[HN Gopher] CLI agents make self-hosting on a home server easier...
___________________________________________________________________
CLI agents make self-hosting on a home server easier and fun
Author : websku
Score : 727 points
Date : 2026-01-11 21:29 UTC (1 days ago)
(HTM) web link (fulghum.io)
(TXT) w3m dump (fulghum.io)
| simonw wrote:
| This posts lists inexpensive home servers, Tailscale and Claude
| Code as the big unlocks.
|
| I actually think Tailscale may be an even bigger deal here than
| sysadmin help from Claude Code at al.
|
| The biggest reason I had not to run a home server was security:
| I'm worried that I might fall behind on updates and end up
| compromised.
|
| Tailscale dramatically reduces this risk, because I can so easily
| configure it so my own devices can talk to my home server from
| anywhere in the world without the risk of exposing any ports on
| it directly to the internet.
|
| Being able to hit my home server directly from my iPhone via a
| tailnet no matter where in the world my iPhone might be is really
| cool.
| philips wrote:
| I agree! Before Tailscale I was completely skeptical of self
| hosting.
|
| Now I have tailscale on an old Kindle downloading epubs from a
| server running Copyparty. Its great!
| ryandrake wrote:
| Maybe I'm dumb, but I still don't quite understand the value-
| add of Tailscale over what Wireguard or some other VPN
| already provides. HN has tried to explain it to me but it
| just seems like sugar on top of a plain old VPN. Kind of like
| how "pi-hole" is just sugar on top of dnsmasq, and Plex is
| just sugar on top of file sharing.
| Skunkleton wrote:
| Yes, that is really all it is.
| mfcl wrote:
| It's plug and play.
| Forgeties79 wrote:
| And some people may not value that but a lot of people
| do. It's part of why Plex has become so popular and fewer
| people know about Jellyfin. One is turnkey, the other
| isn't.
|
| I could send a one page bullet point list of instructions
| to people with very modest computer literacy and they
| would be up and running in under an hour on all of their
| devices with Plex in and outside of their network. From
| that point forward it's basically like having your own
| Netflix.
| Jtsummers wrote:
| I think you answered the question. Sugar. It's easier than
| managing your own Wireguard connections. Adding a device
| just means logging into the Tailscale client, no need to
| distribute information to or from other devices. Get a new
| phone while traveling because yours was stolen? You can set
| up Tailscale and be back on your private network in a
| couple minutes.
|
| Why did people use Dropbox instead of setting up their own
| FTP servers? Because it was easier.
| johnisgood wrote:
| Yeah, but "people" here are alleged software engieners.
| It is quite disheartening.
| wiether wrote:
| First and foremost they are humans, with a limited time
| on Earth.
|
| Being a software engineer doesn't mean you want to spend
| you free time tinkering about your self-hosting setup and
| doing support for your users.
|
| With Tailscale, not only you don't have to care about
| most things since _it just works_, but also on-boarding
| of casual users is straightforward.
|
| Same goes for Plex. I want to watch movies/shows, I don't
| want to spend time tinkering with my setup. And Plex
| provides exactly that. Ditto for my family/friends that
| can access my library with the same simple experience as
| Netflix or whatever.
|
| Meanwhile, I have a coworker who want to own/manage
| everything. So they don't want to use Tailscale and they
| dropped Plex when they forced to use the third-party
| login system. Now they watch less than a third than they
| used to be, and they share their setup with nobody since
| it's too complicated to do.
|
| To each their own, but my goal is to enjoy my setup and
| share it with others. Tailscale and Plex give me that.
| johnisgood wrote:
| There is a difference between "I choose not to" and "I
| cannot". The thread is full of people saying Tailscale
| "unlocked" self-hosting, implying capability, not time
| savings or time preference.
|
| Choosing convenience is fine. But if basic port
| forwarding or WireGuard is beyond someone's skill set,
| "software engineer" is doing a lot of heavy lifting.
|
| I am not saying they are, but if it really is the case,
| then yeah.
|
| As for file sharing... I remember when non-SWEs knew how
| to torrent movies, used DC++ and so on. These days even
| SWEs have no idea how to do it. It is mind-boggling.
| wiether wrote:
| To me the "unlocked" is just another hyperbole used by
| some people, partly because they lack initial knowledge,
| partly because its click-bait.
|
| The way I understand it is more like "without the ease of
| use provided by X, even though I could have done it, I
| wouldn't have done it because it would require time and
| energy that I'm not willing to put in".
|
| Since we're talking about self-hosting, to me the main
| focus is not skill set but time and energy.
|
| There's the same debate around NAS products like Synology
| that are sold with a high markup, meanwhile "every SWE
| should be able to make their own NAS using recycled
| hardware".
|
| Sure. And I did all of this: - homemade NAS setup -
| homemade network setup - homemade mediaplayer setup
|
| It was fun and I learned a lot.
|
| But I moved to some more convenient tools so that I can
| just use them as reliable services, and focus on other
| experimentations/tinkering.
|
| To be honest, the fact that you insist that Plex is just
| "file sharing" that can be replaced by torrents makes me
| think you either don't know what Plex actually is, or you
| are acting in bad faith.
| johnisgood wrote:
| I did not say Plex is "just file sharing that can be
| replaced by torrents". Those were two separate points:
|
| 1. The "unlocked" framing implies capability, not time
| preference
|
| 2. General technical literacy has declined: non-SWEs used
| to torrent, use DC++ extensively, etc.
|
| I was not comparing Plex to torrenting. I was observing
| that basic file-sharing knowledge used to be common and
| now is not (see Netflix et al).
|
| > time and energy being the focus
|
| Sure, that is fair. But that is a different claim than
| "Tailscale unlocked self-hosting for me" which is how it
| is often framed.
| wiether wrote:
| Okay, maybe I misunderstood what you were saying then.
|
| But still, I insist that it's important to understand
| that, even if we share some similarities based on our
| interests/skills/work, we come from different backgrounds
| and have different priorities.
|
| And part of the issue here is probably how people are
| framing things when they write about their experience. In
| tech, some of us are coming from a world of nerds where
| the norm is to be mater-of-factly, while some others are
| more extroverted and tend to put emphasis on random
| boring things.
|
| Regarding this post in particular, I was more concerned
| about how the author was amazed by the fact that a 2025
| computer could run 10 services in parallel... or that
| relying on a proprietary service (Claude) to manage all
| their setup was giving them "a strong feeling of
| independence".
| epistasis wrote:
| Time savings and time preference are most definitely
| "unlocking." I have limited time, I have limited money, I
| have limited interest. Could I reinvent wheels instead of
| using existing software? Sure! But having that existing
| software definitely unlocks possibilities that would not
| be open to me if I were required to build, debug, test,
| and maintain everything I use day-to-day.
| duckmysick wrote:
| Software engineering is a broad spectrum where we can
| move up and down its abstraction ladder. Using off-the-
| shelf tools and even third-party providers is fine. I
| don't have to do everything from scratch - after all, I
| didn't write my own text editor. I'm also happy to
| download prepacked and preconfigured software on my Linux
| distro instead of compiling and adding them to PATH
| manually.
|
| I _could_ , I just choose not to and direct my interests
| elsewhere. Those interests can change over time too. One
| day someone with Tailscale can decide to explore
| Wireguard. Similarly, someone who runs their own mail
| server might decide to move to a hosted solution and do
| something else. That's perfectly fine.
|
| To me, this freedom of choice in software engineering is
| not disheartening. It's liberating and exciting.
| johnisgood wrote:
| That is a strawman though, and I am not sure why all
| replies assume extremes all the time.
|
| Nobody said do everything from scratch. The point is:
| basic networking (port forwarding, WireGuard) should not
| be beyond someone's capability as a software engineer.
|
| "I use apt instead of compiling" is a time tradeoff. "I
| can't configure a VPN" is a skill gap. These are not
| equivalent.
|
| If you choose convenience for whatever reasons, that is
| completely fine.
| mschild wrote:
| "I can't configure a VPN" and "I don't want to configure
| a VPN" are 2 entirely different things. Mind you I have
| no idea how complex tailscale setup is in comparison.
|
| I'm in the middle of setting up my own homeserver. Still
| deciding on what/if I want to expose to the internet and
| not just local network and while setting everything up
| and tinkering is part of the fun for me. I get some
| people just want results that they can rely on.
| Tailscale, while not a perfect option, is still an option
| and if they're fine with the risk profile I can
| understand sacrificing some security for it.
| johnisgood wrote:
| It seems like we do agree. :)
|
| For a homeserver:
|
| - SSH with key-only auth, exposed directly. This has
| worked for decades. Consider non-standard port to reduce
| log noise (not security, just quieter logs), fail2ban if
| you want
|
| - Access internal services via SSH tunnels or just work
| on the box directly
|
| - If exposing HTTP(S): reverse proxy (nginx/caddy) with
| TLS, rate limiting
|
| - Databases, admin panels, monitoring - access via SSH,
| not public (ideally)
|
| You do not need a VPN layer if you are comfortable with
| SSH. It has been battle-tested longer than most
| alternatives.
|
| The fun part of tinkering is also learning what is
| actually necessary vs. cargo-culted advice. You will find
| most "security hardening" guides are overkill for a
| homeserver with sensible defaults.
| duckmysick wrote:
| I'd argue that no, managing your own VPN is not a basic
| skill - certainly not in the realms of software
| engineering (more like network engineering).
| johnisgood wrote:
| WireGuard is ~10 lines of config and wg genkey. Calling
| that "network engineering" is a stretch.
|
| The siloing of basic infrastructure knowledge into "not
| my discipline" is part of the problem. Software gets
| deployed somewhere: understanding ports, keys, and
| routing at a basic level is not specialized knowledge.
|
| Honestly, if 10 lines of config is "network engineering",
| then the bar for software engineering has dropped
| considerably.
| InfinityByTen wrote:
| I am probably in the camp where I've found myself
| ovewhelmed with the amount of information about networks
| and I'm an alleged software engineer (without formal
| training in CS albeit).
|
| The 10 loc is not a valid measure.
|
| `sudo rm -rf /` is a 1 line of code. It's not the lines
| that are hard to wrap your brain around, it's the
| implication of the lines that really what we are talking
| about.
| johnisgood wrote:
| The rm -rf comparison is a bit dramatic. WireGuard's
| config is conceptually simple: your key, peer's key,
| endpoint, what IPs route through the tunnel. The
| "implications" are minimal. It is a point-to-point
| encrypted tunnel.
|
| Being overwhelmed by networking basics is worth
| addressing regardless. It comes up constantly: debugging
| connectivity, deployments, understanding why your app
| cannot reach a database. 30 minutes with the WireGuard
| docs would demystify it. The concepts are genuinely
| simple and worth 30 minutes to understand as it applies
| far beyond VPNs.
|
| I have become pragmatic too. I do not tinker for the sake
| of it anymore. But there is a difference between choosing
| convenience and lacking foundational knowledge. One is a
| time tradeoff, the other is a gap that will bite you
| eventually.
|
| And with LLMs, learning the basics is easier than ever.
| You can ask questions, get explanations, work through
| examples interactively. There is less excuse now to
| outsource or postpone foundational knowledge, not
| more[1].
|
| At some point it is just wanting the benefits without the
| investment. That is not pragmatism, it is hoping the gaps
| never matter. They usually do.
|
| [1] You can ask an LLM to do all of that for you and make
| it help you understand under less than 10 minutes!
| InfinityByTen wrote:
| I do agree on that using LLMs to demistify, learn and
| explore is better alternative than handing it off to go
| rouge on, is a better advice. That's how I used it last
| weekend and I think that's what I would advocate the
| usage instead of just letting YourFavouriteAI be the sys
| admin.
|
| My problem is not just networking knowledge. I genuinely
| faced issues with open source tools. Troubleshooting in
| the days of terrible search is also a major annoyance.
| Sometimes, it's just the case that some of the tools have
| evolved and the same commands don't work as did for
| someone in 2020 in some obscure forum. I remember those
| days of tinkering with linux and open source where you'd
| rely on a Samaritan (bless their soul) who said they'd go
| home and check up and update you.
|
| Claude suggested me Tailscale too, but I'm glad we're
| having this conversation (thanks for the tips btw), so
| that we don't follow hallucinations or bad advice by
| similarly trained agents. I'm cautiously positive, but I
| think there's still a case to go self hosted with AI
| assistance. I found myself looking at possibilities
| rather than fearing dead ends and time black holes.
| johnisgood wrote:
| Thank you for your reply!
|
| I am glad that it is useful to you! The "terrible search
| + outdated forum posts" problem is real for sure. LLMs
| genuinely help there by synthesizing across versions and
| explaining what changed.
|
| I would say that self-hosting with AI assistance is the
| right approach. Use it to understand, not to blindly
| execute. Trust me, it is not much of a deal and you will
| be happy to have gone with this route afterwards!
|
| Good luck with the setup. If you have any questions, let
| me know, I am always happy to help.
|
| (I have very briefly mentioned some stuff here:
| https://news.ycombinator.com/item?id=46586406 but I can
| expand and be a bit more detailed as needed.)
| atmosx wrote:
| You don't have to run the control plane and you don't have
| to manage DNS & SSL keys for the DNS entries. Additionally
| the RBAC is pretty easy.
|
| All these are manageable through other tools, but it's more
| complicated stack to keep up.
| Frotag wrote:
| I always assumed it was because a lot of ISPs use CGNAT and
| using tailscale servers for hole punching is (slightly)
| easier than renting and configuring a VPS.
| Cyph0n wrote:
| It's a bit more than sugar.
|
| 1. 1-command (or step) to have a new device join your
| network. Wireguard configs and interfaces managed on your
| behalf.
