Selfhosted

Don't provide services to others, including your own family, actually especially your own family, until you are quite comfortable with what is going on and what might be causing issues. Focus on helping yourself or keeping whatever other services you were using before just in case.

Trying to fix something at night, with a fuming partner who's already put up with a difficult to use service, because of your want for privacy even though they don't care care, whilst saying "it should work, I don't know what's wrong", is not a great place to be 😁.

Overall though, I found it so interesting that I am doing a part time degree in computer science in my 30s, purely to learn more (whilst being forced to do it to timelines and having paid for it).

I have a very comfortable and 'forget about it' setup my family are now using. Every now and then I add new services for myself, and if it works out, will give access to others to use, keep it just for me or just delete it and move on.

I have multiple servers with about two dozen self-hosted services I run. It all started ten years ago, torrenting shows and then automating. And now everything in my life is self-hosted and backed up. But if I showed my current configuration to me 10 years ago, it would look undoable, completely out of reach. So my suggestion to you is to pick one project that you like, build it. Make mistakes. Fix those mistakes. If you want to access it from outside your network, use WireGuard so that nobody else can have access to your system and find your mistakes for you.

Don't ask for advice. Don't ask for opinions. That's like going into a religion conference and asking which is the right God. You're going to have a bunch of very passionate people telling you a bunch of things you don't understand when all you want to do is tinker. So fuck all those people, just start tinkering.

Finally, Don't host any mission critical shit until you have backups that are tested after multiple iterations. I have fucked up so bad that I have had to reformat discs. I have fucked up so bad that data has just gone missing. I have fucked up so bad that discs have overflowed with backups and corrupted the data and the backups themselves. It was all fun as shit. Because none of it was important. Everything important was somewhere else. The only rule is the 3-2-1 rule, otherwise go fuck up and come back when you dead end on an issue.

Pro tip, use ZFS and take snapshots before you make any changes. Then you can roll back your system if you fuck up. I just implemented it this year and it has saved me so many headaches.

Learn how to use Docker containers

It depends on what you're self-hosting and If you want / need it exposed to the Internet or not. When it comes to software the hype is currently setup a minimal Linux box (old computer, NAS, Raspberry Pi) and then install everything using Docker containers. I don't like this Docker trend because it 1) leads you towards a dependence on property repositories and 2) robs you from the experience of learning Linux (more here) but I it does lower the bar to newcomers and let's you setup something really fast. In my opinion you should be very skeptical about everything that is "sold to the masses", just go with a simple Debian system (command line only) SSH into it and install what you really need, take your time to learn Linux and whatnot. A few notable tools you may want to self-host include: Syncthing, FileBrowser, FreshRSS, Samba shares, Nginx etc. but all depends on your needs.

Strictly speaking about security: if we're talking about LAN only things are easy and you don't have much to worry about as everything will be inside your network thus protected by your router's NAT/Firewall.

For internet facing services your basic requirements are:

• Some kind of domain / subdomain payed or free;
• Preferably Home ISP that has provides public IP addresses - no CGNAT BS;
• Ideally a static IP at home, but you can do just fine with a dynamic DNS service such as https://freedns.afraid.org/.

Quick setup guide and checklist:

1. Create your subdomain for the dynamic DNS service https://freedns.afraid.org/ and install the daemon on the server - will update your domain with your dynamic IP when it changes;
2. List what ports you need remote access to;
3. Isolate the server from your main network as much as possible. If possible have then on a different public IP either using a VLAN or better yet with an entire physical network just for that - avoids VLAN hopping attacks and DDoS attacks to the server that will also take your internet down;
4. If you're using VLANs then configure your switch properly. Decent switches allows you to restrict the WebUI to a certain VLAN / physical port - this will make sure if your server is hacked they won't be able to access the Switch's UI and reconfigure their own port to access the entire network. Note that cheap TP-Link switches usually don't have a way to specify this;
5. Configure your ISP router to assign a static local IP to the server and port forward what's supposed to be exposed to the internet to the server;
6. Only expose required services (nginx, game server, program x) to the Internet us. Everything else such as SSH, configuration interfaces and whatnot can be moved to another private network and/or a WireGuard VPN you can connect to when you want to manage the server;
7. Use custom ports with 5 digits for everything - something like 23901 (up to 65535) to make your service(s) harder to find;
8. Disable IPv6? Might be easier than dealing with a dual stack firewall and/or other complexities;
9. Use nftables / iptables / another firewall and set it to drop everything but those ports you need for services and management VPN access to work - 10 minute guide;
10. Configure nftables to only allow traffic coming from public IP addresses (IPs outside your home network IP / VPN range) to the Wireguard or required services port - this will protect your server if by some mistake the router starts forwarding more traffic from the internet to the server than it should;
11. Configure nftables to restrict what countries are allowed to access your server. Most likely you only need to allow incoming connections from your country and more details here.

Realistically speaking if you're doing this just for a few friends why not require them to access the server through WireGuard VPN? This will reduce the risk a LOT and won't probably impact the performance. Here a decent setup guide and you might use this GUI to add/remove clients easily.

