Comment by teekert | Hacker News Reader

Comment by teekert | Hacker News Reader

NextCloud, Home Assistant, Paperless NGX, Minecraft, Caddy for some Hugo sites/blogs, Unify Controller, Vaultwarden, Traefik, Sabnzbd. Used to do WireGuard but now I use Tailscale, AdGuard home and FoundryVTT.

It's all docker-compose. I'm thinking of taking some services off the internet using TailScale, some already are just on the Tailnet (Home Assistant and Paperless NGX), all my SSH ports are now only open to the tailnet as well. I love Tailscale, except for the battery drain on my iPhone (which wasn't an issue with plain WireGuard)...

Btw, this is my hardware: https://blog.hmrt.nl/posts/personal-cloud-infrastructure/#ha... (beware, the rest of the post is somewhat dated).

Oh, I moved Paperless and Home Assistant to a NUC, mainly because I'm working on the house a lot and I really need those online, those were also set up with Tailscale in mind, and the advantage is that whether that NUC is plugged in, on WiFi or at my parent's place, all services (inc ssh) are still available at the same IP address (of course sensors drop when I move the NUC out of my network, there is no Tailscale for the Shelly plugs etc :)). I'm thinking of a similar setup for my NextCloud now. Always innovating, it's a nice hobby.

>I love Tailscale, except for the battery drain on my iPhone (which wasn't an issue with plain WireGuard).

Netmaker is a good self-hosted alternative that utilizes Wireguard.

> I love Tailscale, except for the battery drain on my iPhone

Same, I hope they can fix this soon. :(

Yah it really does destroy my battery on iOS.

I've run into this too, and there's been an open issue on this for some time now:

https://github.com/tailscale/tailscale/issues/3363

“It's all docker-compose.”

Are you using a utility to manage docker-compose or just setting it up on the CLI (e.g. started with a systemd service)?

I run docker-compose via CLI on my server but it’s not always convenient to ssh in to check on something.

Since it's all a yaml file I just use vscode's remote-ssh to check (files opens in vscode, one click opens a shell at the bottom (ie for docker-compose ps), nice thing is that remote-ssh also allows dragging and dropping files to the server without needing anything else, rarely need that though). If you add the `restart: unless-stopped` line, all containers just come up again after crashes/reboots.

On Arch I just `sudo systemctl enable docker` (after `sudo pacman docker docker-compose`), I wrote a bit about it here: [0]. This starts docker automatically, and docker automatically starts any containers with the above mentioned line in their service entry.

[0]" https://blog.hmrt.nl/posts/wordpress_using_swag/

Look into portainer

Very cool! Since this is all exposed to the internet, how do you keep it secure? I’ve got a spare laptop and a static IP, but I’m concerned about exposing my home server to attacks. Right now I’ve just got it all running in Tailscale, but I’d like to safely host public-facing apps too.

I religiously keep everything up to date, for anything exposed to the public I use https (Traefik does let's encrypt, caddy as well) and set 2FA for Nextcloud for example, there is also a brute-force protection app for NC.

Some services, like HA, my minecraft servers, Paperless, in fact most of them, I would indeed feel less comfortable exposing, and I don't, but for NextCloud I also use it to share large files with friends so it needs to be internet facing, as do the blogs, but Hugo generates static sites, so that is quite secure (like earlier mentioned blog).

Thank you for the explanation! It sounds like a pretty solid system.

In addition to the other comment, look into fail2ban: it's a bruteforce protection that isn't application-specific, it can be configured to protect form bruteforce any service that logs login attempts somewhere.

One extra layer I put on my externally facing sites is a simple auth prompt (after redirect to https!) as an unlikely-to-have-a-compromise gate before any logon for a self-hosted service. You can make it a fairly easy to remember username/password for anyone you want to share your self-hosted apps with, since its a mostly irrelevant extra step just to guard against exploits in more complicated software stacks

I started using traefik as my loadbalancer which supports authentication middleware. I rigged up keycloak and forward-auth to handle external services that either do not support authentication or has a weak security profile. A poor man’s zero trust setup.

Here is the blog I used to get things started: https://geek-cookbook.funkypenguin.co.nz/docker-swarm/traefi...

Neat! Thanks for the tip. I might integrate this in some of my auth, but I'll probably keep using simple auth at the very front due to its old age and absolute simplicity making exploits unlikely

> docker-compose

How do you deal with backups? That’s my main struggle with docker.

I use Borg (https://borgbackup.readthedocs.io/en/stable/) with some Python and Bash scripts.

All my containers write to the same volume mount (e.g., /mnt/docker_share/$service_name), the scripts shutdown the LVM, run the backups from Borg, sync the files to rsync.net and turn the LVM back on when the backups finish.

Reply on news.ycombinator.com