Welcome to Incremental Social! Learn more about this project here!
Check out lemmyverse to find more communities to join from here!

After 1.5 years of learning selfhosting, this is where I'm at

@selfhosted

Mid 2022, a friend of mine helped me set up a selfhosted Vaultwarden instance. Since then, my "infrastructure" has not stopped growing, and I've been learning each and every day about how services work, how they communicate and how I can move data from one place to another. It's truly incredible, and my favorite hobby by a long shot.

Here's a map of what I've built so far. Right now, I'm mostly done, but surely time will bring more ideas. I've also left out a bunch of "technically revelant" connections like DNS resolution through the AdGuard instance, firewalls and CrowdSec on the main VPS.

Looking at the setups that others have posted, I don't think this is super incredible - but if you have input or questions about the setup, I'll do my best to explain it all. None of my peers really understand what it takes to construct something like this, so I am in need of people who understand my excitement and proudness :)

Edit: the image was compressed a bit too much, so here's the full res image for the curious: https://files.catbox.moe/iyq5vx.png
And a dark version for the night owls: https://files.catbox.moe/hy713z.png

vox ,
@vox@sopuli.xyz avatar

btw why did you choose tailscale over zerotier

7Sea_Sailor OP ,
@7Sea_Sailor@lemmy.dbzer0.com avatar

I heard about tailscale first, and haven't yet had enough trouble to attempt a switch.

vox ,
@vox@sopuli.xyz avatar

huh i thought zerotier is more popular.
i love it but their android app sucks. hasn't received a single large update since android 5 and constantly keeps disconnecting

7Sea_Sailor OP ,
@7Sea_Sailor@lemmy.dbzer0.com avatar

Are you talking about the Tailscale App or the ZeroTier app? Because the TS Android app is the one thing im somewhat unhappy about, since it does not play nice with the private DNS setting.

vox ,
@vox@sopuli.xyz avatar

I'm talking about the zerotier's app

AustralianSimon , (edited )
@AustralianSimon@lemmy.world avatar

Tail scale is stupid easy to set up and free for first ten 100 devices and supports 3 custom domains.

vox , (edited )
@vox@sopuli.xyz avatar

zerotier is open source and free with up to 25 nodes per network, and supports custom ip assignments (in custom ranges, with option to have multiple subnets per network), custom dhcp, managed dns, and custom, multiple managed routes (with option to point to a custom gateway), and traffic flow rules.

for example here are the rules i have set up for my "gaming" network that i use to play LAN games with my friends (only allows ipv4, arp and ipv6 traffic and prevents clients from self-assigning ip addresses)
https://sopuli.xyz/pictrs/image/9ad763ef-5dbb-49b4-8f2c-d63ed376b60f.webp

route settings page:
my "personal" network (which just links all of my personal devices together) exists in 172.16.0.0/24 and auto-assigns ipv4 addresses in 172.16.0.101-172.16.0.199 range using dhcp (but i have configured custom ip addresses for each device anyway), and ipv6 is auto-assigned using RFC4196.
https://sopuli.xyz/pictrs/image/3a501371-5351-4c07-965a-c68c0552505e.webp
https://sopuli.xyz/pictrs/image/0aa0ed9c-effd-4fc8-a8b2-e6c6d118a6ec.webp

AustralianSimon , (edited )
@AustralianSimon@lemmy.world avatar

Tail scale can be self hosted also. But for example, it took me 5 clicks to set up a tail scale network with 3 devices.

Also it's apparently been buffed to 100 devices for free and 3 custom domains.

Also open source https://github.com/tailscale/tailscale

Mbourgon ,

What did you use to chart this? And nicely done.

Mbourgon , (edited )

Excalidraw. Reading is hard. (Yeah, I missed that it was mentioned in the thread)

dipshit ,

Excalidraw is nice. Also, I want to throw in a mention for mermaid.live (mermaid js). A little less flexiblity but it’s nice. There’s also kroki.io which hosts a lot of these types of apps.

Mbourgon ,

Yeah, definitely a concert to Mermaid.

Fedegenerate ,

I am sorry, I am but a worm just starting Docker and I have two questions.

Say I set up pihole in a container. Then say I use Pihole's web UI to change a setting, like setting the web UI to the midnight theme.

Do changes persist when the container updates?

I am under the impression that a container updating is the old one being deleted and a fresh install taking its place. So all the changes in settings vanish.

I understand that I am supposed to write files to define parameters of the install. How am I supposed to know what to write to define the changes I want?

Sorry to hijack, the question doesn't seem big enough for its own post.