|
| 2. ACLs that allow you to have fine grained control over
| connectivity. For example, server A should never be able to
| talk to server B.
|
| 3. NAT is handled completely transparently.
|
| 4. SSO and other niceties.
|
| For me, (1) and (2) in particular make it a huge value add
| over managing Wireguard setup, configs, and firewall rules
| manually.
| drnick1 wrote:
| > Kind of like how "pi-hole" is just sugar on top of
| dnsmasq, and Plex is just sugar on top of file sharing.
|
| Speaking of that, I have always preferred a plain Unbound
| instance and a Samba server over fancier alternatives. I
| guess I like my setups extremely barebone.
| ryandrake wrote:
| Yea, my philosophy for self-hosting is "use the smallest
| amount of software you can in order to do what you really
| need." So for me, sugar X on top of fundamental
| functionality Y is always rejected in favor of just
| configuring Y."
| simonw wrote:
| If you're confident that you know how to securely configure
| and use Wireguard across multiple devices then great, you
| probably don't need Tailscale for a home lab.
|
| Tailscale gives me an app I can install on my iPhone and my
| Mac and a service I can install on pretty much any Linux
| device imaginable. I sign into each of those apps once and
| I'm done.
|
| The first time I set it up that took less than five minutes
| from idea to now-my-devices-are-securely-networked.
| zeroxfe wrote:
| > Plex is just sugar on top of file sharing.
|
| right, like browsers are just sugar on top of curl
| edoceo wrote:
| curl is just sugar on sockets ;)
| epistasis wrote:
| SSH is just sugar on top of telnet and running your own
| encryption algorithms by hand on paper and typing in the
| results.
| InfinityByTen wrote:
| At least postman is :P
| SchemaLoad wrote:
| Tailscale is Wireguard but it automatically sets everything
| up for you, handles DDNS, can punch through NAT and CGNAT,
| etc. It's also running a Wireguard server on every device
| so rather than having a hub server in the LAN, it directly
| connects to every device. Particularly helpful if it's not
| just one LAN you are trying to connect to, but you have
| lots of devices in different areas.
| lelandbatey wrote:
| If Plex is "just file sharing" then I guarantee you'd find
| Tailscale "just WireGuard".
|
| I enjoy that relative "normies" can depend on it/integrate
| it without me having to go through annoying bits. I like
| that it "just works" without requiring loads of annoying
| networking.
|
| For example, my aging mother just got a replacement
| computer and I am able to make it easy to access and
| remotely administer by just putting Tailscale on it, and
| have that work seamlessly with my other devices and
| connections. If one day I want to fully self-host, then I
| can run Headscale.
| navigate8310 wrote:
| Tailscale is able to punch holes in CGNAT which a vanilla
| wireguard cannot
| BatteryMountain wrote:
| Setting up wireguard manually can be a pain in the butt
| sometimes. Tailscale makes it super easy but then your info
| flows through their nodes.
| tech_ken wrote:
| Managing the wg.conf is a colossal PITA, especially if I'm
| trying to like provision a new client and don't have access
| to my main laptop. It's crying out for a CRUD app on top of
| it, and I think tailscale is basically that plus a little.
| The value add seems obvious.
|
| Also plex is way more than sugar on top of file sharing;
| it's like filesharing, media management, and a CDN rolled
| into one product. Soulseek isn't going to handle
| transcoding for you.
| epistasis wrote:
| I use Tailscale for exactly those reasons, plus the easy
| SSL certificates and clients for Android and iOS.
|
| From this thread, I've learned about Pangolin:
|
| https://github.com/fosrl/pangolin
|
| Which seems very compelling to me too. If it has apps
| that allow various devices connect to the VPN it might be
| worth it to me to trial using it instead of Tailscale...
| dangoodmanUT wrote:
| definitely, but to be fair, beyond that it's just linux. Most
| people would need claude code to get what ever they want to use
| linux for running reliably (systemd service, etc.)
| dangoodmanUT wrote:
| i'm still waiting for ECC minipcs, then i'll go all in on
| local DBs too
| aaronax wrote:
| Supermicro has some low power options such as
| https://www.supermicro.com/en/products/system/Mini-
| ITX/SYS-E...
| drnick1 wrote:
| I'd rather expose a Wireguard port and control my keys than
| introduce a third party like Tailscale.
|
| I am not sure why people are so afraid of exposing ports. I
| have dozens of ports open on my server including SMTP, IMAP(S),
| HTTP(S), various game servers and don't see a problem with
| that. I can't rule out a vulnerability somewhere but services
| are containerized and/or run as separate UNIX users. It's the
| way the Internet is meant to work.
| CSSer wrote:
| The answer is people who don't truly understand the way it
| works being in charge of others who also don't in different
| ways. In the best case, there's an under resourced and over
| leveraged security team issuing overzealous edicts with the
| desperate hope of avoiding some disaster. When the sample
| size is one, it's easy to look at it and come to your
| conclusion.
|
| In every case where a third party is involved, someone is
| either providing a service, plugging a knowledge gap, or
| both.
| sauercrowd wrote:
| People are not full time maintainers of their infra though,
| that's very different to companies.
|
| In many cases they want something that works, not something
| that requires a complex setup that needs to be well
| researched and understood.
| buildfocus wrote:
| Wireguard is _really_ simple in that sense though. If
| you're not doing anything complicated it's very easy to set
| up & maintain, and basically just works.
|
| You can also buy quite a few routers now that have it built
| in, so you literally just tick a checkbox, then scan a QR
| code/copy a file to each client device, done.
| vladvasiliu wrote:
| This may come with its own limitations, though.
|
| My ISP-provided router (Free, in France) has WG built-in.
| But other than performance being abysmal, its main pain
| point is not supporting subnet routing.
|
| So if all you want is to connect your phone / laptop
| while away to the local home network, it's fine. If you
| want to run a tunnel between two locations with multiple
| IPs on the remote side, you're SoL.
| Topgamer7 wrote:
| I don't have a static IP, so tailscale is convenient. And
| less likely to fail when I really need it, as apposed to
| trying to deal with dynamic dns.
| heavyset_go wrote:
| > _I 'd rather expose a Wireguard port and control my keys
| than introduce a third party like Tailscale._
|
| This is what I do. You can do Tailscale like access using
| things like Pangolin[0].
|
| You can also use a bastion host, or block all ports and set
| up Tor or i2p, and then anyone that even wants to talk to
| your server will need to know cryptographic keys to route
| traffic to it at all, on top of your SSH/WG/etc keys.
|
| > _I am not sure why people are so afraid of exposing ports.
| I have dozens of ports open on my server including SMTP,
| IMAP(S), HTTP(S), various game servers and don 't see a
| problem with that._
|
| This is what I don't do. Anything that needs real internet
| access like mail, raw web access, etc gets its own VPS where
| an attack will stay isolated, which is important as more
| self-hosted services are implemented using things like React
| and Next[1].
|
| [0] https://github.com/fosrl/pangolin
|
| [1] https://news.ycombinator.com/item?id=46136026
| edoceo wrote:
| Is a container not enough isolation? I do SSH to the host
| (alt-port) and then services in containers (mail, http)
| heavyset_go wrote:
| Depends on your risk tolerance.
|
| I personally wouldn't trust a machine if a container was
| exploited on it, you don't know if there were any
| successful container escapes, kernel exploits, etc. Even
| if they escaped with user permissions, that can fill your
| box with boobytraps if they have container-granted
| capabilities.
|
| I'd just prefer to nuke the VPS entirely and start over
| than worry if the server and the rest of my services are
| okay.
| Imustaskforhelp wrote:
| Yea I feel that too.
|
| there are some well respected compute providers as well
| which you can use and for very low amount, you can sort
| of offload this worry to someone else.
|
| That being said, VM themselves are good enough security
| box too. I consider running VM's even on your home server
| with public facing strategies usually allowable
| heavyset_go wrote:
| Yeah, I only run very little on VPS, so this is
| practically free to me. Everything else I host at home
| behind Wireguard w/ Pangolin.
| Imustaskforhelp wrote:
| I understand where you are coming from but no, containers
| aren't enough isolation.
|
| If you are running some public service, it might have
| bugs and of course we see some RCE issues as well or
| there can be some misconfig and containers by default
| dont provide enough security if an hacker tries to break
| in. Containers aren't secure in that sense.
|
| Virtual machines are the intended use case for that. But
| they can be full of friction at time.
|
| If you want something of a middle compromise, I can't
| recommend incus enough.
| https://linuxcontainers.org/incus/
|
| It allows you to setup vm's as containers and even
| provides a web ui and provides the amount of isolation
| that you can trust (usually) everything on.
|
| I'd say to not take chances with your home server because
| that server can be inside your firewall and can infect on
| a worst case scenario other devices but virtualization
| with things like incus or proxmox (another well respected
| tool) are the safest and provide isolation that you can
| trust with. I highly recommend that you should take a
| look at it if you deploy public serving services.
| esseph wrote:
| With ports you have dozens or hundreds of applications and
| systems to attack.
|
| With tailscale / zerotier / etc the connection is initiated
| from inside to facilitate NAT hole punching and work over
| CGNAT.
|
| With wireguard that removes a lot of attack surfaces but
| wouldn't work if behind CGNAT without a relay box.
| SchemaLoad wrote:
| If you expose ports, literally everything you are hosting and
| every plugin is an attack surface. Most of this stuff is
| built by single hobbiest devs on the weekend. You are also
| exposed to any security issues you make in your
| configuration. My first attempt self hosting I had redis
| compromised because I didn't realise I had exposed it to the
| internet with no password.
|
| Behind a VPN your only attack surface is the VPN which is
| generally very well secured.
| sva_ wrote:
| You exposed your redis publicly? Why?
|
| Edit: This is the kind of service that you should only
| expose to your intranet, i.e. a network that is protected
| through wireguard. NEVER expose this publicly, even if you
| don't have admin:admin credtials.
| SchemaLoad wrote:
| I actually didn't know I had. At the time I didn't
| properly know how docker networking worked and I exposed
| redis to the host so my other containers could access it.
| And then since this was on a VPS with a dedicated IP,
| this made it exposed to the whole internet.
|
| I now know better, but there are still a million other
| pitfalls to fall in to if you are not a full time system
| admin. So I prefer to just put it all behind a VPN and
| know that it's safe.
| drnick1 wrote:
| > but there are still a million other pitfalls to fall in
| to if you are not a full time system admin.
|
| Pro tip: After you configure a new service, review the
| output of ss -tulpn. This will tell you what ports are
| open. You should know exactly what each line represents,
| especially those that bind on 0.0.0.0 or [::] or other
| public addresses.
|
| The pitfall that you mentioned (Docker automatically
| punching a hole in the firewall for the services that it
| manages when an interface isn't specified) is
| discoverable this way.
| jsrcout wrote:
| Thanks, didn't know about this one.
| vladvasiliu wrote:
| Isn't GP's point _inadvertently_ exposing stuff? Just
| mention docker networking on HN and you 'll get
| threadfuls of comments on how it helpfully messes with
| your networking without telling you. Maybe redis does the
| same?
|
| I mitigate this by having a dedicated machine on the
| border that only does routing and firewalling, with no
| random services installed. So anything that helpfully
| opens ports on internal vms won't automatically be
| reachable from the outside.
| Jach wrote:
| I have a VPS with OVH, I put Tailscale on it and it's
| pretty cool to be able to install and access local (to the
| server) services like Prometheus and Grafana without having
| to expose them through the public net firewall or mess with
| more apache/nginx reverse proxies. (Same for individual
| services' /metrics endpoints that are served with a
| different port.)
| buran77 wrote:
| > I'd rather expose a Wireguard port and control my keys than
| introduce a third party like Tailscale.
|
| Ideal if you have the resources (time, money, expertise).
| There are different levels of qualifications, convenience,
| and trust that shape what people can and will deploy. This
| defines where you draw the line - at owning every binary of
| every service you use, at compiling the binaries yourself, at
| checking the code that you compile.
|
| > I am not sure why people are so afraid of exposing ports
|
| It's simple, you increase your attack surface, and the effort
| and expertise needed to mitigate that.
|
| > It's the way the Internet is meant to work.
|
| Along with no passwords or security. There's no prescribed
| way for how to use the internet. If you're serving one person
| or household rather than the whole internet, then why expose
| more than you need out of some misguided principle about the
| internet? Principle of least privilege, it's how security is
| meant to work.
| lmm wrote:
| > It's simple, you increase your attack surface, and the
| effort and expertise needed to mitigate that.
|
| Sure, but opening up one port is a much smaller surface
| than exposing yourself to a whole cloud hosting company.
| appplication wrote:
| Ah... I really could not disagree more with that
| statement. I know we don't want to trust BigCorp and
| whatnot, but a single exposed port and an incomplete
| understanding of what you're doing is really all it takes
| to be compromised.
| SchemaLoad wrote:
| Even if you understand what you are doing, you are still
| exposed to every single security bug in all of the
| services you host. Most of these self hosted tools have
| not been through 1% of the security testing big tech
| services have.
| johnisgood wrote:
| Now you are exposed to every security bug in Tailscale's
| client, DERP relays, and coordination plane, plus you
| have added a trust dependency on infrastructure you do
| not control. The attack surface did not shrink, it
| shifted.
| bjt12345 wrote:
| How would another service be impacted by an open UDP port
| on a server that the service is not using?
| IgorPartola wrote:
| For every remote exploit and cloud-wide outage that has
| happened over the past 20 years my sshd that is exposed
| to the internet on port 22 has had zero of either. There
| were a couple of major OpenSSH bugs but my auto updater
| took care of that before I saw it on the news.
|
| You can trust BugCorp all you want but there are more
| sshd processes out there than tailnets and the scrutiny
| is on OpenSSH. We are not comparing sshd to say WordPress
| here. Maybe when you don't over engineer a solution you
| don't need to spend 100x the resources auditing it...
