So I am in a vicious cycle. I start doing something, notice there is a better way, change my setup and restart. So from just Ubuntu server, I developed to proxmox. From documenting everything manuall in joplin, i am now using ansible. I started with wireguard, then tailscale with selfhosted headscale. I try to get my setup right on the first try, which i notice is stupid as I am writing. It just hinders me to make progress. I think I should rather try to get it up and running as fast as possible (and securely of cause) to make progress and fail fast maybe? And I like all the changes I made, I think they were the right choice, but its a bit tiering. And I like ansible, I just have the urge to automate absolutely everything, so I can redeploy everything right after I installed proxmox. Which is not necessary at all at this stage, idk :D Maybe someone has some tips how to overcome perfectionism?
Selfhosted
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
-
No spam posting.
-
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
-
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
-
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
-
No trolling.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
For me, tinkering is part of the process and I'm enjoying it. Deciding to do something differently and changing a lot of stuff every now and then is fine. What's annoying is if you are in the middle of such a process and then run out of (free) time. Next time I look at it I forgot half of it if it's not finished and documented.
I spent some time last week learning both Ansible and Podman Quadlets. They are a powerful duo, especially for self hosting.
Ansible is a desired state system for Linux. Letting you define a list of servers and what their configuration should be, like "have podman installed" and "have this file at this location with this content".
Podman quadlets is a system for defining podman containers as a service. You define the container, volumes, and networks all in essentially Systemd unit files.
Mixing the two together, I can have my entire podman setup in a format that can be pushed to any server in seconds.
And of course everything is text files that git well.
I was thinking about this for some time now, can you link me to some good tutorials about quadlets in particular? Ansible will have to wait for now.
Unfortunately not. I found documentation largely lacking. I mostly read the docs and searched specific questions that came up(which often just took me back to the docs). I did as a local LLM for help, but found it's knowledge base lacking. Sometimes it would work for a hint, but it more often than not made up parameters and features.
I did the same last week (and am still in the process of setting up more services for my new server). I have a few VMs (running Fedora CoreOS, with podman preinstalled), and I use ansible to push my quadlets, podman secrets, and static configuration files. Persistent data volumes get mounted using virtiofs from the host system, and the VMs are not supposed to contain any state themselves. The VMs are also provisioned using using ansible.
Do you use ansible to automatically restart changed containers after pushing your changes? So far, I just trigger a systemctl daemon-reload, but trigger restarts manually (which I guess is fine for development).
I haven't gotten too far, but right now I've got persistent volumes being pushed by NFS from my NAS. I'm using rocky Linux VMs as my target, but for this use case, Fedora CoreOS should be the same.
I haven't yet tried using Ansible to create the VMs, but that would be cool. I know teraform is designed for that sort of thing, but if Ansible can do it, all the better. I'd love to get to a point where my entire stack as Ansible.
I don't yet have Ansible restarting the service, but that should be a simple as adding a few new tasks after the daemon-reload task. What I don't know how to do is tell it to only restart if there is change to any of the config files uploaded. That would be nice to minimize service restarts.
I finally set up Jellyfin and Sonarr! I've been using Plex and manually managing torrents for a while now, recently found the *arr services and they are very impressive. Got the Jackett - Sonarr - Jellyfin - Nginx stack set up, now working on getting SSL + DynDNS so I can make it available remotely. Also accidentally blasted my ratio downloading a bunch of TV shows all at once so gotta seed up for a bit before i fill it out more. But so far the setup has been pleasantly breezy for how complex a setup it is ❤️
For privacy reasons, I have finally fully disabled dynamic dns updates and closed the last holes in the home firewall, moving to 100% proxying via a VPS for publicly available stuff, and a tailnet (headscale) for everything private. The only real cross-over is Nextcloud - mountains of private data, but I want it publicly available for file shares. Fortunately, Nextcloud has a setting to whitelist IP addresses that allow log-in, so I can restrict that to just the non-VPS tailnet addresses. From the public internet, only public shares are accessible.
