this post was submitted on 30 Jul 2024
158 points (92.0% liked)

Selfhosted

39937 readers
375 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

  1. Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.

  2. No spam posting.

  3. Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.

  4. Don't duplicate the full text of your blog or github here. Just post the link for folks to click.

  5. Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).

  6. No trolling.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 1 year ago
MODERATORS
 

I saw this post today on Reddit and was curious to see if views are similar here as they are there.

  1. What are the best benefits of self-hosting?
  2. What do you wish you would have known as a beginner starting out?
  3. What resources do you know of to help a non-computer-scientist/engineer get started in self-hosting?
you are viewing a single comment's thread
view the rest of the comments
[–] JustMarkov@lemmy.ml 17 points 3 months ago* (last edited 3 months ago) (5 children)

2.What do you wish you would have known as a beginner starting out?

Caddy. Once you try Caddy there's no turning back to Nginx or Apache.

[–] poVoq@slrpnk.net 14 points 3 months ago (4 children)

That's what everyone thinks for a while, and then they go back to Nginx.

Eh, my main reason for switching is that Caddy builds in LetsEncrypt. My Caddyfile is really simple, it's just a reverse proxy that handles TLS and proxies regular HTTP to my services. I don't have it serving any files or really knowing anything about the services. Here's my setup:

  1. HAProxy - directs subdomains to devices (in VPN) based on SNI
  2. Caddy - manages TLS and LetsEncrypt and communicates w/ services over HTTP
  3. Nginx - serves files for things like NextCloud, if needed (most services have their own HTTP server)

Each of these are separate Docker containers, which makes it really easy to manage and diagnose problems. The syntax for Nginx is more complex for 1&2, and the performance benefit of managing it all in one service just isn't relevant for a self-hosted system, so I use this layered approach that makes each level as simple as possible.

[–] keyez@lemmy.world 2 points 3 months ago

I went from NGinx to HAProxy for 5 years, now on Caddy for 2 and loving it. So much simpler and efficient.

[–] kadotux@sopuli.xyz 2 points 3 months ago (1 children)

As someone who just learned about Caddy, could you elaborate?

[–] poVoq@slrpnk.net 5 points 3 months ago* (last edited 3 months ago) (2 children)

You usually want less integration, not more. Simple self-contained things. Nginx is good at that. That's also why you don't want to use Nginx Proxy Manager or Certbot's Nginx integration etc. It first looks like they make it easier, but there is too much hidden complexity under the hood.

Also, sooner or later you will run into some software that you would really like to try, which is only documented for Nginx and uses some sort of image caching or so, that is hard to replicate with Caddy etc.

[–] Deemo@lemmy.world 2 points 3 months ago (1 children)

Certbot’s Nginx integration etc

How do you obtain ssl certs then?

[–] poVoq@slrpnk.net 1 points 3 months ago* (last edited 3 months ago) (1 children)

I switched to Dehydrated (with dns-01 challenge), but Certbot itself is fine, the problem is the Nginx integration that tries to automatically change your Nginx config files.

[–] Deemo@lemmy.world 2 points 3 months ago (1 children)

Do you manually update the config every 3 months?

[–] poVoq@slrpnk.net 1 points 3 months ago (1 children)

??? The location and the file name of the certificates don't change, so why would I have to do that?

On the contrary, before I disabled the certbot's Nginx integration, every three months certbot would "manage" to break my Nginx and I had to manually repair it.

I think we are not talking about the same thing. I mean the Certbot extension that automatically modifies the Nginx config files. A telltale sign are usually the comments "#managed by certbot” that it likes to leave behind all over your config files.

[–] Deemo@lemmy.world 1 points 3 months ago

I've only really use caddy and my only experience with ngnix is ngnix proxy manager (which isn't really true ngnix).

I wasn't sure if hot swapping certs (even with same name was possible, kinda thought you would to reload it upon cert change).

Also regarding cert bot I have only used it in manual mode so it's managed mode is a bit foreign.

[–] Zeoic@lemmy.world 1 points 3 months ago (1 children)

Not sure I agree about proxy manager. Anything you need to access is in the gui. You can easily add advanced configs to the entries. Been using it for 5 or so years, and there hasnt been anything I was missing from using straight nginx before that.

[–] towerful@programming.dev 2 points 3 months ago (1 children)

The benefit of using config files is easy version management via git.
Makes it easy to rebuild from scratch and easy to rollback a change that breaks something

[–] Zeoic@lemmy.world 1 points 3 months ago

Fair enough. I manage the same by backing up the vm its on.

[–] lemmyvore@feddit.nl 1 points 3 months ago (1 children)

I'm currently in the process of separating the certificate renewal service from the reverse proxy completely.

But if you're just starting out Nginx Proxy Manager makes it so easy.

[–] ahal@lemmy.ca 2 points 3 months ago (1 children)

Out of curiosity, what's the benefit of splitting those?

[–] lemmyvore@feddit.nl 3 points 3 months ago* (last edited 3 months ago) (1 children)

It lets you change reverse proxy or run a website with TLS completely independently of the certbot. The certbot deals with obtaining certs and leaves them in a dir, and the proxies or webservers just take them from that dir. If the proxy container breaks the certbot still does its thing etc.

It also makes it easier to do stuff like run different proxies in paralel for different things, chain proxies (for instance if you need to use a VPS because you can't forward ports) and so on.

But it's all for advanced setups, for basic stuff I'd still go with NPM.

[–] ahal@lemmy.ca 2 points 3 months ago

Cool makes sense, thanks for the reply! And yeah, I don't think I'm quite there yet.

[–] farcaller@fstab.sh 3 points 3 months ago

Apparently traefik might be better if you run docker compose and such, as it does auto-discovery, which reduces the amount of manual configuration required.

[–] Deemo@lemmy.world 2 points 3 months ago (1 children)

Silly question how safe are caddy plugins? (especially dns challenge modules like cloudflare, duckdns, etc).

https://github.com/caddy-dns https://github.com/caddy-dns/cloudflare/tree/master

Not sure if those plugins are covered by caddy's security disclosure policy

https://github.com/caddyserver/caddy/security

[–] xinayder@infosec.pub 1 points 3 months ago

I maintain the DNS plugin for Vultr and I can say that it's "safe", but if you're worried you should check their source code.

I believe it's easier to have a vulnerability in the external provider's API (for example, caddy-dns/vultr uses govultr) than Caddy. But I wouldn't take things for granted if I was skeptical about these plugins.

[–] Passerby6497@lemmy.world 2 points 3 months ago

LOL, as a noob I went with caddy, then traefik before settling on NPM. Ironically, all the "QoL" features people brag about just made base configs harder and lead to shit randomly failing.

NPM has been solid as a rock, even if I have to do slightly more work, it's more reliable and does what I want quicker and easier than the alternative.

[–] ahal@lemmy.ca 1 points 3 months ago

I've been meaning to try Caddy, but I just can't even imagine something simpler than NginxProxyManager.