| lillecarl wrote:
| If you only expose SSH then you're fine, but if you're
| deploying a bunch of WebApps you might not want them
| accessible on the internet.
|
| The few things I self host I keep out in the open. etcd,
| Kubernetes, Postgres, pgAdmin, Grafana and Keycloak but I
| can see why someone would want to hide inside a private
| network.
| IgorPartola wrote:
| Yeah any web app that is meant to be private is not
| something I allow to be accessible from the outside
| world. Easy enough to do this with ssh tunnels OR
| Wireguard, both of which I trust a lot more than anything
| that got VC funding. Plus that way any downtime is my own
| doing and in my control to fix.
| refulgentis wrote:
| This felt like it didn't do your aim justice, "$X and an
| incomplete understanding of what you're doing is all it
| takes to be compromised" applies to many $X, including
| Tailscale.
| justinparus wrote:
| Using a BigCorp service also has risks. You are exposed
| to many of their vulnerabilities, that's why our
| information ends up in data leaks.
| johnisgood wrote:
| Same applies to Tailscale. A Tailscale client,
| coordination plane vulnerability, or incomplete
| understanding of their trust model is also all it takes.
| You are adding attack surface, not removing it.
|
| If your threat model includes "OpenSSH might have an RCE"
| then "Tailscale might have an RCE" belongs there too.
|
| If you are exposing a handful of hardened services on
| infrastructure you control, Tailscale adds complexity for
| no gain. If you are connecting machines across networks
| you do not control, or want zero-config access to
| internal services, then I can see its appeal.
| b112 wrote:
| There was a time when people were allowed to drive cars
| unlicensed.
|
| These days, that seems insane.
|
| As the traffic grew, as speeds increased, licensing
| became necessary.
|
| I think, these days, we're almost into that category. I
| don't say this happily. But having unrestricted access
| seems like an era coming to an end.
|
| I realise this seems unworkable. But so was the idea of a
| driver's license. Sometimes society and safety comes
| first.
|
| I'm willing to bet that in under a decade, something akin
| to this will happen.
| yreg wrote:
| Can you be more concrete what do you predict?
| mpalmer wrote:
| I'll take this to mean that you think arbitrary access to
| a computer's capabilities will require licensure, in
| which case I think this is a bad metaphor.
|
| The point of a driver's license is that driving a ton of
| steel around at >50mph presents risk of harm to _others_.
|
| Not knowing how to use a computer - driving it "poorly" -
| does not risk harm to others. Why does it merit
| restriction, based on the topic of this post?
| oarsinsync wrote:
| Your unpatched Wordpress install is someone else's botnet
| host, forming part of the "distributed" in DDoS, which
| harms others.
|
| It's why Cloudflare exists, which in itself is another
| form of harm, in centralising a decentralised network.
| johnisgood wrote:
| The argument is self-defeating:
|
| 1. "Unpatched servers become botnet hosts" - true, but
| Tailscale does not prevent this. A compromised machine on
| your tailnet is still compromised. The botnet argument
| applies regardless of how you access your server.
|
| 2. Following this logic, you would need to license all
| internet-connected devices: phones, smart TVs, IoT. They
| get pwned and join botnets constantly. Are we licensing
| grandma's router?
|
| 3. The Cloudflare point undermines the argument: "botnets
| cause centralization (Cloudflare), which is harm", so the
| solution is... licensing, which would centralize
| infrastructure further? That is the same outcome being
| called harmful.
|
| 4. Corporate servers get compromised constantly. Should
| only "licensed" corporations run services? They already
| are, and they are not doing better.
|
| Back to the topic: I have no clue what you think
| Tailscale is, but it does increase security, only
| convenience.
| johnisgood wrote:
| I meant: does _not_ increase security.
| oarsinsync wrote:
| The comment I was replying to was claiming that using
| your computer 'poorly' does not harm others. I was simply
| refuting that. Having spent the last two decades null
| routing customer servers when they decide to join an
| attack, this isn't theoretical.
|
| As an aside, I dislike tailscale, and use wireguard
| directly.
|
| Back to the topic: Your connected device can harm others
| if used poorly. I am not proposing licensing
| requirements.
| mpalmer wrote:
| I would detest living in a world where regulators assign
| liability in this way, it sounds completely ridiculous.
| On a level with "speech is violence".
| sejje wrote:
| If I threw my license away tomorrow, what would be insane
| about me driving without a license?
|
| Are you saying "unlicensed" where you mean "untrained?"
| b112 wrote:
| The point of massive fines, and in some cases jailtime
| for driving without a license is control.
|
| If someone breaks regs, you want to be able to levy fines
| or jail. If they do it a lot, you want an inability to
| drive at all.
|
| It's about regulating poor drivers. And yes, initially
| vetting a driver too.
| sejje wrote:
| I don't really know any adults who don't drive, and
| nobody ever told me they weren't capable.
|
| I don't think it's about driving ability, besides the
| initial vetting.
| johnisgood wrote:
| I am ~30 years old and I do not drive. In fact, I cannot
| drive.
| b112 wrote:
| From the perspective of those writing the regs, speeding,
| running lights, driving carelessly or dangerously (all
| fines or crimes here) are indeed indicators of safe
| driving or not.
|
| Understand, I am not advocating this. I said I did not
| like it. Neirher of those statements have anything totk
| do with whether I think it will come to pass, or not.
| heavyset_go wrote:
| Someone would need your 256-bit key to do anything to an
| exposed Wireguard port.
| eqvinox wrote:
| In theory.
|
| In the same theory, someone would need your EC SSH key to
| do anything with an exposed SSH port.
|
| Practice is a separate question.
| bjt12345 wrote:
| SSH is TCP though and the outside world can initiate a
| handshake, the point being that wireguard silently
| discards unauthenticated traffic - there's no way they
| can know the port is open for listening.
| JasonADrury wrote:
| Not even remotely comparable.
|
| Wireguard is explicitly designed to not allow
| unauthenticated users to do anything, whereas SSH is
| explicitly designed to allow unauthenticated users to do
| a whole lot of things.
| xnickb wrote:
| Headscale is a thing
| prmoustache wrote:
| Headscale is only really useful if you need to manage
| multiple users and/or networks. If you only have one
| network you want to have access to and a small number of
| users/devices it only increases the attack surface over
| having one wireguard listening because it has more moving
| parts.
| mfru wrote:
| I think the most important thing about Tailscale is how
| accessible it is. Is there a GUI for Wireguard that lets
| me configure my whole private network as easily as
| Tailscale does?
| ErneX wrote:
| I set it up to open the port for few secs via port
| knocking. Plus another script that runs on the server
| that opens connections to my home ip addr doing reverse
| lookup to a domain my router updates via dyndns so
| devices at my home don't need to port knock to connect.
| prmoustache wrote:
| > Ideal if you have the resources (time, money, expertise).
| There are different levels of qualifications, convenience,
| and trust that shape what people can and will deploy. This
| defines where you draw the line - at owning every binary of
| every service you use, at compiling the binaries yourself,
| at checking the code that you compile.
|
| Wireguard is distributed by distros in official packages.
| You don't need time, money and expertise to setup
| unattended upgrades with auto reboot on a debian or redhat
| based distro. At least it is not more complicated than
| setting an AI agent.
| madeofpalk wrote:
| What about SMTP, IMAP(S), HTTP(S), various game servers
| parent mentioned have open ports for?
|
| Having a single port open for VPN access seems okay for
| me. That's what I did, But I don't want an "etc" involved
| in what has direct access to hardware/services in my
| house from outside.
| bjt12345 wrote:
| How does wireguard interfere with email?
| observationist wrote:
| This is where using frontier models can help - You can have
| them assist with configuring and operating wireguard nearly
| as easily as you can have them walk you through Tailscale,
| eliminating the need for a middleman.
|
| The mid-level and free tiers aren't necessarily going to
| help, but the Pro/Max/Heavy tier can absolutely make
| setting up and using wireguard and having a reasonably
| secure environment practical and easy.
|
| You can also have the high tier models help with things
| like operating a FreePBX server and VOIP, manage a private
| domain, and all sorts of things that require domain
| expertise to do well, but are often out of reach for people
| who haven't gotten the requisite hands on experience and
| training.
|
| I'd say that going through the process of setting up your
| self hosting environment, then after the fact asking the
| language model "This is my environment: blah, a, b, c, x,
| y, z, blah, blah. What simple things can I do to make it
| more secure?"
|
| And then repeating that exercise - create a chatgpt
| project, or codex repo, or claude or grok project, wherein
| you have the model do a thorough interrogation of you to
| lay out and document your environment. With that done, you
| condense it to a prompt, and operate within the context
| where your network is documented. Then you can easily
| iterate and improve.
|
| Something like this isn't going to take more than a few 15
| minute weekend sessions each month after initially setting
| it up, and it's going to be a lot more secure than the
| average, completely unattended, default settings consumer
| network.
|
| You could try to yolo it with Operator or an elevated MCP
| interface with your system, but the point is, those high
| tier models are sufficiently good enough to make
| significant self hosting easily achievable.
| zamadatix wrote:
| It's the way the internet was meant to work but it doesn't
| make it any easier. Even when everything is in
| containers/VMs/users, if you don't put a decent amount of
| additional effort into automatic updates and keeping that
| context hardened as you tinker with it it's quite annoying
| when it gets pwned.
|
| There was a popular post less than a month ago about this
| recently https://news.ycombinator.com/item?id=46305585
|
| I agree maintaining wireguard is a good compromise. It may
| not be "the way the internet was intended to work" but it
| lets you keep something which feels very close without
| relying on a 3rd party or exposing everything directly. On
| top of that, it's really not any more work than Tailscale to
| maintain.
| SoftTalker wrote:
| I just run an SSH server and forward local ports through
| that as needed. Simple (at least to me).
| zamadatix wrote:
| I do that as well, along with using sshd as a SOCKS proxy
| for web based stuff via Firefox, but it can be a bit of a
| pain to forward each service to each host individually if
| you have more than a few things going on - especially if
| you have things trying to use the same port and need to
| keep track of how you mapped it locally. It can also a
| lot harder to manage on mobile devices, e.g. say you have
| some media or home automation services - they won't be as
| easy to access via a single public SSH host via port
| forwarding (if at all) as a VPN would be, and wireguard
| is about as easy a personal VPN as there is.
|
| That's where wg/Tailscale come in - it's just a
| traditional IP network at that point. Also less to do to
| shut up bad login attempts from spam bots and such. I
| once forgot to configure the log settings on sshd and
| ended up with GBs of logs in a week.
|
| The other big upside (outside of not having a 3rd party)
| in putting in the slightly more effort to do wg/ssh/other
| personal VPN is the latency+bandwidth to your home
| services will be better.
| jmb99 wrote:
| > and wireguard is about as easy a personal VPN as there
| is.
|
| I would argue OpenVPN is easier. I currently run both
| (there are some networks I can't use UDP on, and I
| haven't bothered figuring out how to get wireguard to
| work with TCP), and the OpenVPN initial configuration was
| easier, as is adding clients (DHCP, pre-shared
| cert+username/password).
|
| This isn't to say wireguard is hard. But imo OpenVPN is
| still easier - and it works _everywhere_ out of the box.
| (The exception is networks that only let you talk on 80
| and 443, but you can solve that by hosting OpenVPN on
| 443, in my experience.)
|
| This is all based on my experience with opnsense as the
| vpn host (+router/firewall/DNS/DHCP). Maybe it would be a
| different story if I was trying to run the VPN server on
| a machine behind my router, but I have no reason to do so
| - I get at least 500Mbps symmetrical through OpenVPN, and
| that's just the fastest network I've tested a client on.
| And even if that is the limit, that's good enough for me,
| I don't need faster throughput on my VPN since I'm almost
| always going to be latency limited.
| Imustaskforhelp wrote:
| Also to Simon: I am not sure about how Iphone works but
| in android, you could probably use mosh and termux to
| then connect to the server as well and have the end
| result while not relying on third party (in this case
| tailscale)
|
| I am sure there must be an Iphone app which could
| probably allow something like this too. I highly
| recommend more people take a look into such workflow, I
| might look into it more myself.
|
| Tmate is a wonderful service if you have home networks
| behind nat's.
|
| I personally like using the hosted instance of tmate
| (tmate.io) itself but It can be self hosted and is open
| source
|
| Once again it has third party issue but luckily it can be
| self hosted so you can even have a mini vps on
| hetzner/upcloud/ovh and route traffic through that by
| hosting tmate there so ymmv
| Rebelgecko wrote:
| How many random people do you have hitting port 22 on a
| given day?
| SoftTalker wrote:
| Dozens. Maybe hundreds. But they can't get in as they
| don't have the key.
| gsich wrote:
| change port.
| sally_glance wrote:
| Underrated reply - I randomize the default ports
| everywhere I can, really cuts down on brute
| force/credential stuffing attempts.
| Maledictus wrote:
| or keep the port and move to IPv6 only.
| lee_ars wrote:
| After years of cargo-culting this advice--"run ssh on a
| nonstandard port"--I gave up and reverted to 22 because
| ssh being on nonstandard ports didn't change the volume
| of access attempts in the slightest. It was thousands per
| day on port 22, and thousands per day on port anything-
| else-i-changed-it-to.
|
| It's worth an assessment of what you _think_ running ssh
| on a nonstandard port protects you against, and what it's
| actually doing. It won't stop anything other than the
| lightest and most casual script-based shotgun attacks,
| and it won't help you if someone is attempting to exploit
| an actual-for-real vuln in the ssh authentication or
| login process. And although I'm aware the plural of
| "anecdote" isn't "data," it sure as hell didn't reduce
| the volume of login attempts.