I set up a L4 proxy so that the encryption for Nextcloud happens at home and the VPS just passes encrypted packets. Then it occurred to me that a compromised VPS could easily grab a SSL cert for my Nextcloud subdomain via a regular-old http-challenge and MITM access to all my files, defeating the point.
Then I found a neat hack that effectively disables http-challenge certs for subdomains by requiring a wildcard certificate - which can only be created with a dns-challenge. I was able to also disable all other certificate authorities. Obviously, I have /some/ trust in the VPS I administer - it's on my tailnet network - but no longer have the concern that it could easily MITM Nextcloud. https://www.naut.ca/blog/2019/10/19/mitigating-http-mitm-possibilities-with-lets-encrypt/
Considering switching my Forgejo to a Tangled.sh knot. Their easy self hosted CI option is appealing
but mostly itd be easier to collaborate than opening sign ups on my instance of forgejo
Forgejo is developing ActivityPub support, so eventually we'll be able to collaborate across forgejo instances :) I'll have a look at tangled as well
oh thats cool thanks for sharing!
That looks super interesting. Just yesterday I was reading on https://radicle.xyz/ for similar reasons.
I'm trying to find a reasonably priced used rack mount computer to move all my containers to. I have a rack in my house but measuring the depth between posts only gets me around 17.5". Recently deployed paperless-ngx and decided it would be too much to add onto my poor little NAS which hosts everything else so its deployed on my main computer and I want to avoid that strategy.
Challenge is that being new to rack servers and all of this (the NAS was a great intro box) I've got a large learning curve ahead of me.
Are you using the rack already? Many people are opting for 10" racks for their homelabs these days. There's 3D printable enclosures for many thin clients and mini PCs. Minilab is the go-to term. This is mine if you're interested
Already have the rack and it hosts most of my items (router, switch, raspberry pi rack, NAS, PS3 apple TV). Honestly other than the raspberry pi rack and the router, the rest are just using shelves anyways. I need to find a good, non-bulky way to take the enclosure fan and switch it on when temps get above a set point. What I've done in the past with an arduino is way too bulky.
I love your idea and its funny you mention the mini PCs and thin clients. As I look at prices I'm more and more leaning towards just another shelf and using mini PCs.
Just be sure to get a decent KVMoIP (KVM over IP); it’s worth it for the first time you’re not home and a system blue screens.
For what it's worth, Ikea's LACK tables make great mini racks
The LACK rack!
I have a Dell R220 and a R240 which I’m looking to offload, free. They’re both specifically for short racks if you happen to be near central NC.
I'm a newbie to the whole selfhosting thing. Been doing NAS+minipc for past 6 months with a few services running. 2 days ago I embarresed myself.
So, I been running 5 services on nginx proxy manager. But I heard that NPMplus is slightly better and can renew certs automatically. I had transferred settings from NPM to NPMplus by hand off the photo and for some reason NPMplus couldn't work with services ran on NAS. I went back to NPM and haven't touched the issue til last Sunday.
During troubleshooting I found out that my dumb ass didnt pay attention and put '':'' instead of ''." . So 192.168.xxx.xx became 192:168:xxx:xx and that was the reason I spent whole day troubleshooting the issue.
Next goal: go back to my homeland and set Pi3 at my parent's place to be my VPN so I can setup an arr stack and automate media downloads in a way that govt. of my current residence couldn't put a deep hole in my wallet.
Do your parents live in a place where that won't happen?
For auto renewing certs: You can do that easily with the normal nginx, using certbot alongside it. Just tell certbot to handle the domain once and it will renew it forever.
-
Yes. Kind of. It is in EU but afaik piracy is not an illegal thing there yet or is not enforced as much compared to where I live now.
-
Too late. NPMplus is up and running. Also, I like dark mode.
Just got a domain and started exposing my local jellyfin through cloudflare, mostly wanting to listen to my music on my phone when i'm outside too.