Limit ,

With containers, most will have a persistent volume that is mapped to the host filesystem. This is where your config data is. When you update a container, just the image is updated(pihole binaries) but it leaves the config files there. Things like your block lists and custom dns settings, theme settings, all of that will remain.

Fedegenerate ,

Thank you.

Cyanogenmon ,
@Cyanogenmon@lemmy.world avatar

This is oddly similar to some informal workups I've done for our work network.

Nice work 👍.

lemmyissupergay ,

This is needlessly over complicated and bloated just FYI but if you enjoy complexity for the sake of complexity then go for it.

thorbot ,

I just have a UniFi firewall, a Synology Diskstation, and a linux server running everything. Provides torrenting, video streaming with plex, file sharing, game server hosting, music hosting, and more, and I don't ever have to mess with it :). This is impressive but I don't know if I would want to support it personally

7Sea_Sailor OP ,
@7Sea_Sailor@lemmy.dbzer0.com avatar

I'd love to have everything centralized at home, but my net connection tends to fail a lot and I dont want critical services (AdGuard, Vaultwarden and a bunch of others that arent listed) to be running off of flakey internet, so those will remain in a datacenter. Other stuff might move around, or maybe not. Only time will tell, I'm still at the beginning of my journey after all!

thorbot ,

Fair. I'm lucky enough to be able to get business internet at home so I have a static IP and 99.9% uptime. My plex watchers and game hosting players know that sometimes around 3am, they might be booted when my networking gear auto updates itself, haha

LunchEnjoyer ,

Since nobody else asked about this, why ruTorrent over the other typical download clients?

1371113 ,

You’re usually stuck with what your seedbox provider gives you.

LunchEnjoyer ,

Ahh I'm not too familiar with seedboxes, thanks 🌻

7Sea_Sailor OP ,
@7Sea_Sailor@lemmy.dbzer0.com avatar

Pretty sure ruTorrent is a typical download client. The real reason is that it came preinstalled and I never had a reason to change it ¯_(ツ)_/¯

remotedev ,

Sorry if someone already asked this, but do you have any tutorials or guides that you used and found helpful for starting out? I have some small experience with nginx and such, but I would definitely need to follow along with something that tells me what to do and what each part does in a infrastructure like you have haha

von ,

Had to look up what a few of these were myself, check the sidebar resources: https://github.com/awesome-selfhosted/awesome-selfhosted

7Sea_Sailor OP ,
@7Sea_Sailor@lemmy.dbzer0.com avatar

That's a tough one. I've pieced this all together from countless guides for each app itself, combined with tons of reddit reading.

There are some sources that I can list though:

dutchkimble ,

I've been dabbling in self hosting recently and found that chatgpt can help you setup a lot if you don't get annoyed and keep fixing your prompts. It even writes out your docker compose files for you and you can ask it questions on what things mean and what's linked to each other. If you do try it out though, avoid giving personal info like passwords in the chat.

kadotux , (edited )
@kadotux@lemmings.world avatar

I saved this! Yeah, it seems like a lot of work, but I got inspired again (I had a slight self-hosting burnout and nuked my raspberry setup ~year ago) so I appreciate it. :) Can I ask what hardware you run this on?
edit: I just wanted to ramble some more: I just fired up my rPI4 again just last week, setup it with just as barebone VPS with wireguard, samba, jellyfin and pi-hole+unbound (as to not burn myself again :D )

7Sea_Sailor OP ,
@7Sea_Sailor@lemmy.dbzer0.com avatar

Glad to have gotten you back into the grind!

My homelab runs on an N100 board I ordered on Aliexpress for ~150€, plus some 16GB Corsair DDR5 SODIMM RAM.
The Main VPS is a 2 vCPU 4GB RAM machine, and the LabProxy is a 4 vCPU 4GB RAM ARM machine.

sailingbythelee ,

What VPS service do you use/recommend and what's your monthly cost?

7Sea_Sailor OP ,
@7Sea_Sailor@lemmy.dbzer0.com avatar

I use Hetzner, mainly because of their good uptime, dependable service and being geographically close to me. Its a "safe bet" if you will. Monthly cost, if we're not counting power usage by the homelab, is about 15 bucks for all three servers.

notfromhere ,

What is seedbox? Is it part of the homelab or a service like the VPSs?

7Sea_Sailor OP ,
@7Sea_Sailor@lemmy.dbzer0.com avatar

its basically a VPS that comes with torrenting software preinstalled. Depending on hoster and package, you'll be able to install all kinds of webapps on the server. Some even enable Plex/Jellyfin on the more expensive plans.

notfromhere ,

How do you do the sshfs mount, tracker and search queries? Is that over tailscale?