|
| Public key-only auth + strict allowlists will do a lot
| more for your security posture. If you feel like ssh is
| using enough CPU rejecting bad login attempts to actually
| make you notice, stick it behind wireguard or set up
| port-knocking.
|
| And sure, put it on a nonstandard port, if it makes you
| feel better. But it doesn't really do much, and anyone
| hitting your host up with censys.io or any other
| assessment tool will see your nonstandard ssh port
| instantly.
| wasmitnetzen wrote:
| Conversely, what do you gain by using a standard port?
|
| Now, I do agree a non-standard port is not a security
| tool, but it doesn't hurt running a random high-number
| port.
| lee_ars wrote:
| > Conversely, what do you gain by using a standard port?
|
| One less setup step in the runbook, one less thing to
| remember. But I agree, it doesn't hurt! It just doesn't
| really help, either.
| Rebelgecko wrote:
| I've tried using a nonstandard port but I still see a
| bunch of IPs getting banned, with the added downside of
| if I'm on the go sometimes I don't remember the port
| drnick1 wrote:
| > There was a popular post less than a month ago about this
| recently https://news.ycombinator.com/item?id=46305585
|
| This incident precisely shows that containerization worked
| as intended and protected the host.
| zamadatix wrote:
| It protected the host itself but it did not protect the
| server from being compromised and running malware, mining
| cryptocurrency.
|
| Containerizing your publicly exposed service will also
| not protect your HTTP server from hosting malware or your
| SMTP server from sending SPAM, it only means you've
| protected your SMTP server from your compromised HTTP
| server (assuming you've even locked it down accurately,
| which is exactly the kind of thing people don't want to
| be worried about).
|
| Tailscale puts the protection of the public portion of
| the story to a company dedicated to keeping that portion
| secure. Wireguard (or similar) limit the protection to a
| single service with low churn and minimal attack surface.
| It's a very different discussion than preventing lateral
| movement alone. And that all goes without mentioning not
| everyone wants to deal with containers in the first place
| (though many do in either scenario).
| nobody9999 wrote:
| >It's the way the internet was meant to work but it doesn't
| make it any easier. Even when everything is in
| containers/VMs/users, if you don't put a decent amount of
| additional effort into automatic updates and keeping that
| context hardened as you tinker with it it's quite annoying
| when it gets pwned.
|
| As someone who spent _decades_ implementing and securing
| networks and internet-facing services for corporations
| large and small as well as self-hosting my own services for
| much of that time, the primary lesson I 've learned and
| tried to pass on to clients, colleagues and family is:
| If you expose it to the Internet, assume it will be pwned
| at some point.
|
| No, that's not _universally_ true. But it 's a smart
| assumption to make for several reasons:
|
| 1. No software is completely bug free and those bugs can
| expose your service(s) to compromise;
|
| 2. Humans (and their creations) are imperfect and _will_
| make mistakes -- possibly exposing your service(s) to
| compromise;
|
| 3. Bad actors, ranging from marginally competent script
| kiddies to master crackers with big salaries and big
| budgets from governments and criminal organizations are out
| there 24x7 trying to break into whatever systems they can
| reach.
|
| The above applies just as much to tailscale or wireguard as
| it does to ssh/http(s)/imap/smtp/etc.
|
| I'll say it again as it's possibly the _most_ important
| concept related to exposing _anything_ :
| If you expose it to the Internet, assume that, at some
| point, it will be compromised and plan accordingly.
|
| If you're lucky (and good), it may not happen while you're
| responsible for it, but assuming it will and having a plan
| to mitigate/control an "inevitable" compromise will save
| your bacon much better than _just_ relying on someone else
| 's code to _never_ break or have bugs which put you at
| risk.
|
| Want to expose ports? Use Wireguard? Tailscale? HAProxy? Go
| for it.
|
| And do so in ways that meet your requirements/use cases.
| But don't forget to at least _think_ (better yet script
| /document) about what you will do if your services are
| compromised.
|
| Because odds are that one day they will.
| Etheryte wrote:
| Every time I put anything anywhere on the open net, it gets
| bombarded 24/7 by every script kiddie, botnet group , and
| these days, AI company out there. No matter what I'm hosting,
| it's a lot more convenient to not have to worry about that
| even for a second.
| drnick1 wrote:
| > Every time I put anything anywhere on the open net, it
| gets bombarded 24/7 by every script kiddie, botnet group ,
| and these days, AI company out there
|
| Are you sure that it isn't just port scanners? I get
| perhaps hundreds of connections to my STMP server every
| day, but they are just innocuous connections (hello, then
| disconnect). I wouldn't worry about that unless you see
| repeated login attempts, in which case you may want to
| deploy Fail2Ban.
| TheCraiggers wrote:
| Port scanners don't try to ssh into my server with
| various username/password combinations.
|
| I prefer to hide my port instead of using F2B for a few
| reasons.
|
| 1. Log spam. Looking in my audit logs for anything
| suspicious is horrendous when there's just megs of login
| attempts for days.
|
| 2. F2B has banned me in the past due to various oopsies
| on my part. Which is not good when I'm out of town and
| _really_ need to get into my server.
|
| 3. Zero days may be incredibly rare in ssh, but maybe not
| so much in Immich or any other relatively new software
| stack being exposed. I'd prefer not to risk it when
| simple alternatives exist.
|
| Besides the above, using Tailscale gives me other
| options, such as locking down cloud servers (or other
| devices I may not have hardware control over) so that
| they can only be connected to, but not out of.
| pferde wrote:
| You can tweak rate thresholds for F2B, so that it blocks
| the 100-attempts-per-second attackers, but doesn't block
| your three-attempts-per-minute manual fumbling.
| TheCraiggers wrote:
| I know this. But I don't like that they still get to try
| at least once, and there's still the rest of my list.
| NewJazz wrote:
| This is a good reason not to expose random services, but a
| wireguard endpoint simply won't respond at all if someone
| hits it with the wrong key. It is better even than key
| based ssh.
| Frotag wrote:
| Speaking of Wireguard, my current topology has all peers
| talking to a single peer that forwards traffic between peers
| (for hole punching / peers with dynamic ips).
|
| But some peers are sometimes on the same LAN (eg phone is
| sometimes on same LAN as pc). Is there a way to avoid
| forwarding traffic through the server peer in this case?
| wooptoo wrote:
| Two separate WG profiles on the phone; one acting as a
| Proxy (which forwards everything), and one acting just as a
| regular VPN without forwarding.
| Frotag wrote:
| I guess I'm looking for wireguard's version of STUN. And
| now that I know what to google for, finally found some
| promising leads.
|
| https://github.com/jwhited/wgsd
|
| https://www.jordanwhited.com/posts/wireguard-endpoint-
| discov...
|
| https://github.com/tjjh89017/stunmesh-go
| megous wrote:
| Have your network managing software setup a default route
| with a lower metric than wireguard default route based on
| wifi SSID. Can be done easily with systemd-networkd,
| because you can match .network file configurations on SSID.
| You're probably out of luck with this approach on network-
| setup-challenged devices like so called smart phones.
| torcete wrote:
| The way I do it is to have two different first level
| domains. Let's say:
|
| - w for the wireguard network. - h for the home network.
|
| Nothing fancy, just populate the /etc/hosts on every
| machine with these names.
|
| Now, it's up to me to connect to my server1.h or server1.w
| depending whether I am at home or somewhere else.
| darkwater wrote:
| I don't fully understand your topology use case. You have
| different peers that are "road-warriors" and that sometimes
| happen to be both on the same LAN which is not your home
| LAN, and need to speak the one to the other? And I guess
| you are connecting to the other peer via DNS, so your DNS
| record always points to the Wireguard-provided IP?
| epistasis wrote:
| I've managed wireguard in the past, and would never do it
| again. Generating keys, distributing them, configuring it
| all...... bleh!
|
| Never again, it takes too much time and is too painful.
|
| Certs from Tailscale are reason enough to switch, in my
| opinion!
|
| The key with successful self hosting is to make it easy and
| fast, IMHO.
| alpn wrote:
| > I'd rather expose a Wireguard port and control my keys than
| introduce a third party like Tailscale.
|
| I'm working on a (free) service that lets you have it both
| ways. It's a thin layer on top of vanilla WireGuard that
| handles NAT traversal and endpoint updates so you don't need
| to expose any ports, while leaving you in full control of
| your own keys and network topology.
|
| https://wireplug.org
| copperx wrote:
| Apparently I'm ignorant about Tailscale, bacause your
| service description is exactly what I thought Tailscale
| was.
| SchemaLoad wrote:
| The main issue people have with Tailscale is that it's a
| centralised service that isn't self hostable. The
| Tailscale server manages authentication and keeping track
| of your devices IPs.
|
| Your eventual connection is direct to your device, but
| all the management before that runs on Tailscales server.
| TOMDM wrote:
| Isn't this what headscale is for?
| hamandcheese wrote:
| This is very cool!
|
| But I also think it's worth a mention that for basic "I
| want to access my home LAN" use cases you don't need P2P,
| you just need a single public IP to your lan and perhaps
| dynamic dns.
| kevin_thibedeau wrote:
| A public IP and DDNS can be impossible behind CGNAT. A
| VPN link to a VPS eliminates that problem.
| digiown wrote:
| The VPS (using wg-easy or similar solutions) will be able
| to decrypt traffic as it has all the keys. I think most
| people self-hosting are not fine with big cloud
| eavesdropping on their data.
|
| Tailscale really is superior here if you use tailnet
| lock. Everything always stays encrypted, and fails over
| to their encrypted relays if direct connection is not
| possible for various reasons.
| hamandcheese wrote:
| When I said "you just need a single public IP" I figured
| it was clear that I wasn't claiming this works for people
| who don't have a public IP.
| digiown wrote:
| Where will you host the wg endpoint to open up?
|
| - Each device? This means setting up many peers on each
| of your devices
|
| - Router/central server? That's a single point of
| failure, and often a performance bottleneck if you're on
| LAN. If that's a router, the router may be compromised
| and eavesdrop on your connections, which you probably
| didn't secure as hard because it's on a VPN.
|
| Not to mention DDNS can create significant downtime.
|
| Tailscale fails over basically instantly, and is E2EE,
| unlike the hub setup.
| hamandcheese wrote:
| To establish a wg connection, only one node needs a
| public IP/port.
|
| > Router/central server? That's a single point of failure
|
| Your router is a SPOF regardless. If your router goes
| down you can't reach any nodes on your LAN, Tailscale or
| otherwise. So what is your point?
|
| > If that's a router, the router may be compromised and
| eavesdrop on your connections, which you probably didn't
| secure as hard because it's on a VPN.
|
| Secure your router. This is HN, not advice for your mom.
|
| > Not to mention DDNS can create significant downtime.
|
| Set your DNS ttl correctly and you should experience no
| more than a minute of downtime whenever your public IP
| changes.
| digiown wrote:
| > one node needs a public IP/port
|
| A lot of people are behind CGNAT or behind a non-
| configurable router, which is an abomination.
|
| > Secure your router
|
| A typical router cannot be secured against physical
| access, unlike your servers which can have disk
| encryption.
|
| > Your router is a SPOF regardless
|
| Tailscale will keep your connection over a downstream
| switch, for example. It will not go through the router if
| it doesn't have to. If you use it for other usecases like
| kdeconnect synchronizing clipboard between phone and
| laptop, that will also stay up independent of your home
| router.
| digiown wrote:
| A mesh-type wireguard network is rather annoying to set up if
| you have more than a few devices, and a hub-type network (on
| a low powered router) tends to be so slow that it
| necessitates falling back to alternate interfaces when you're
| at home. Tailscale does away with all this and always uses
| direct connections. In principle it is more secure than
| hosting it on some router without disk encryption (as the
| keys can be extracted via a physical attack, and a pwned
| router can also eavesdrop on traffic).
| byb wrote:
| My biggest source of paranoia is my open home assistant port,
| while it requires a strong password and is TLS-encrypted, I'm
| sure that one day someone will find an exploit letting them
| in, and then the attacker will rapidly turn my smart home
| devices on and off until they break/overheat the power
| components until they start a fire and burn down my house.
| seszett wrote:
| That seems like a very irrational fear. Attackers don't go
| around trying to break into Home Assistant to turn the
| lights on at some stranger's house.
|
| There's also no particular reason to think Home Assistant's
| authentication has to have a weakness point.
|
| And your devices are also unlikely to start a fire just by
| being turned on and off, if that's your fear you should
| replace them at once because if they catch fire it doesn't
| matter if it's an attacker or yourself turning them on and
| off.
| timc3 wrote:
| People are putting their whole infrastructure onto HA -
| cars, Apple/Google/other accounts, integrations to grid
| companies, managing ESP software etc..
|
| I think that has more potential for problems than turning
| lights on and off and warrants strong security.
| wao0uuno wrote:
| Why expose HA to the internet? I'm genuinely curious.
| catlifeonmars wrote:
| Honestly the managed PKI is the main value-add from Tailscale
| over plain wireguard.
|
| I've been meaning to give this a try this winter:
| https://github.com/juanfont/headscale
| BatteryMountain wrote:
| Which router OS are you using? I have openwrt + daily auto
| updates configure with a couple of packages blacklisted that
| I manually update now & then.
| PeterStuer wrote:
| Defence in dept. You have a layer of security even before a
| packet reaches your port. I might have a zero day on your
| service, but now I also need to breach your reverse proxy to
| get to it.
| nialv7 wrote:
| > introduce a third party like Tailscale.
|
| Well just use headscale and you'll have control over
| everything.
| vladvasiliu wrote:
| That just moves the problem, since headscale will require a
| server you manage with an open port.