I followed some guides that should make it fine with cloudflare's policy, video doesnt work when i tried it but otherwise its been fun despite me feeling like im walking on eggshells all the time. I guess time will tell if it holds up
Some things which have caused issues for me:
File permissions
Video/audio format (264/aac stereo is best for compatibility)
I finally got around to setting up my internal services with TLS. It was surprisingly easy with a Caddy docker image supporting Cloudflare DNS challenge.
I did this because various services I use are starting to require https.
Now everything is on a custom domain, https, and I can access it through Tailscale as usual.
Just ordered a used HP EliteDesk 800 G3 SFF (3.6GHz Intel Core i7-7700, 8GB DDR4 RAM, 256GB SSD) off EBay to replace my Apple Mac mini "Core i7" 2.3 (Late 2012/Server). Hoping to put 32GB of RAM in it, 1TB NVMe boot drive and maybe a 3.5” HDD for media instead of using an external drive. Might move to NixOS (I’d like to learn how to administer Nix even though it’s very complicated sometimes) and Podman, instead of using Proxmox and Docker Debian VMs and LXC containers.
Any advice and guidance appreciated!
I got two of those for 100$ USD for the purpose of hosting openwrt in proxmox LXC containers. One thing I noticed is they have no cooling. I put a 10 GBe mellanox card in it plus a very low end radeon gpu and it gets quite hot in there. My recommendation, instead of trying to embiggen it as much as possible, by putting 2 more sticks of ram and the biggest cpu, I would recommend just buying another. The performance boost per dollar isn't as much as the performance capacity of a second, third or 4th machine.
Thanks for the recommendation, I got this one for just over $100 after tax. Space is an issue for me, so more machines isn’t the best and I can always keep the Mac Mini chugging if needed. I’ll probably only do the HDD/SSD and RAM upgrade, but it’s definitely worth keeping in mind if I throw a new NIC or GPU in it. I am thinking of putting a Noctua fan on the CPU cooler to keep it quieter and cooler!
Just discovered TinyAuth and it is fantastic. I am replacing Authentik with it because it has what I want but is much faster, smaller, and simpler. Also, the license is FOSS.
Trying to figure out how to drop my energy requirements and still keep ~100TB running.
Right now it’s 12x 10TB drives in a RAID 6 with ~8TB still available; it might be time to bite the bullet and upgrade to 20TB drives. Problem is, if my calculations are correct, I’d still need 7 drives - 5 X 20TB=100TB and then two more drives for “parity”.
The server I have lined up already has a PERC in it.
Do you actually need 100TB instantly available? Could a portion of that be cold storage that can be booted quickly from a WOL packet from the always-on machine when needed? With some tweaking, you could probably set up an alpine-based NAS to boot in <10 seconds, especially if you picked something that supported coreboot and could avoid that long bios post time.
What is beets, hobbits?
It's a tool that checks and corrects metadata for your music collection. You can also import music with it to your collection (it will put everything in the right folders etc).
It does require some manual intervention now and then, though (do you really want to apply this despite some discrepancies? Choose, which of these albums it really is. Etc).
I have a couple pis that run docker containers including pihole. The containers have their storage on a centralized share drive.
I had a power outage and realized they can't start if they happen to come up before the share drive PC is back up.
How do people normally do their docker binds? Optimally I guess they would be local but sync/backup to the share drive regularly.
Sort of related question: in docker compose I have restart always and yet if a container exits successfully or seemingly early in it's process (like pihole) it doesn't restart. Is there an easy way to still have them restart?
What's the best ACME server?
I feel like my little Pi server is set up nicely now. At least I'm at the point where I'm not concerned about technically maintaining it. It's as secure as I want it to be and I've tweaked my maintenance scripts slightly to avoid any unexpected issues.
I tried installing snikket but I couldn't figure out how to get it to work with my Caddyfile using my current wildcard domain cert configuration. I'll try again another time when I'm motivated again. It's a low priority to me.
The last changes I made were adding logs and making them accessible to myself. So far they are all boring and predictable. Which is good news. It's also nice to see that I'm the only person accessing it. The bots haven't found my little corner of the internet yet.