Don't be afraid to expose the Wireguard port because if someone tried to connect and they don't authenticate with the right key the server will silently drop the packets.

Now if your ISP doesn't provide you with a public IP / port forwarding abilities you may want to read this in order to find why you should avoid Cloudflare tunnels and how to setup and alternative / more private solution.

Honestly the single biggest thing to self-hosting is breaking stuff.

Host stuff that seems interesting to you, and dick around with it. If it breaks, read the logs and try to fix. If you can't, revert to a backup and try to reproduce.

If you start out with things that interest you, you'll more likely stick with the hobby. From there you can move to hosting things with external access - maybe vpn inside your own network through your router?

From there, get your security in line and host a basic webserver. Something small, low attack vector, and build on it. Then expand!

Definitely recommend docker to start with - specifically docker compose. Read the documentation and mess around!

First container I would host is portainer. General web admin/management panel for containers.

Good luck :).

Basic knowledge that makes selfhosting easier

1. Some networking basics (Firewall, VPN, NAT, DHCP, ARP, VLAN) makes every selfhosters life easier.
   1b. Your ISP router probably sucks, but you might be able to experiment with some static DHCP at least. I'm a fan of the BSD based routers opnsense/pfsense but depending on what router you have you might also be able to run OpenWrt on your existing router.
2. Some management system and filesharing basics (NFS, SMB, SSH, SCP and SFTP).
3. Learning how to set up a backup for your stuff. The hypervisor you choose may or may not have a built in solution.
4. Checking out a few different hypervisors (Proxmox, Incus, KVM/QEMU, etc) and find out which one you wanna dive deeper into.
   4b. Learn how to make a snapshot for easy rollback in said hypervisor ASAP. Being able to undo the last changes that broke a machine is a godsend.
   4c. VM, LXC, Docker and Podman basics (what are they, how do they differ, which one fits my usecase?)
   
   I know Flackbox has a good CCNA (networking) study guide on youtube, but that is way too in depth for a self hosting beginner.
   Here's some introduction to different parts of the network:
   Free CCNA 200-301 Course 06-05: IPv4 Addresses
   Free CCNA 200-301 Course 23-01: DHCP Introduction
   Free CCNA 200-301 Course 12-04: ARP Address Resolution Protocol
   Free CCNA 200-301 Course 21-01: VLANs Introduction
   Free CCNA 200-301 Course 21-04: Why we have VLANs

Be sure to make regular backups of your data.
... and using RAID is not a backup.

Separate everything into lab and production, starting with your network. Test everything in your lab, then move it to production when you've ironed out the kinks.

So setup an isolated network in your router (pretty much all can do it these days), and test everything there.

Alternatively, build an isolated test environment in a virtualization solution, like ESXi or Proxmox - though these are both advanced skillsets (or at least not beginner). ESXi is easier to learn than Proxmox, and you should still be able to get a copy.

Try things out. Get an old pc with some old hard drives no one will want and get to it!

Just install whatever on it and start asking yourself what you want to do with it.

I started on Ubuntu Server and ended up on Unraid. Caused alot of problems along the way but in the end I learned alot to where I dont stress too much when stuff goes south.

Also, when you truly do invest into a proper server. Consider the drives you are buying are gonna die one day. It may take years to happen but it will happen!

keep it simple ;)

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:

[Thread #600 for this sub, first seen 13th Mar 2024, 11:55] [FAQ] [Full list] [Contact] [Source code]

That depends. How new are you? What do you already know?

You don’t need to delve into networking too heavily at first. I recommend ProxMox as the most beginner friendly platform. It’s open source and based on Debian 12 underneath. That means that updates won’t hit you until they’ve been run in the wild for a while. This is what you want for a server.

It has a free backup server you can use to take automatic backups, and it can run virtual machines, lxc containers, and docker can be installed on an lxc or vm and you’re golden. If you install docker bare metal you limit yourself to docker.

The new SDN functionality also lets you make self-contained networks that isolate your vms. Couple with this opnsense eventually, and you can make a nice public setup and not worry too much about east west security.

Depends a bit on what you'd like to achieve. I'd say play around with YunoHost on a VPS to get started and learn more. With YunoHost you will get XMPP and email server after installation, and then you can start installing other YunoHost apps.

As another noob, Tailscale is great.

I've been playing with VPNs for a week or two, can't get anything running. Then I remembered I have Tailscale installed on my Home Assistant and I opened it up on my phone and connected up

And now I can access my network at work, and can use WhatsApp when I'm connected to works WiFi even though it's been blocked on their firewall.

I've just been listening to the Self Hosted podcast (who are sponsored by Tailscale) and learned that you can basically do networking with Tailscale by putting everything on the Tailnet. So now I'm going down that rabbit hole.

But I've run Home Assistant for years and used reverse proxies and Cloudflare to access it from outside my network, yet now I'm learning I can just have Tailscale on all the time on my phone and I'm on my own network wherever I am in the world, which is amazing considering I just put an add-on on my HA instance and scanned a QR code.