um… did my bio get deleted?

  • 0 Posts
  • 52 Comments
Joined 1 year ago
cake
Cake day: June 13th, 2023

help-circle
  • I consider selfhosting to be both. VPS or homelab. The latter has more ‘cred’ but is also a much bigger investment and not everyone can do it. Granted I’m living in a difficult environment but as somebody using Linux since 1994 it took me 3 years to recently get a homelab to where I could credibly serve the wider internet from it, and I still use a VPS as reverse proxy anyway! Meanwhile, offloading your physical plant to a mom-n-pop platform-as-a-service provider isn’t the worst thing in the world. Some operators started out selfhosting and grew their little VPS provider from that, those guys need business too!





  • Personally I’d go for as big a UPS as I could afford, but I serve some public-facing stuff from my homelab and I live in an area with outdated infrastructure and occasional ice storms. I currently have a small UPS and have been too tired/overwhelmed to set up automated shutdown yet. It’s not too hard though, I’ve done it before. And even without that in place, my small UPS has kept things going thru a bunch of <10 minute outages.


  • There isn’t a guide yet that I’ve found. I slowly & painfully assembled all the info and beat my head against the task until I had something working & stable.

    I’m currently building a comprehensive one, but due to circumstances beyond my control, it’s taking forever.

    I think civilization just hasn’t gotten there yet, but I suspect I’m not the only one working on this, so I bet the reverse proxy tunnel HOWTO situation will be way better in a year or two…

    FWIW I use nginx on the front end, and rathole for my tunnels - the latter is a very straightforward way to set up the tunnels.


  • Currently I have a bastion host running a hardened distro, which establishes a reverse proxy tunnel to its ssh port via my $4/mo VPS using rathole, an excellent reverse proxy utility I switched to from frp.

    I also maintain a Tor hidden service pointed at the bastion host’s ssh port and another on a different internal host. These are so that I can still get in if the bastion host, my VPS, or certain aspects of networking are down for some reason.

    Eventually I will implement port knocking / single packet authorization by deploying fwknop on some or all of these services to further enhance security.










  • I have a background (in the distant past) as a PHP dev, and currently make my income doing mostly Wordpress work.

    For a very long time I took a jaundiced eye towards big PHP apps for the exact same reasons. That being said, I just two days ago finally installed Nextcloud in my homelab and exposed it to the world.

    It’s worth noting that a lot of PHP’s bad rep comes from Wordpress, which is terrible in security terms in large part due to a huge and very poorly vetted ecosystem of plugins written by coders of all skill levels.

    PHP itself had a number of anti-features which made security difficult in the past. A lot of those issues have been worked on. As somebody who was up to my eyeballs in PHP for years during the bad old days, I’m now confident installing big PHP apps if I think the dev team and dev process are reasonably mature.