7Sea_Sailor OP ,
@7Sea_Sailor@lemmy.dbzer0.com avatar

The rclone mount works via SSH credentials. Torrent files and tracker searches run over simple HTTPS, since both my torrent client and jackett expose public APIs for these purposes, so I can just enter the web address of these endpoints into the apps running on my homelab.

Sidenote, since you said sshfs mount: I tried sshfs, but has significantly lower copy speeds than with rclone mount. Might have been a misconfiguration, but it was more time efficient to use rclone than trying to debug my sshfs connection speed.

notfromhere ,

I have noticed very slow speeds with sshfs as well. I’ll have to give rclone mount over ssh a try. Thanks!

ginko ,

Architecture looks dope

Hope you've safeguarded your setup by writing a provisoning script in case anything goes south.

I had to reinstall my server from scratch twice and can't fathom having to reconfigure everything manually anymore

7Sea_Sailor OP ,
@7Sea_Sailor@lemmy.dbzer0.com avatar

Nope, don't have that yet. But since all my compose and config files are neatly organized on the file system, by domain and then by service, I tar up that entire docker dir once a week and pull it to the homelab, just in case.

How have you setup your provisioning script? Any special services or just some clever batch scripting?

ginko ,

Old school ansible at first, then I ditched it for Cloudbox (an OSS provisioning script for media server)

Works wonders for me but I believe it's currently stuck on a deprecated Ubuntu release

krash ,

How do you like crowdsec? I've used it on a tiny VPS (2 vcpu / 1 GB RAM) and it hogs my poor machine. I also found it to have a bit of learning curve, compared to fail2ban (which is much simpler, but dosen't play well with Caddy by default).

Would be happy to see your Caddy / Crowdsec configuration.

Sekki ,

Somehow I only had issues with CrowdSec. I used it with Traefik but it would ban me and my family every time they used my selhosted matrix instance. I could not figure out why and it even did that when I tried it on OPNSense without the Traefik bouncer...

7Sea_Sailor OP ,
@7Sea_Sailor@lemmy.dbzer0.com avatar

The crowdsec agent running on my homelab (8 Cores, 16GB RAM) is currently sitting idle at 96.86MiB RAM and between 0.4 and 1.5% CPU usage. I have a separate crowdsec agent running on the Main VPS, which is a 2 vCPU 4GB RAM machine. There, it's using 1.3% CPU and around 2.5% RAM. All in all, very manageable.

There is definitely a learning curve to it. When I first dove into the docs, I was overwhelmed by all the new terminology, and wrapping my head around it was not super straightforward. Now that I've had some time with it though, it's become more and more clear. I've even written my own simple parsers for apps that aren't on the hub!

What I find especially helpful are features like explain, which allow me to pass in logs and simulate which step of the process picks that up and how the logs are processed, which is great when trying to diagnose why something is or isn't happening.

The crowdsec agent running on my homelab is running from the docker container, and uses pretty much exactly the stock configuration. This is how the docker container is launched:

  crowdsec:
    image: crowdsecurity/crowdsec
    container_name: crowdsec
    restart: always
    networks:
      socket-proxy:
    ports:
      - "8080:8080"
    environment:
      DOCKER_HOST: tcp://socketproxy:2375
      COLLECTIONS: "schiz0phr3ne/radarr schiz0phr3ne/sonarr"
      BOUNCER_KEY_caddy: as8d0h109das9d0
      USE_WAL: true
    volumes:
      - /mnt/user/appdata/crowdsec/db:/var/lib/crowdsec/data
      - /mnt/user/appdata/crowdsec/acquis:/etc/crowdsec/acquis.d
      - /mnt/user/appdata/crowdsec/config:/etc/crowdsec

Then there's the Caddyfile on the LabProxy, which is where I handle banned IPs so that their traffic doesn't even hit my homelab. This is the file:

{
	crowdsec {
		api_url http://homelab:8080
		api_key as8d0h109das9d0
		ticker_interval 10s
	}
}

*.mydomain.com {
	tls {
		dns cloudflare skPTIe-qA_9H2_QnpFYaashud0as8d012qdißRwCq
	}
	encode gzip
	route {
		crowdsec
		reverse_proxy homelab:8443
	}
}

Keep in mind that the two machines are connected via tailscale, which is why I can pass in the crowdsec agent with its local hostname. If the two machines were physically separated, you'd need to expose the REST API of the agent over the web.