|
| Sure, tailscale is nice, but from an open-port-on-the-net
| perspective it's probably a bit below just opening
| wireguard.
| arjie wrote:
| I used to do that, but Tailscale with your own headscale
| server is pretty snazzy. The other thing is with cloudflared
| running your server doesn't have to be Internet-routable.
| Everything is tunneled.
| eqvinox wrote:
| > I am not sure why people are so afraid of exposing ports.
|
| Similar here, I only build & run services that I trust myself
| enough to run in a secure manner by themselves. I still have
| a VPN for some things, but everything is built to be secure
| on its own.
|
| It's quite a few services on my list at this point and really
| don't want to have a break in one thing lead to a break in
| everything. It's always possible to leave a hole in one or
| two things by accident.
|
| On the other side this also means I have a Postgres instance
| with TCP/5432 open to the internet - with no ill effects so
| far, and quite a bit of trust it'll remain that way, because
| I _understand_ its security properties and config now.
| twelvedogs wrote:
| i tried wireguard and ended up giving up on it, too many isps
| just block it here or use some kind of tech that fucks with
| it and i have no idea why, i couldn't _connect_ to my home
| network because it was blocked on whatever random wifi i was
| on
|
| the new problem is now my isp uses cgnat and there's no easy
| way around it
|
| tailscale avoids all that, if i wanted more control i'd
| probably use headscale rather than bother with raw wireguard
| pferde wrote:
| And there's nothing wrong with it. That is what wireguard
| is meant to be - a rock-solid secure tunneling
| implementation that's easy to build higher-level solutions
| on.
| pacija wrote:
| Of course. A port is a door. If service listening on a port
| is secure and properly configured (e.g. ssh), whole Internet
| can bang on it all day every day, they won't let through
| without proper key. Same for imap, xmpp or any othet service.
|
| But what can you expect from people who provide services but
| won't even try to understand how they work and how they are
| configured as it's 'not fun enough', expecting claude code to
| do it right for them.
|
| Asking AI to do thing you did 100 times before is OK I guess.
| Asking AI to do thing you never did and have no idea how it's
| properly done - not so much I'd say. But this guy obviously
| does not signal his sysadmin skills but his AI skills. I hope
| it brings him the result he aimed for.
| rubatuga wrote:
| Yggdrasil network is probably the future. At Hoppy Network
| we're about to release private yggdrasil relays as a service
| so you don't get spammed with "WAN" traffic. With Yggdrasil,
| IP addresses aren't allocated by an authority - they are
| owned and proven by public key cryptography.
| gambiting wrote:
| "Back in the day"(just few years ago) I used to expose a port
| for RDP on my router, on a non-standard port. Typically it
| would be fine and quiet for a few weeks, then I assume some
| automatic scanner would find it and from that point onwards I
| could see windows event log reporting a log in attempt every
| second, with random login/password combinations, clearly just
| looking for something that would work. I would change the
| port and the whole dance would repeat all over again. Tens of
| thousands of login attempts every day, all year round. I used
| to just ignore it, since clearly they weren't going to log in
| with those random attempts, but eventually just switched to
| OpenVPN.
|
| So yeah, the lesson there is that if you have a port open to
| the internet, _someone_ will scan it and try to attack it.
| Maybe not if it 's a random game server, but any popular
| service will get under attack.
| drnick1 wrote:
| > someone will scan it and try to attack it. Maybe not if
| it's a random game server, but any popular service will get
| under attack.
|
| That's fine, it's only people knocking on a closed door.
| You cannot host things such as email or HTTP without open
| ports, your service needs to be publicly accessible by
| definition.
| inapis wrote:
| Skill issue. Not to mention the ongoing effort required to
| maintain and secure the service. But even before that, a lot
| of people are behing CGNAT. Tailscale makes punching a hole
| through that very easy. Otherwise you have to run your own
| relay server somewhere in the cloud.
| abc123abc123 wrote:
| This is the truth. I've been exposing 22 and 80 for decades,
| and nothing has happened. The ones I know who had something
| bad happen to them exposed proprietary services or security
| nightmares like wordpress.
| 1vuio0pswjnm7 wrote:
| "I'd rather expose a Wireguard port and control my keys than
| introduce a third party like Tailscale."
|
| It's always perplexing to me how HN commenters replying to a
| comment with a statement like this, e.g., something like "I
| prefer [choice with some degree of DIY]", will try to "argue"
| against it
|
| The "arguments" are rarely, "I think that is a poor choice
| because [list of valid reasons]"
|
| Instead the responses are something like, "Most people...".
| In other words, a nonsensical reference to other computer
| users
|
| It might make sense for a commercial third party to care
| about what other computer users do, but why should any
| individual computer user care what others do (besides genuine
| curiosity or commercial motive)
|
| For example, telling family, friends, colleagues how you
| think they should use their computers usually isn't very
| effective. They usually do not care about your choices or
| preferences. They make their own
|
| Would telling strangers how to use their computers be any
| more effective
|
| Forum commenters often try to tell strangers what to do, or
| what not to do
|
| But every computer user is free to make their own choices and
| pursue their own preferences
|
| NB. I am not commenting on the open ports statement
| zobzu wrote:
| put simply and fairly bluntly: because they do not know how
| things work.
|
| but actually it's worse. this is HN - supposedly, most
| commenters are curious by nature and well versed into most
| basic computer stuff. in practice, it's slowly less and less
| the case.
|
| worse: what is learned and expected is different from what
| you'd think.
|
| for example, separating service users sure is better than
| nothing, but the OS attack surface as a local user is still
| huge, hence why we use sandboxes, which really are just OS
| level firewalls to reduce the attack surface.
|
| the open port attack surface isnt terrible though: you get a
| bit more of the very well tested tcp/ip stack and up to 65k
| ports all doing the exact same thing, not terrible at all.
|
| Now, add to it "AI" which can automatically regurgitate and
| implement whatever reddit and stack overflow says.. it makes
| for a fun future problem - such forums will end up with
| mostly non-new AI content (new problem being solved will be a
| needle in the haystack) - and - users will have learned that
| AI is always right no matter what it decides (because they
| don't know any better and they're being trained to blindly
| trust it).
|
| Heck, i predict there will be a chat, where a bunch of humans
| will argue very strongly that an AI is right while its
| blatantly wrong, and some will likely put their life on the
| line to defend it.
|
| Fun times ahead. As for my take: humans _need_ learning to
| live, but are lazy. Nature fixes itself.
| dpacmittal wrote:
| Tailscale works behind NAT, wireguard does not unless you
| also have a publicly reachable relay server which introduces
| its own maintenance headaches and cost.
| comrade1234 wrote:
| I just have a vpn server on my fiber modem/router
| (edgerouter-4) and use vpn clients on my devices. I actually
| have two vpn networks - one that can see the rest of my home
| network (and server) and the other that is completely isolated
| and can't see anything else and only does routing. No need to
| use a third-party and I have more flexibility
| PaulKeeble wrote:
| Its especially important in the CGNAT world that has been
| created and the enormous slog that IPv6 rollout has ultimately
| become.
| shadowgovt wrote:
| Besides the company that operates it, what is the big
| difference between Tailscale and Cloudflare tunnels? I've seen
| Tailscale mentioned frequently but I'm not quite sure what it
| gets for me. If it's more like a VPN, is it possible to use on
| an arbitrary device like a library kiosk?
| ssl-3 wrote:
| I don't use Cloudflare tunnels for anything.
|
| But Tailscale is just a VPN (and by VPN, I mean: Something
| more like "Connect to the office networ" than I do
| "NordVPN"). It provides a private network on top of the
| public network, so that member devices of that VPN can
| interact together privately.
|
| Which is pretty great: It's a simple and free/cheap way for
| me to use my pocket supercomputer to access my stuff at home
| from anywhere, with reasonable security.
|
| But because it happens at the network level, you (generally)
| need to own the machines that it is configured on. That tends
| to exclude using it in meaningful ways with things like
| library kiosks.
| vachina wrote:
| You can self host a tailscale network entirely on your own,
| without making a single call to Tailscale Inc.
|
| Your cloudflare tunnel availability depends on Cloudflare's
| mood of the day.
| SchemaLoad wrote:
| Yeah same story for me. I did not trust my sensitive data on
| random self hosting apps with no real security team. But now I
| can put the entire server on the local network only and split
| tunnel VPN from my devices and it just works.
|
| LLMs are also a huge upgrade here since they are actually quite
| competent at helping you set up servers.
| Melatonic wrote:
| Why not cloudflare tunnels ?
| mobilio wrote:
| CF tunnels are game changers for me!
| driton wrote:
| Even behind a tunnel, if you happen to be running an older
| version of a service (like Immich) with a known exploit, you
| are still vulnerable to attacks. Tailscale sidesteps this by
| keeping the service completely "invisible" to the outside
| world, so the two don't quite compare in my view.
| JamesSwift wrote:
| Just use subpath routing and fail2ban and Im very comfortable
| with exposing my home setup to the world.
|
| The only thing served on / is a hello world nginx page.
| Everything else you need to know the randomly generated subpath
| route.
| MattSayar wrote:
| Just be sure to run it with --accept-dns=false otherwise you
| won't have any outbound Internet on your server if you ever get
| logged out. That was annoying to find out (but easy to debug
| with Claude!)
| BatteryMountain wrote:
| Tailscale is a good first step, but its best to configure
| wireguard directly on your router. You can try headscale but it
| seems to be more of a hobby project - so native wireguard is
| the only viable path. Most router OS's supports wireguard these
| days too. You can ask claude to sanity check your
| configuration.
| johnisgood wrote:
| Tailscale does not solve the "falling behind on updates"
| problem, it just moves the perimeter. Your services are still
| vulnerable if unpatched: the attacker now needs tailnet access
| first (compromised device, account, or Tailscale itself).
|
| You have also added attack surface: Tailscale client,
| coordination plane, DERP relays. If your threat model includes
| "OpenSSH might have an RCE" then "Tailscale might have an RCE"
| belongs there too.
|
| WireGuard gives you the same "no exposed ports except VPN"
| model without the third-party dependency.
|
| The tradeoff is convenience, not security.
|
| BTW, why are people acting like accessing a server from a phone
| is a 2025 innovation?
|
| SSH clients on Android/iOS have existed for 15 years. Termux,
| Prompt, Blink, JuiceSSH, pick one. Port N, key auth, done. You
| can run Mosh if you want session persistence across network
| changes. The "unlock" here is NAT traversal with a nice UI, not
| a new capability.
| Galanwe wrote:
| > BTW, why are people acting like accessing a server from a
| phone is a 2025 innovation?
|
| > SSH clients on Android/iOS have existed for 15 years
|
| That is not the point, Tailscale is not just about having a
| network connection, it's everything that goes with. I used to
| have OpenVPN, and there's a world of difference.
|
| - The tailscale client is much nicer and convenient to use on
| Android than anything I have seen.
|
| - The auth plane is simpler, especially for non tech users
| (parents, wife) whom I wish to access my photo album. They
| are basically independent with tailscale.
|
| - The simplicity also allows me to recommend it to friends
| and we can link between our tailnet, e.g. to cross backup our
| NAS.
|
| - Tailscale can terminate SSH publicly, so I can selectively
| expose services on the internet (e.g. VaultWarden) without
| exposing my server and hosting a reverse proxy.
|
| - ACLs are simple and user friendly.
| johnisgood wrote:
| You are listing conveniences, which is fair. I said the
| tradeoff is convenience, not security.
|
| > "Tailscale can terminate SSH publicly"
|
| You are now exposing services via Tailscale's
| infrastructure instead of your own reverse proxy. The
| attack surface moved, it did not shrink.
| twelvedogs wrote:
| > Tailscale does not solve the "falling behind on updates"
| problem, it just moves the perimeter.
|
| nothing 100% fixes zero days either, you are just adding
| layers that all have to fail at the same time
|
| > You have also added attack surface: Tailscale client,
| coordination plane, DERP relays. If your threat model
| includes "OpenSSH might have an RCE" then "Tailscale might
| have an RCE" belongs there too.
|
| you still have to have a vulnerable service after that. in
| your scenario you'd need an exploitable attack on wireguard
| or one of tailscale's modifications to it _and_ an
| exploitable service on your network
|
| that's extra difficulty not less
| johnisgood wrote:
| The "layers" argument applies equally to WireGuard without
| Tailscale. Attacker still needs VPN exploit + vulnerable
| service.
|
| The difference: Tailscale adds attack vectors that do not
| exist with self-hosted WireGuard: account compromise,
| coordination plane, client supply chain, other devices on
| your tailnet. Those are not layers to bypass, they are
| additional entry points.
|
| Regardless, it is still for convenience, not security.
| PeterStuer wrote:
| These are two very separate issues. Tailscale or other reverse
| proxies will give you access from the WAN.
|
| Claude Code or other assistants will give you conversational
| management.
|
| I already do the former (using Pangolin). I'm building towards
| the latter but first need to be 100% sure I can have perfect
| rollback and containement across the full stack CC could
| influence.
| lee_ars wrote:
| I've started experimenting with Claude Code, and I've decided
| that it never touches anything that isn't under version
| control.
|
| The way I've put this into practice is that instead of
| letting claude loose on production files and services, i keep
| a local repo containing copies of all my service config files
| with a CLAUDE.md file explaining what each is for, the actual
| host each file/service lives on, and other important details.
| If I want to experiment with something ("Let's finally get
| around to planning out and setting up kea-dhcp6!"), Claude
| makes its suggestions and changes in my local repo, and then
| I manually copy the config files to the right places, restart
| services, and watch to see if anything explodes.
|
| Not sure I'd ever be at the point of trusting agentic AI to
| directly modify in-place config files on prod systems (even
| for homelab values of "prod").
