Selfhosted
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
-
No spam posting.
-
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
-
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
-
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
-
No trolling.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
view the rest of the comments
I use a central nginx container to redirect to all my other services using a wildcard let's encrypt cert for my internal domain from acme.sh and I access it all externally using a tailscale exit node. The only publicly accessible service that I run is my Lemmy instance. That uses a cloudflare tunnel and is isolated in it's own vlan.
TBH I'm still not really happy having any externally accessible service at all. I know enough about security to know that I don't know enough to secure against much anything. I've been thinking about moving the Lemmy instance to a vps so it can be someone else's problem if something bad leaks out.
Don't fret, not even Microsoft does.
You're not as valuable as a target as Microsoft.
It's just about risk tokerance. The only way to avoid risk is to not play the game.
I know what "wildcard" and "let's encrypt cert" are separately but not together. What's going on with that?
How do you have your tailscale stuff working with ssl? And why did you set up ssl if you were accessing via tailscale anyway? I'm not grilling you here, just interested.
I feel that. I keep meaning to set up something like nagios for monitoring and just haven't gotten around to it yet.
So when I ask Let's Encrypt for a cert, I ask for *.int.teuto.icu instead of specifically jellyfin.int.teuto.icu, that way I can use the same cert for any internally running service. Mostly I use SSL on everything to make browsers complain less. There isn't much security benefit on a local network. I suppose it makes harder to spoof on an external network, but I don't think that's a serious threat for a home net. I used to use home.lan for all of my services, but that has the drawback of redirecting to a search by default on most browsers. I have my tailscale exit node running on my router and it just works with SSL like anything else.
Ok so I currently have a cert set up to work with:
domain.com
www.domain.com (some browsers seemingly didn't like it if I didn't have www)
subdomain.domain.com
Are you saying I could just configure it like this:
domain.com
*.domain.com
The idea of not having to keep updating the cert with new subdomains (and potentially break something in the process) is really appealing
Yes. If you're using lets encrypt then note that they do not support wildcard certs with the HTTP-01 challenge type. You will need to use the DNS-01 challenge type. To utilize it you would need a domain registrar that supports api dns updates like cloudflare and then you can use the acme.sh package. Here is an example guide i found.
Note that you could still request multiple explicit subdomains in the same issue/renew commands so it's not a huge deal either way but the wildcard will be more seamless in the future if you don't know what other services you might want to selfhost.
awesome, thanks for the info