I hope this helps clear up some of your confusion! Let me know if you need any further help with understanding it. It only gets easier the more you interact with it!

don't worry, all credentials in the two files are randomized, never the actual tokens

krash ,

Thanks for the offer! I might take you up on that :-) If you have a Matrix handle and hang out in certain rooms, please DM me and I'll harass reach out to you there.

7Sea_Sailor OP ,
@7Sea_Sailor@lemmy.dbzer0.com avatar

Hm, I have yet to mess around with matrix. As anything fediverse, the increased complexity is a little overwhelming for me, and since I am not pulled to matrix by any communities im a part of, I wasn't yet forced to make any decisions. I mainly hang out on discord, if that's something you use.

rbos ,
@rbos@lemmy.ca avatar

I have crowdsec on a bunch of servers. It's great and I love that I'm feeding my data to the swarm.

callcc ,

Remeber, the more boxes you have, the more advanced you are as an admin! Once you do his job for money, the challenge is the exact opposite. The less parts you have, the better. The more vanilla they are, the better.

7Sea_Sailor OP ,
@7Sea_Sailor@lemmy.dbzer0.com avatar

Absolutely! To be honest, I don't even want to have countless machines under my umbrella, and constantly have consodilation in mind - but right now, each machine fulfills a separate purpose and feels justified in itself (homelab for large data, main VPS for anything thats operation critical and cant afford power/network outages and so on). So unless I find another purpose that none of the current machines can serve, I'll probably scale vertically instead of horizontally (is that even how you use that expression?)

Decronym Bot , (edited )

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:

Fewer Letters More Letters
DNS Domain Name Service/System
HTTP Hypertext Transfer Protocol, the Web
HTTPS HTTP over SSL
IP Internet Protocol
Plex Brand of media server package
SSH Secure Shell for remote terminal access
SSL Secure Sockets Layer, for transparent encryption
TCP Transmission Control Protocol, most often over IP
VPN Virtual Private Network
VPS Virtual Private Server (opposed to shared hosting)
k8s Kubernetes container management package
nginx Popular HTTP server

11 acronyms in this thread; the most compressed thread commented on today has 15 acronyms.

[Thread for this sub, first seen 2nd Feb 2024, 05:25]
[FAQ] [Full list] [Contact] [Source code]

dan ,
@dan@upvote.au avatar

I'd recommend using Borgbackup over SSH, instead of just using rclone for backups. As far as I know, rclone is like rsync in that you only have one copy of the data. If it gets corrupted at the source, and that gets synced across, your backup will be corrupted too. Borgbackup and Borgmatic are a great way to do backups, and since it's deduplicated you can usually store months of daily backups without issue. I do daily backups and retain 7 daily backups, 4 weekly backups, and 'infinite' monthly backups (until my backup server runs out of space, then I'll start pruning old monthly backups).

Borgbackup also has an append-only mode, which prevents deleting backups. This protects the backup in case the client system is hacked. Right now, someone that has unauthorized access to your main VPS could in theory delete both the system and the backup (by connecting via rclone and deleting it). Borg's append-only mode can be enabled per SSH key, so for example you could have one SSH key on the main VPS that is in append-only mode, and a separate key on your home PC that has full access to delete and prune backups. It's a really nice system overall.

7Sea_Sailor OP ,
@7Sea_Sailor@lemmy.dbzer0.com avatar

You're right, that's one of the remaining pain points of the setup. The rclone connections are all established from the homelab, so potential attackers wouldn't have any traces of the other servers. But I'm not 100% sure if I've protected the local backup copy from a full deletion.

The homelab is currently using Kopia to push some of the most important data to OneDrive. From what I've read it works very similarly to Borg (deduplicate, chunk based, compression and encryption) so it would probably also be able to do this task? Or maybe I'll just move all backups to Borg.

Do you happen to have a helpful opinion on Kopia vs Borg?

dan ,
@dan@upvote.au avatar

I haven't tried Kopia, so unfortunately I can't compare the two. A lot of the other backup solutions don't have an equivalent to Borg's append-only mode though.

fine_sandy_bottom ,

I'm a borg guy. I'd never heard of kopia. This is from their docs though:

Each snapshot is always incremental. This means that all data is uploaded once to the repository based on file content, and a file is only re-uploaded to the repository if the file is modified. Kopia uses file splitting based on rolling hash, which allows efficient handling of changes to very large files: any file that gets modified is efficiently snapshotted by only uploading the changed parts and not the entire file.

So looks like they do append only.

dan ,
@dan@upvote.au avatar

What I mean by "append-only" is that the client can't delete the backups. I don't think Kopia supports that.

fine_sandy_bottom ,

Oooh.

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • incremental_games
  • selfhosted@lemmy.world
  • meta
  • All magazines
    •