| mtoner23 wrote:
| People are way too worried about security imo. Statistically,
| no one is targeting you to be hacked. By the time you are
| important and valuable enough for your home equipment to be a
| target you would have hired someone else to manage this for you
| fetzu wrote:
| I think this is very dangerous perspective. A lot of attacks
| on infra are automated, just try to expose a Windows XP
| machine to the internet for a day and see with how much
| malware you end up with. If you leave your security
| unchecked, you will end up attacked; not by someone targeting
| you specifically, but having all your data encrypted for
| ransom might still create a problem for you (even if the
| attacker doesn't care about YOUR data specifically).
| subscribed wrote:
| Oh, sure, no one is _targeting_ me specifically.
|
| Its only swarms of bots and scripts going through the entire
| internet, including me.
|
| iptables and fail2ban should be installed pretty early, and
| then - just watch the logs.
| johnfn wrote:
| Once, when I was young and inexperienced, I left a server
| exposed to the Internet by accident (I accidentally exposed a
| user with username postgres, password postgres). In hours the
| machine had been hacked to run a botnet. Was I stupid? Yes.
| But I absolutely wasn't a high-profile enough person to "be a
| target" - clearly someone was just scanning IP addresses.
| hexfish wrote:
| Is Tailscale still recording metadata about all your
| connections?
| https://github.com/tailscale/tailscale/issues/16165
| znpy wrote:
| > The biggest reason I had not to run a home server was
| security: I'm worried that I might fall behind on updates and
| end up compromised.
|
| In my experience this is much less of an issue depending on
| your configuration and what you actually expose to the public
| internet.
|
| Os-side, as long as you pick a good server os (for me that's
| rocky linux) you can safely update once every six months.
|
| Applications-wise, i try and expose as little as possible to
| the public internet and everything exposed is running in an
| unprivileged podman container. Random test stuff is only
| exposed within the vpn.
|
| Also tailscale is not even a hard requirement: i rub openvpn
| and that works as well, on my iphone too.
|
| The truly differentiating factor is methodological, not
| technological.
| miki123211 wrote:
| Now I wish there was some kind of global, single-network
| version of Tailscale...
|
| TS is cool if you have a well-defined security boundary. This
| is you / your company / your family, they should have access.
| That is the rest of the world, they should not.
|
| My use case is different. I do occasionally want to share
| access to otherwise personal machines around. Tailscale machine
| sharing sort of does what I want, but it's really inconvenient
| to use. I wish there was something like a Google Docs flow,
| where any Tailscale user could attempt to dial into my machine,
| but they were only allowed to do so after my approval.
| fartfeatures wrote:
| Take a look at Zrok it might be what you want:
| https://zrok.io
| PLG88 wrote:
| You have more or less described OpenZiti. Just mint a new
| identity/JWT for the user, create a service, and viola, only
| that user has access to your machine. Fully open source and
| self-hostable.
| throwup238 wrote:
| There's also Cloudflare tunnels for stuff that you want to be
| available to the internet but dont want to open ports and deal
| with that. You can add an auth policy that only works with your
| email and Github/whatever SSO.
| cmiles8 wrote:
| Anyone seriously about tech should have a homelab. It's a small
| capital investment that lasts for years and with proxmox or
| similar having your own personal "private cloud" on demand is
| simple.
| e2e4 wrote:
| My stack. Claude code working via CLIs: Coolify on hetzner
| pablonaj wrote:
| Can you comment a bit on your setup? Sounds interesting.
| Humorist2290 wrote:
| Fun. I don't agree that Claude Code is the real unlock, but
| mostly because I'm comfortable with doing this myself. That said,
| the spirit of the article is spot on. The accessibility to run
| _good_ web services has never been better. If you have a modest
| budget and an interest, that's enough -- the skill gap is
| closing. That's good news I think.
|
| But Tailscale is the real unlock in my opinion. Having a slot
| machine cosplaying as sysadmin is cool, but being able to access
| services securely from anywhere makes them legitimately usable
| for daily life. It means your services can be used by
| friends/family if they can get past an app install and login.
|
| I also take minor issue with running Vaultwarden in this setup.
| Password managers are maximally sensitive and hosting that data
| is not as banal as hosting Plex. Personally, I would want
| Vaultwarden on something properly isolated and locked down.
| heavyset_go wrote:
| I believe Vaultwarden keeps data encrypted at rest with your
| master key, so some of the problems inherent to hosting such
| data can be mitigated.
| Humorist2290 wrote:
| I can believe this, and it's a good point. I believe
| Bitwarden does the same. I'm not against Vaultwarden in
| particular but against colocation of highly sensitive
| (especially orthogonally sensitive) data in general. It's
| part of a self-hoster's journey I think: backups, isolation,
| security, redundancy, energy optimization, etc. are all
| topics which can easily occupy your free time. When your
| partner asks whether your photos are more secure in Immich
| than Google, it can lead to an interesting discussion of
| nuances.
|
| That said, I'm not sure if Bitwarden is the answer either.
| There is certainly some value in obscurity, but I think they
| have a better infosec budget than I do.
| Gualdrapo wrote:
| One day when I have some extra bucks I'd try to get a home server
| running, but the idea of having something eating grid electricity
| 24/7 doesn't seem to play along well with this 3rd world budget.
| Are there some foolproof and not so costly off-grid/solar setups
| to look at (like a Raspberry-based thingy or similar)?
| noname120 wrote:
| Mac Mini (M1 and later) under Asahi Linux just uses 5 W for a
| normal workload. If you push it to 100% of CPU it reaches 20 W.
| That's very little.
| SchemaLoad wrote:
| Only thing is you can't run Proxmox which makes self hosting
| much better, and you'll be limited to ARM builds, which on
| server is at least a lot easier than trying to run desktop
| apps. Modern micro desktops are also fairly power efficient,
| perhaps not quite as low as the mac, but much lower than a
| regular gaming desktop idling.
|
| Avoid stacking in too many hard drives since each one uses
| almost as much power as the desktop does at idle.
| atahanacar wrote:
| I doubt anyone who is too tight on cash that they have to
| think about the electricity cost of a home server can afford
| a Mac.
| imiric wrote:
| Your fridge and other home appliances likely use much more
| power than whatever a small server would. The mini PC in the
| article is very power efficient. You likely won't notice it in
| your power bill, regardless of your budget. You could go with a
| solar-powered setup if you prefer, but IMO for this type of use
| case it would be overengineering.
| efilife wrote:
| how many times will I get clickbaited by some cool title only to
| see AI praise in the article and nothing more? It's tiring and
| happens way too often
|
| related "webdev is fun again": claude. https://ma.ttias.be/web-
| development-is-fun-again/
|
| Also the "Why it matters" in the article. I thought it's a jab at
| AI-generated articles but it starts too look like the article was
| AI written as well
| keybored wrote:
| Everything is now not-niche but on the cusp of hitting the
| mainstream. Like Formal Methods.[1] But they were nice enough
| to put it in the title. Then tptacek replied that he "called it
| a little bit" because of: Did Semgrep Just Get A Lot More
| Interesting?[2] (Why? What could the reason be?)
|
| [1] https://martin.kleppmann.com/2025/12/08/ai-formal-
| verificati...
|
| [2]: https://fly.io/blog/semgrep-but-for-real-now/
| jacobthesnakob wrote:
| Maybe because I don't do SWE for my job, but I have fun writing
| docker-compose files, troubleshooting them, and adding
| containers to my server. Then I understand how/why stuff works
| if it breaks, why would I want to hand that over to an AI?
|
| Waiting for the follow-on article "Claude Code reformatted my
| NAS and I lost my entire media collection."
| chasing0entropy wrote:
| ROFL. There have been at least two posts of Claude without
| confirmation deleting a repository and one where it wiped an
| entire partition
| efilife wrote:
| psa: The title has been changed since
| sprainedankles wrote:
| Impeccable timing, I finally got around to putting some old
| hardware to use and getting a home assistant instance (and
| jellyfin, and immich, and nextcloud, ...) set up over winter
| break. Claude (and tailscale) saved hours of my time and enabled
| me to build enough momentum to get things configured. It's now
| feasible for me to spend 15-20 minutes knocking down homeserver
| tasks that I otherwise would've ignored. Quite fun!
| hinkley wrote:
| What I'd really like is to run the admin interface for an app on
| a self hosted system behind firewalls, and push read replicas out
| into the cloud. But I haven't seen a database where the master
| pushes data to the replicas instead of the replicas contacting
| the master. Which creates some pretty substantial tunneling
| problems that I don't really want on my home network.
|
| Is there a replica implementation that works in the direction I
| want?
| chasing0entropy wrote:
| Use NAT hole punching if you're advanced, or you could fall
| back to IP/port filtering
| hinkley wrote:
| Why do I have to use a tunnel and empower a machine I don't
| control to mess with a machine I do? Why has this been made
| so difficult? Why wouldn't a master be aware of all of its
| replicas? Raft does.
| bakies wrote:
| Tailscale will take care of the networking if you install it in
| both locations.
| reachableceo wrote:
| Cloudron makes this even easier. Well worth 1.00 a day! Handles
| the entire stack (backups , monitoring , dns , ssl , updates ).
| sciences44 wrote:
| Interesting subject, thank you! I have a cluster of 2 Orange Pis
| (16 GB RAM each) plus a Raspberry Pi. I think it's high time to
| get them back on my desk. I never had time to get very far with
| the setup due to a lack of time. It took so long to write the
| Ansible scripts/playbooks, but with Claude Code, it's worth a try
| now. So thanks for the article; it makes me want to dust it off!
| atmosx wrote:
| Just make sure you have a local and remote backup server.
|
| From to time, test the restore process.
| yencabulator wrote:
| Claude with root access will ensure there's "motivation" to run
| the restore process regularly.
| __MatrixMan__ wrote:
| I haven't tried it yet, but the evil twin to this practice is
| to nuke everything periodically to ensure that your agent isn't
| relying on any filesystem state that it hasn't specified builds
| for (i.e. https://grahamc.com/blog/erase-your-darlings/).
|
| They tend to slip out of declarative mode and start making
| untracked changes to the system from time to time.
| cafebeen wrote:
| This is great and echoes my experience. Although I would add a
| caveat that this mostly applies to solo work. Once you need to
| collaborate or operate on a team, many of limits of self-hosting
| return.
| holyknight wrote:
| not with these hardware prices...
| SchemaLoad wrote:
| Second hand micro desktops are still cheap, at least for now.
| drnick1 wrote:
| Hardware that is considered e-waste (like a Core 2 Duo) makes a
| wonderful home server.
| SchemaLoad wrote:
| You can go much newer than that and get semi modern intel
| chips second hand. For something that runs 24/7, the power
| cost will exceed the savings from using long obsolete chips.
| minihoster wrote:
| Might as well ask here in case author or anyone else with a
| similar setup is reading. Has anyone run into stability issues
| running a bunch of self-hosting stuff on a mac mini M1 (8GB)? My
| setup is pretty basic - docker running Jellyfin, Immich, *arr
| software, qbittorrent. Stuff is stored on a NAS over SMB. Usually
| within a few hours of rebooting, the OS or at least userspace
| totally freezes. SSH connections are instantly closed, screen
| share doesn't work. It responds to ping for a while but that also
| goes down eventually. Pretty stumped...
| jackschultz wrote:
| I literally did this yesterday and had the same thought. Older
| computer (8 gigs ram) with crappy windows I never used and I
| thought huh, I wonder how good these models can take me through
| installing linux with goal of docker deploys of relatively basic
| things like cron tasks, personal postgres, and minio that I can
| used for self shared data.
|
| Took a couple hours with some things I ran across, but the model
| had me go through the setup for debian, how to go through the
| setup gui, what to check to make it server only, then it took me
| through commands to run so it wouldn't stop when I closed the
| laptop, helped with tailscale, getting the ssh keys all setup.
| Heck it even suggested doing daily dumps of the database and
| saving to minio and then removing after that. Also knows about
| the limitations of 8 gigs of ram and how to make sure docker
| settings for the difference self services I want to build don't
| cause issues.
|
| Give me a month and true strong intention and ability to google
| and read posts and find the answer on my own and I still don't
| think I would have gotten to this point with the amount of trust
| I have in the setup.
|
| I very much agree with this topic about self hosting coming alive
| because these models can walk you through everything. Self
| building and self hosting can really come alive. And in the
| future when open models are that much better and hardware costs
| come down (maybe, just guessing of course) we'll be able to also
| host our own agents on these machines we have setup already. All
| being able to do it ourselves.
| notesinthefield wrote:
| I find myself a bit overwhelmed with hardware options during
| recent explorations. Seemingly _everything_ can handle what I
| want a local copy of my Bandcamp archive to stream via jellyfin.
| Good times we're in but even having good sysadmin skills, I wish
| someone would just tell me exactly what to buy.
| devonhk wrote:
| > I wish someone would just tell me exactly what to buy.
|
| I'll bite. You can save a lot of money by buying used hardware.
| I recommend looking for old Dell OptiPlex towers on Facebook
| Marketplace or from local used computer stores. Lenovo
| ThinkCentres (e.g., m700 tiny) are also a great option if you
| prefer something with a smaller form factor.
|
| I'd recommend disregarding advice from non-technical folks
| recommending brand new, expensive hardware, because it's
| usually overkill.
| SchemaLoad wrote:
| I spent so long trying to make Raspberry Pis work but they
| just kind of suck and everything is harder on them. I only
| just discovered that there are an infinite supply of these
| micro desktops second hand from offices/government. I was
| able to pick up a 9th gen intel with 16gb ram for less than
| the cost of a Pi 5, and it's massively more powerful.
| jacobthesnakob wrote:
| Pi's are incredible little basic home servers but they
| can't handle transcoding. Great option for places with very
| expensive electricity too.
