Waiting on the version of Podman that supports passt to hit Debian Bookworm or backports to attempt rootless. Deployed with Ansible except a few manual parts like creating the Postgres databases themselves.
No auto updates or notifications so far, as there seems to be a couple incompatibility issues left with Watchtower & Podman. Although since I switched CrowdSec to monitor journald instead of the Podman socket I don't really have a reason to keep the daemon running, and I think that's for the best.
Rootless docker via Terraform. Can create all my containers with traefik and dashboard configs at the click of a button.
I’m using network overlays for individual containers and separation.
Secondly fail2ban installed on host to secure docker services. Ban FORWARDING chains specific to docker instead of INPUT chains. [fail2ban docker](Configure Fail2Ban for a Docker Container – seifer.guru)
Use 2FA for services if available.
Rootless docker has limitations when it comes to port exposing, storage drivers, network overlays etc.
The host is auto-updating security batches but rebooted manually only.
Docker containers are updated manually too. I built all containers from file and don’t pull them because most are modified (plugins, minimizing sizes, dedicated user rights etc.)
Currently, I’m just using my root account with Docker and update everything manually. I have dockcheck-web installed to check whether any updates are available (https://github.com/Palleri/DCW). From the outside everything is only accessible using Wireguard and connections have to go through a Caddy proxy in order to reach a container. Curious what other peoples setup is.
Docker and a Synology NAS. Everything is accessed though a wireguard VPN.
I run docker on almalinux on Proxmox. Nothing is exposed to the Internet. Yes, I do automatic updates for everything, but reboots are manual.