You may have noticed a few of my posts here, I am very interested in self-hosting and what advice can you give to a newbie? maybe some literature, video, I don’t know~

  • TCB13@lemmy.world
    link
    fedilink
    English
    arrow-up
    13
    ·
    8 months ago

    It depends on what you’re self-hosting and If you want / need it exposed to the Internet or not. When it comes to software the hype is currently setup a minimal Linux box (old computer, NAS, Raspberry Pi) and then install everything using Docker containers. I don’t like this Docker trend because it 1) leads you towards a dependence on property repositories and 2) robs you from the experience of learning Linux (more here) but I it does lower the bar to newcomers and let’s you setup something really fast. In my opinion you should be very skeptical about everything that is “sold to the masses”, just go with a simple Debian system (command line only) SSH into it and install what you really need, take your time to learn Linux and whatnot. A few notable tools you may want to self-host include: Syncthing, FileBrowser, FreshRSS, Samba shares, Nginx etc. but all depends on your needs.

    Strictly speaking about security: if we’re talking about LAN only things are easy and you don’t have much to worry about as everything will be inside your network thus protected by your router’s NAT/Firewall.

    For internet facing services your basic requirements are:

    • Some kind of domain / subdomain payed or free;
    • Preferably Home ISP that has provides public IP addresses - no CGNAT BS;
    • Ideally a static IP at home, but you can do just fine with a dynamic DNS service such as https://freedns.afraid.org/.

    Quick setup guide and checklist:

    1. Create your subdomain for the dynamic DNS service https://freedns.afraid.org/ and install the daemon on the server - will update your domain with your dynamic IP when it changes;
    2. List what ports you need remote access to;
    3. Isolate the server from your main network as much as possible. If possible have then on a different public IP either using a VLAN or better yet with an entire physical network just for that - avoids VLAN hopping attacks and DDoS attacks to the server that will also take your internet down;
    4. If you’re using VLANs then configure your switch properly. Decent switches allows you to restrict the WebUI to a certain VLAN / physical port - this will make sure if your server is hacked they won’t be able to access the Switch’s UI and reconfigure their own port to access the entire network. Note that cheap TP-Link switches usually don’t have a way to specify this;
    5. Configure your ISP router to assign a static local IP to the server and port forward what’s supposed to be exposed to the internet to the server;
    6. Only expose required services (nginx, game server, program x) to the Internet us. Everything else such as SSH, configuration interfaces and whatnot can be moved to another private network and/or a WireGuard VPN you can connect to when you want to manage the server;
    7. Use custom ports with 5 digits for everything - something like 23901 (up to 65535) to make your service(s) harder to find;
    8. Disable IPv6? Might be easier than dealing with a dual stack firewall and/or other complexities;
    9. Use nftables / iptables / another firewall and set it to drop everything but those ports you need for services and management VPN access to work - 10 minute guide;
    10. Configure nftables to only allow traffic coming from public IP addresses (IPs outside your home network IP / VPN range) to the Wireguard or required services port - this will protect your server if by some mistake the router starts forwarding more traffic from the internet to the server than it should;
    11. Configure nftables to restrict what countries are allowed to access your server. Most likely you only need to allow incoming connections from your country and more details here.

    Realistically speaking if you’re doing this just for a few friends why not require them to access the server through WireGuard VPN? This will reduce the risk a LOT and won’t probably impact the performance. Here a decent setup guide and you might use this GUI to add/remove clients easily.

    Don’t be afraid to expose the Wireguard port because if someone tried to connect and they don’t authenticate with the right key the server will silently drop the packets.

    Now if your ISP doesn’t provide you with a public IP / port forwarding abilities you may want to read this in order to find why you should avoid Cloudflare tunnels and how to setup and alternative / more private solution.

    • anamethatisnt@lemmy.world
      link
      fedilink
      English
      arrow-up
      5
      ·
      8 months ago

      My Debian Hypervisor do have a DE (GNOME) to be able to easily access virtual machines with virt-manager if I mess up their networking, my Debian VMs run CLI only though.

      Regarding your last section I agree strongly - I only expose my vpn with no other incoming ports open. You also don’t need to invest in a domain if you do it this way.
      I don’t mind helping my friends install their openvpn client and certificate and it’s nice to not have my services bombarded with failed connection attempts.

      • TCB13@lemmy.world
        link
        fedilink
        English
        arrow-up
        2
        ·
        8 months ago

        My Debian Hypervisor do have a DE (GNOME) to be able to easily access virtual machines with virt-manager

        Well I guess that depends on your level of proficiency with the cli. I personally don’t want a DE running ever, in fact my system doesn’t even have a GPU nor a CPU that can do graphics.

        With that said, do you know about Cockpit? It provides you with a very light WebUI for any server and has a virtual machine manager as well.

        I don’t mind helping my friends install their openvpn client and certificate and it’s nice to not have my services bombarded with failed connection attempts.

        Yes I know the feeling ahahah. Now you should consider Wireguard, it’s way easier and lighter. Check out the links I provided, there’s a nice WebUI to provision clients there.

        • anamethatisnt@lemmy.world
          link
          fedilink
          English
          arrow-up
          2
          ·
          8 months ago

          Cockpit
          I do know about and use Cockpit with said virtual machine manager but I mostly use it as a shutdown/boot/restart app in my phone and a convenient service monitor and log viewer when troubleshooting.

          Wireguard/OpenVPN
          I really should try out Wireguard sometime but currently OpenVPN is fast enough for my bandwidth and I was already proficient with setting it up before Wireguard.
          The WebUI definitely looks useful.

          • TCB13@lemmy.world
            link
            fedilink
            English
            arrow-up
            2
            ·
            8 months ago

            I do know about and use Cockpit with said virtual machine manager

            So… no need for a DE :) Wireguard is so damn good, even if you manual setup it’s just easier.

              • TCB13@lemmy.world
                link
                fedilink
                English
                arrow-up
                1
                ·
                8 months ago

                Well, it’s not just about RAM. A DE comes with dozens of packages and things that get updated, startup delays and whatnot.

    • mipadaitu@lemmy.world
      link
      fedilink
      English
      arrow-up
      3
      ·
      8 months ago

      This is a good list, but I didn’t see you mention SSL certificates. If you’ve gone through all your steps, you should be able to use LetsEncrypt to get free, automatically managed SSL certs for your environment.

      https://letsencrypt.org/