| SchemaLoad wrote:
| I just found their proprietary hardware and being ARM too
| limiting. I wanted to set up full disk encryption to set
| up nextcloud on, and found that on the pi this is an
| incredibly complex process. While on an x86 PC it's just
| a checkbox on install.
|
| And then you can only use distros which have a raspberry
| pi specific build. Generic ARM ones won't work.
| jacobthesnakob wrote:
| Yeah the complaints are fair. I stick to RPi OS for
| maximum compatibility. People have been crying for a
| Google Drive client for Linux for over a decade, but
| still have to set it up in rclone.
|
| I build out my server in Docker and I've been surprised
| that every image I've ever wanted to download has an ARM
| image.
| drnick1 wrote:
| Way too expensive for their moderate performance. All
| serious self-hosters (not Youtube home-labbers) use x86
| machines, often retired desktop/gaming rigs or used
| datacenter hardware.
| jacobthesnakob wrote:
| What is a "serious self hoster"? How many Docker
| containers do I need to be running on my Pi 5 to get into
| the club?
| devonhk wrote:
| Yeah, they're amazing value. I paid $125 CAD for a 4th gen
| i7 with 16GB of RAM about 5 years ago. It's been running
| almost 24/7 ever since with no issues.
| SchemaLoad wrote:
| You also don't have to deal with the usual annoyance of
| second hand gear like facebook marketplace and no
| delivery. These companies / governments have contracts
| with reseller companies who will buy the entire stock and
| sell them online just like buying new.
| notesinthefield wrote:
| I forgot all about these after I stopped doing desktop
| support, thanks!
| lucb1e wrote:
| What's the power consumption on those?
|
| I'm not familiar with Dell product names specifically but
| 'tower' sounds like it'll sit there burning 200W idle. Old
| laptops (sliding out the battery) is what I've been opting
| for, which use barely anything more than the router it sits
| next to. Especially if you just want to serve static files as
| GP seems to be looking for, an old smartphone will be enough
| but there you can't remove the battery (since it won't run
| off of just the charger)
| rr808 wrote:
| Get started a corporate surplus mini pc on ebay. They super
| cheap - search for micro pc - if you get a recent CPU from Dell
| or Lenovo should be under $200, you can install Fedora or other
| Linux distribution. Ask Claude for everything else.
| lucb1e wrote:
| That's twice what I'd spend on a first server when you're
| still figuring out what you need!
|
| My first "server" was a 65EUR second-hand laptop including
| shipping iirc, in ~2010 euros so say maybe 100EUR now when
| taking inflation into account. I used that for a number of
| years and had a good idea of what I wanted from my next setup
| (which wasn't much heavier, but a little newer cpu wasn't
| amiss after 3 years). Don't think one needs to even go so far
| as 200$ for a "local Bandcamp archive" (static file storage)
| and serving that via some streaming webserver
|
| Jellyfin docs do mention "Not having a GPU is NOT recommended
| for Jellyfin, as video transcoding on the CPU is very
| performance demanding" but that's for on-the-fly video
| transcoding. If you transcode your videos to the desired
| format(s) upon import, or don't have any videos at all yet as
| in GP's case, it doesn't matter if the hardware is 20x
| slower. Worst case, you just watch that movie in source
| material quality: on a LAN you won't have network speed
| bottlenecks anyway, and transcoding on GPU is much more
| expensive (purchase + ongoing power costs) than the gigabit
| ethernet that you can already find by default on every laptop
| and router
| bicepjai wrote:
| I feel the same way. I now have around 7 projects hosted on a
| home server with Coolify + Cloudflare. Always worry about
| security and I have seen many posts related to self hosting on HN
| trending recently
| SchemaLoad wrote:
| For security just don't expose the server to the internet.
| Either set up wireguard or tailscale. You can set it up in a
| split tunnel config so your phone only uses the VPN for LAN
| requests.
| bicepjai wrote:
| I am expecting Cloudflare Tunnel to take care of security. In
| fact, that is the only reason I am okay hosting from home.
| Are you talking about something more on top of Cloudflare
| Tunnel or extra security features or a replacement?
| SchemaLoad wrote:
| Cloudflare Tunnel is a very similar solution. Just a
| different product for the same task.
| easterncalculus wrote:
| Nice. This is a great start. The next steps are backups and
| regular security updates. The former is probably pretty easy with
| Claude and a provider like Backblaze, for updates I wonder if
| "check for security issues with my software and update anything
| in need" will work well (and most importantly, how consistently).
| Alternatively, getting the AI to threat model and perform any
| docker hardening measures.
|
| Then someday we self-host the AI itself, and it all comes
| together.
| zrail wrote:
| My security update system is straightforward but it took quite
| a lot of thought to get here.
|
| My self hosted things all run as docker containers inside
| Alpine VMs running on top of Proxmox. Services are defined with
| Docker Compose. One of those things is a Forgejo git server
| along with a runner in a separate VM. I have a single command
| that will deploy everything along with a Forgejo action that
| invokes that command on a push to main.
|
| I then have Renovate running periodically set to auto-merge
| patch-level updates and tag updates.
|
| Thus, Renovate keeps me up to date and git keeps everyone
| honest.
| StrLght wrote:
| > Your home server's new sysadmin: Claude Code
|
| (In)famous last words?
| comrade1234 wrote:
| Prices are going to have an effect here. I have a 76TB backup
| drive of 8 drives. A few months ago one of my 10TB drives failed
| and I replaced it with a 12 TB WD gold for 269CHF. I was thinking
| of building a new backup drive (for fun) and so I priced the same
| drive and now it's 409CHF.
|
| It's not tariffs (I'm in Switzerland). It's 100% the buildout of
| data centers for AI.
| benzguo wrote:
| Great post! Totally agree - agents like Claude Code make self-
| hosting a lot more realistic and low maintenance for the average
| dev.
|
| We've gone a step further, and made this even easier with
| https://zo.computer
|
| You get a server, and a lot of useful built-in functionality
| (like the ability to text with your server)
| danpalmer wrote:
| There's something ironic about using Claud Code - a closed source
| service, that you can't self-host the hardware for, and that you
| can't get access to the data for - to self-host so that you can
| reduce your dependencies on things.
| SchemaLoad wrote:
| Before you had to rely on blog posts and reddit for
| information, something you also couldn't self host. And if you
| are just asking it questions and taking actions yourself, you
| are learning how it works to do it yourself next time.
| danpalmer wrote:
| Or you could read man pages, ask people for help, read
| books... all of which are more closely aligned with self-
| hosting than outsourcing the whole process.
|
| I agree you could use LLMs to learn how it works, but given
| that they explain and do the actions, I suspect the vast
| majority aren't learning anything. I've helped students who
| are learning to code, and very often they just copy/paste
| back and forth and ignore the actual content.
| SchemaLoad wrote:
| Sure, you could. But this isn't my job, it isn't my career.
| I just want Nextcloud running on a machine at home. I know
| linux and docker well enough to validate the ideas coming
| out of Gemini, and it helps me find stuff much faster than
| if I had to read man pages or read books.
|
| And I find the stuff that the average self hoster needs is
| so surface level that LLMs flawlessly provide solutions.
| danpalmer wrote:
| My push back isn't really on the possibility, it's on the
| irony. Self hosting is for many an ideological act that's
| about reducing dependencies on big tech, removing
| surveillance, etc. LLMs are essentially the antithesis of
| this.
|
| If you're self hosting for other reasons then that's
| fine. I self host media for various reasons, but I also
| give all my email/calendar/docs/photos over to a big tech
| company because I'm not motivated by that aspect.
| SchemaLoad wrote:
| Kind of but I don't really agree. Before LLMs you were
| still reliant on online resources, forums, digitalocean
| blog posts. The server itself also doesn't rely on an
| LLM. If one goes down, your server will continue
| functioning. You are also not tied to any particular LLM
| and can freely switch.
|
| They also aren't seeing any of your sensitive data being
| hosted on the server. At least the way I use them is
| getting suggestions for what software and configs I
| should go with, and then I do the actual doing. Which
| means I'm becoming independently more capable than I was
| before.
| johnisgood wrote:
| That would be ideal, but there are software engineers who
| use Tailscale, so I think our expectations are too high.
| raincole wrote:
| If I google how to host a Wordpress blog are you going to tell
| me what I am doing is "ironic" because Google is not hosted by
| me? Even more ironic, Google has a competing product, blogspot!
| How ironic!
| itchingsphynx wrote:
| Ahh yes, the irony is not lost on using a paid closed-source
| service to create and help manage a self-hosted service running
| FOSS. I thought it was because I didn't want to pay SAAS
| subscription costs, but now I just need Claude Pro...
|
| I'm asking Claude technical questions about setup, e.g., read
| this manual, that I have skimmed but don't necessarily fully
| understand yet. How do I monitor this service? Oh connect
| Tailscale and manage with ACLs. But what do I do when it
| doesn't work or goes down? Ask Claude.
|
| To get more accurate setup and diagnostics, I need to share
| config files, firewall rules, IPv6 GUAs, Tailscale ACLs... and
| Claude just eats it up, and now Anthropic knows it forever too.
| Sure, CGNET, Wireguard, and ssh logins stand between us, but...
| Claude is running a terminal window on a LAN device next to
| another terminal window that does have access to my server. Do
| I trust VS Code? Anthropic? The FOSS? Is this really self-
| hosting? Ahh, but I am learning stuff, right?
| __MatrixMan__ wrote:
| There is, but if I have to chose between tolerating the irony,
| and waiting for the hardware/model performance situation to
| improve before getting started, I'll ironically mark self-
| hosting a claude-equivalent as a TODO and get started on the
| other stuff now.
| chaz6 wrote:
| I would really like some kind of agnostic backup protocol, so I
| can simply configure my backup endpoint using an environment
| variable (e.g. `-e
| BACKUP_ENDPOINT=https://backup.example.com/backup -e
| BACKUP_IDENTIFIER=xxxxx`), then the application can push a backup
| on a regular schedule. If I need to restore a backup, I log onto
| the backup app, select a backup file and generate a one time code
| which I can enter into the application to retrieve the data. To
| set up a new application for backups, you would enter a friendly
| name into the backup application and it would generate a key for
| use in the application.
| dangus wrote:
| I use Pika Backup which runs on the BorgBackup protocol for
| backing up my system's home directory. I'm not really sure if
| this is exactly what you're talking about, though. It just
| sends backups to network shares.
| cryostasis wrote:
| I'm actively in the process of setting this up for my
| devices. What have you done for off-site backups? I know
| there are Borg specific cloud providers (rsync.net, borgbase,
| etc.). Or have you done something like rclone to an S3
| provider?
| dangus wrote:
| No off-site backup for me, these items aren't important
| enough, it's more for "oops I broke my computer" or "set my
| new computer up faster" convenience.
|
| Anything I really don't want to lose is in a paid cloud
| service with a local backup sync over SMB to my TrueNAS box
| for some of the most important ones.
|
| An exception is GitHub, I'm not paying for GitHub, but git
| kinda sorta backs itself up well enough for my purposes
| just by pulling/pushing code. If I get banned from GitHub
| or something I have all the local repos.
| cryostasis wrote:
| Good to know! I have shifted more to self hosting, e.g.,
| Gitea rather than Github, and need to establish proper
| redundancy. Hopefully Borg Backup, with it's
| deduplication will be good, at least for on-site backups.
| dangus wrote:
| I am much more in-between. I don't mind cloud stuff and
| even consider it safer than my local stuff due to other
| smart people doing the work. And I'm not looking for a
| second job self hosting, except for my game servers.
|
| I mostly just don't want to be stuck with cloud services
| from big tech that have slimy practices. I'd rather pay
| for honest products that let me own my data better. With
| the exception given to GitHub which I guess is out of my
| own laziness and maybe I should do something about that.
|
| If you're using gitea you might be interested in Forgejo,
| it's a fork and I think it's well regarded since gitea
| went more commercial-ish IIRC?
| Waterluvian wrote:
| Maybe apps could offer backup to stdout and then you pipe it.
| That way each app doesn't have to reason about how to interact
| with your target, doesn't need to be trusted with credentials,
| and we don't need a new standard.
| PaulKeeble wrote:
| At the moment I am docker compose down everything, run the
| backup of their files and then docker compose up -d again
| afterwards. This sort of downtime in the middle of the night
| isn't an issue for home services but its also not an ideal
| system given most wont be mid writing a file at the time of
| backup anyway because its the middle of the night! But if I
| don't do it the one time I need those files I can guarantee it
| will be corrupted so at the moment don't feel like there are a
| lot of other options.
| ibizaman wrote:
| I'm working on introducing this kind of protocol in NixOS. I
| called it contracts. https://github.com/NixOS/rfcs/pull/189
|
| The idea is a contract is defined saying which options exist
| and what they mean. For backups, you'd get the Unix user doing
| the backup, what folders to backup and what patterns to
| exclude. But also what script can be run to create a backup and
| restore from a backup.
|
| Then you'd get a contract consumer, the application to be
| backup, which declares what folders to backup either which
| users.
|
| On the other side you have a contract provider, like Restic or
| Borgbackup which understand this contract and know thanks to it
| how to backup the application.
|
| As the user, your role is just to plug-in a contract provider
| with a consumer. To choose which application backs up which
| application.
|
| This can be applied to LDAP, SSO, secrets and more!
| elemdos wrote:
| I've also found AI to be super helpful for self-hosting but in a
| different way. I set up a Pocketbase instance with a Lovable-like
| app on top (repo here: https://github.com/tinykit-studio/tinykit)
| so I can just pull out my phone, vibecode something, and then
| instantly host it on the one server with a bunch of other apps.
| I've built a bunch of stuff for myself (journal, CRM, guitar
| tuner) but my favorite thing has been a period tracker for a
| close friend who didn't want that data tracked + sold.