Right now I'm taking a break from self-hosted stuff to work on my gardens and two artsy projects. A wooden carving for a friend's birthday and an overly complicated shell script that has no real purpose. Although I've learned lots from it already so it's not a complete waste of time.
Nothing new, just peacefully chugging along hosting my blog, Jellyfin, Radicale for calendar and contacts. Still long-term searching for a photo storing & sharing (gallery) solution, as well as a better music server. Maybe Navidrome is what I'm looking for.
Oh, and I need to renew my SSL certificate soon. I don't like Letsencrypt. Everything EU-based, I'm not going to start making US-based contracts.
Did you have a look at Immich yet for photos?
Can recommend Immich for the Photo gallery and sharing option.
Can recommend Navidrome for music.
Just got my new NAS drives, so about to make the transition.
It’s actually new drives, and a new host. I’ve been running my old Synology NAS for years. But decided I ought to switch to a “real” NAS through Proxmox.
Just set up a simple samba container with Cockpit as a web manager, so far working really well. But I want to validate backups before I start moving all the irreplaceable data.
Something I’m excited about is using my old Synology NAS as an automatic, off-site backup once I transition. Heard about Duplicati from a friend, sounds like a great syncing solution.
Other than that I’ve been looking into using Apple HomeKit features with my Home Assistant devices. And also planning to move my hardware from the cheap Amazon floor shelf to a real 19” rack.
I'm in planning for upgrading my NAS. It has a 10Gbps fiber connection, and my main workstation does, as well. My goal is to be able to saturate that with both read and write speed. Timeline is 6 to 8 months out.
Budget in the range of $2000-3000. Currently doing RAID1 on a pair of 18TB disks. I usually want to double that with each upgrade, but there's some leeway on there.
I think my best option is 6 NVMe sticks on RAID6. 8TB sticks would give 32TB of usable space. Not quite double, but close enough.
I would like easy hot swap capabilities. Unfortunately, it looks like the only option for that would be Icydock, and those are expensive. The other way is to go down to SATA drives where relatively cheap 2.5" hot swap bays exist, but a setup that can saturate 10Gbps writes with reasonable redundancy would be even more expensive.
Need a motherboard that has a pair of 16x slots. One needs to be a GPU for Jellyfin transcoding. Also need a 4x slot for a 10Gbps sfp+ NIC. With two NVMe slots on the mobo, this should be workable without going to Threadripper or Epyc chips and such--idle power consumption sucks on those. Totally giving up on hot swap here, though.
There are 8tb NVMe sticks that are priced close to fit in this budget range. I had found one Samsung stick that, according to Amazon price trackers, was around $300 in the recent past (can't seem to find it now). A lot will depend on tariffs, of course.
One surprise is that a Kioxia CD6-R u.3 drive at 15.36TB goes for $1150. 4 drives on RAID10 would be a workable space upgrade. That setup would be out of budget, but not as much as I would have expected. Referb deals or future price movement might put it in range.
H A R V E S T E R
Lol
But honestly got all of nodes (some new hardware, some minipcs, some old laptops, some ewaste servers, some raspberry pies, a VM off my Macbook), all in my harvestet cluster. I got Rancher running as a vcluster as well so messed some with Rancher provisioned rke2 clusters too.
Played some with nutanix as a vm in that cluster (what a fing nightmare, anr not virtual hardware just Nutanix ...). Playing with ESXI now (its not happy about my amd chips so far...). And also my virtual harvester cluster. Easy so far but i want to get more ambitoius in creating a mock deployment, network and all, so i can test crazier configs without losing a day to rebuilding a cluster via thumb drive again...
Also managed some risk and got my ISP to let me do dual modems on the same bus and configed OpenWRT to load balance between them and via usb my wifi hotspot. Still working with them to try and get more IPs so can use the 4 total ports on my modem stacks to attach to both of my routers.
I like tinkering with junk, so the other half of my hobby is just risk mitigation (which i also enjoy).