| 1shooner wrote:
| Others here mention Coolify for a homeserver. If you're looking
| for turnkey docker-compose based apps rather than just
| framework/runtime environments, I will recommend the runtipi
| project. I have found it to be simple and flexible. It offers an
| 'app store' like interface, and supports hosting your own app
| store. It manages certs and reverse proxy via traefik as well.
|
| https://runtipi.io/
| indigodaddy wrote:
| Cosmos Cloud is great too. I use it on a free tier OCI Ampere
| 24G VM
|
| https://cosmos-cloud.io/
| austin-cheney wrote:
| I have found that storage is up in price more than 60% from last
| year.
|
| I am writing a personal application to simplify home server
| administration if anybody is interested:
| https://github.com/prettydiff/aphorio
| tezza wrote:
| Wait... tailscale connection to your own network, and
| unsupervised sysadmin from an oracle that hallucinates and bases
| its decisions on blog post aggregates?
|
| p0wnland. this will have script kiddies rubbing their hands
| asciii wrote:
| Hope OP has nice neighbors because sharing that password is
| basically keys to this kingdom
| jordanf wrote:
| sharing what password?
| amelius wrote:
| > The reason is simple: CLI agents like Claude Code make self-
| hosting on a cheapo home server dramatically easier and actually
| fun.
|
| But I want to host an LLM.
| shamiln wrote:
| Tailscsle was never the unlock for me, but I guess I never was
| the typical use case here.
|
| I have a 1U (or more), sitting in a rack in a local datacenter. I
| have an IP block to myself.
|
| Those servers are now publicly exposed and only a few ports are
| exposed for mail, HTTP traffic and SSH (for Git).
|
| I guess my use case also changes in that I don't use things just
| for me to consume, select others can consume services I host.
|
| My definition here of self-hosting isn't that I and I only can
| access my services; that's be me having a server at home which
| has some non critical things on it.
| zrail wrote:
| Curious how long you've been sitting on the IP block. I've been
| nosing around getting an ASN to mess around with the lower
| level internet bones but a /24 is just way too expensive these
| days. Even justifying an ASN is hard, since the minimum cost is
| $275/year through ARIN.
| bakies wrote:
| Is that the minimum for an ASN? /24 is a lot of public IP
| space! I'd expect just to get a static IP from and ISP if I
| were to coloc like this
| zrail wrote:
| The minimum publicly routable IPv4 subnet is /24 and IPv6
| is /48. IPv6 is effectively free, there are places that
| will lease a /48 for $8/year, whereas as far as I can tell
| it's multiple thousands of USD per year to acquire or lease
| a /24 of IPv4.
| wswin wrote:
| Home NAS servers are already shipped with user friendly GUI.
| Personally I haven't used them, but I certainly would prefer it,
| or recommend it to tech-illitarate people instead of allowing LLM
| to manage the server.
| zebnyc wrote:
| Basic question: If I wanted a simple self hosting solution for a
| bot with a database, what is the simplest solution / provider I
| can go with. This bot is just for me doesn't need to be
| accessible to the general public.
|
| Thanks
| chasing0entropy wrote:
| Ask chatGPT bro
| cryptica wrote:
| I started self-hosting after noticing that my AWS bill increased
| from like $300 per month to $600 per month within a couple of
| years. When looking at my bill, 3/4 of the cost was 'AWS Other';
| mostly bandwidth. I couldn't understand why I was paying so much
| for bandwidth given that all my database instances ran on the
| same host as the app servers and I didn't have any regular
| communication between instances.
|
| I suspect it may have been related to the Network File System
| (NFS)? Like whenever I read a file on the host machine, it goes
| across the data-center network and charges me? Is this correct?
|
| Anyway, I just decided to take control of those costs. Took me 2
| weeks of part-time work to migrate all my stuff to a self-hosted
| machine. I put everything behind Cloudflare with a load balancer.
| Was a bit tricky to configure as I'm hosting multiple domains
| from the same machine. It's a small form factor PC tower with 20
| CPU cores; easily runs all my stuff though. In 2 months, I
| already recouped the full cost of the machine through savings in
| my AWS bill. Now I pay like $10 a month to Cloudflare and even
| that's basically an optional cost. I strongly recommend.
|
| Anyway it's impressive how AWS costs had been creeping slowly and
| imperceptibly over time. With my own machine, I now have way more
| compute than I need. I did a calculation and figured out that to
| get the same CPU capacity (no throttling, no bandwidth
| limitations) on AWS, I would have to pay like $1400 per month...
| But amortized over 4 years my machine's cost is like $20 per
| month plus $5 per month to get a static IP address. I didn't need
| to change my internet plan other than that. So AWS EC2
| represented a 56x cost factor. It's mind-boggling.
|
| I think it's one of these costs that I kind of brushed under the
| carpet as "It's an investment." But eventually, this cost became
| a topic of conversation with my wife and she started making jokes
| about our contribution to Jeff Bezos' wife's diamond ring. Then
| it came to our attention that his megayacht is so large that it
| comes with a second yacht beside it. Then I understood where he
| got it all from. Though to be fair to him, he is a truly great
| businessman; he didn't get it from institutional money or complex
| hidden political scheme; he got it fair and square through a very
| clever business plan.
|
| Over 5 years or so that I've been using AWS, the costs had been
| flat. Meanwhile the costs of the underlying hardware had dropped
| to like 1/56th... and I didn't even notice. Is anything more
| profitable than apathy and neglect?
| jdsully wrote:
| The most likely culprit was talking to other nodes via their
| public IP instead of their local ones. That gets billed as
| interent traffic (most expensive). The second culprit is your
| database or other nodes are in different AZs and you get a
| x-zone bandwidth charge.
|
| Bandwidth inside the same zone is free.
| dwd wrote:
| Been self-hosting for last 20 years and I would have to say LLMs
| were good for generating suggestions when debugging an issue I
| hadn't seen before, or for one I had seen before but was looking
| for a quicker fix. I've used it to generate bash scripts,
| firewall regex.
|
| On self-hosting: be aware that it is a warzone out there. Your IP
| address will be probed constantly for vulnerabilities, and even
| those will need to dealt with as most automated probes don't
| throttle and can impact your server. That's probably my biggest
| issue along with email deliverability.
| MrDarcy wrote:
| The best solution I've found for probes is to put all eggs into
| the basket listening on 443.
|
| Haproxy with SNI routing was simple and worked well for many
| years for me.
|
| Istio installed on a single node Talos VM currently works very
| well for me.
|
| Both have sophisticated circuit breaking and ddos protection.
|
| For users I put admin interfaces behind wireguard and block TCP
| by source ip at the 443 listener.
|
| I expose one or two things to the public behind an oauth2-proxy
| for authnz.
|
| Edit: This has been set and forget since the start of the
| pandemic on a fiber IPv4 address.
| aaronax wrote:
| And use a wildcard cert so that all your services don't get
| proved due to cert transparency logs.
| SchemaLoad wrote:
| These days I just wouldn't put my homeserver exposed to the
| internet only. LAN only with a VPN. Does mean you can't share
| links and such with other people, but your server is now very
| secure and most of the stuff you do on it doesn't need public
| access anyway.
| FaradayRotation wrote:
| ~10 years ago I remember how shocked I was the first time I saw
| how many people were trying to probe my IP on my home router,
| from random places all over the globe.
|
| Years later I still had the same router. Somewhere a long the
| line, I fired the right neurons and asked myself, "When was the
| last time $MANUFACTURER published an update for this? It's been
| awhile..."
|
| In the context of just starting to learn about the fundamentals
| of security principles and owning your own data (ty hackernews
| friends!), that was a major catalyst for me. It kicked me into
| a self-hosting trajectory. LLMs have saved me a lot of extra
| bumps and bruises and barked shins in this area. They helped me
| go in the right direction fast enough.
|
| Point is, parent comment is right. Be safe out there. Don't let
| your server be absorbed into the zombie army.
| syndacks wrote:
| Can the same thing be said for using docker compose etc on a VPS
| to host a web app? Ie you can get the ergonomic / ease of using
| Fly, Renderer?
|
| Historically, managed platforms like Fly.io, Render, and
| DigitalOcean App Platform existed to solve three pain points: 1.
| Fear of misconfiguring Linux 2. Fear of Docker / Compose
| complexity 3. Fear of "what if it breaks at 2am?"
|
| CLI agents (Claude Code, etc.) dramatically reduce (1) and (2),
| and partially reduce (3).
|
| So the tradeoff has changed from:
|
| "Pay $50-150/month to avoid yak-shaving" - "Pay $5-12/month and
| let an agent do the yak-shaving"
| recvonline wrote:
| I started the same project end of last year and it's true -
| having an LLM guide you through the setup and writing docs is a
| real game changer!
|
| I just wish this post wasn't written by an LLM! I miss the days
| where you can feel the nerdy joy through words across the
| internet.
| chasd00 wrote:
| What I do at home is ubuntu on a cheap small computer I found on
| ebay. ufw blocks everything except 80, 443, and 22. Setup ssh to
| not use passwords and ensure nginx+letsencrypt doesn't run as
| root. Then, forward 80 and 443 from my home router to the server
| so it's reachable from the internet. That's about it, now I have
| an internet accessible reverse proxy to surface anything running
| on that server. The computers on the same LAN (just my laptop
| basically) have host file entries for the server. My registrar
| handles DNS for the external side (routers public ip). Ssh'ing to
| the server requires a lan IP but that's no big deal I'm at home
| whenever I'm working on it anyway.
| dizhn wrote:
| Put wireguard on that thing and don't expose anything on your
| public IP. Better yet don't have a public IP. Just port forward
| the wireguard IP from your router. That's it. No firewall no
| nothing. Not even accidental exposure.
| drnick1 wrote:
| > Put wireguard on that thing and don't expose anything on
| your public IP. Better yet don't have a public IP.
|
| This is nonsense. You can't self-host services meant to
| interact with the public (such as email, websites, Matrix
| servers, etc.) without a public IP, preferably one that is
| fixed.
| tstrimple wrote:
| Sure you can. It's what cloudflared and services like it
| are designed for.
| drnick1 wrote:
| Is it still self-hosting though?
| hooo wrote:
| You just need to keep the DNS record updated.
| dizhn wrote:
| Of course it is. You get to maintain all the server
| architecture yourself.
|
| I don't have a need to give people public access but if I
| did I would set up Authentik and proxy everything through
| it and hand out usernames to people I want for the whole
| thing (or per app). You would open only :443 and not
| worry about a thing.
|
| As a bonus use caddy as forward auth, create a wildcard
| subdomain (cloudflare dns supports it), configure caddy
| for wildcard domains for sub-sub domains and dns cert
| verification via cloudflare token. This way nobody even
| knows your real domain names. Nothing they can see in DNS
| or certificate transparency logs. (This is my working
| theory. I haven't actually researched it too deep but I
| am doing it.) You add a new app/site in caddy's config
| and everything else is completely automatic. You can even
| use dynamic dns with a client or a script that uses the
| same cloudflare token to update your IP.
|
| As I said above. Don't even need to have a public IP on
| this machine. Better if you don't in case something like
| docker or an AI agent accidentally opens a port. (Your
| router already protects you but I am talking about if
| this was on a cloud host or an ISP that gives you real
| IPs for each of your machines)
| nick2k3 wrote:
| All fine and great with Tailscale until you company places an iOS
| restriction on external VPNs and your work phone is also your
| primary phone :(
| jacobthesnakob wrote:
| My work WiFi blocked traffic to port 51820, the default
| WireGuard port. I was wondering why my VPN started failing to
| handshake one day. I changed my ports to 51821 that night and
| back in business. I checked our technology policy and there's
| no "thou shalt not use a VPN" clause so no clue why someone one
| day decided to drop WireGuard traffic on the network.
| teiferer wrote:
| Restrict use of private devices?
|
| Though just blocking particular ports for this purpose is
| very 90s and obviously ineffective, as you demonstrated.
| Anybody proficient in installing wireguard also knows how to
| change ports.
| ivanjermakov wrote:
| Usually you can ask for a separate phone for work. I can't
| stand when personal devices are poisoned with Intune and other
| company crap.
| teiferer wrote:
| > your work phone is also your primary phone :(
|
| That's the flaw right there. Don't mix company assets with
| pricate use. Phone, laptop, car. Your life is already very
| dependent on your employer (through income), don't get yourself
| locked in even more by depending on them for personal tech.
| Plus it's a security risk to your company.
|
| Unless you have a low paying job, which rarely anybody on HN
| does, you can afford your own phone and laptop. And IT won't
| find your messages to girlfriend or pictures you don't want
| others to see or browsing history.
| CuriouslyC wrote:
| Tailscale is pretty sweet. Cloudflare WARP is also pretty sweet,
| a little clunkier but you get argo routing for free and I trust
| Cloudflare for security.
| JodieBenitez wrote:
| So it's self hosting but with a paid and closed saas dependency ?
| I'll pass.
| HarHarVeryFunny wrote:
| Doesn't have to be that way though. As discussed here recently,
| a basic local agent like Claude Code is only a couple hundred
| lines of code, and could easily be written by something like
| Claude Code if you didn't want to do it yourself.
|
| If you have your own agent, then it can talk to whatever you
| want - could be OpenRouter configured to some free model, or
| could be to a local model too. If the local model wasn't
| knowledgeable enough for sysadmin you could perhaps use
| installable skills (scripts/programs) for sysadmin tasks, with
| those having been written by a more powerful model/agent.
| RicoElectrico wrote:
| I just use Proxmox on Optiplex 3060 micro. On it, a Wireguard
| tunnel for remote admin. The ease of creating and tearing down
| dedicated containers makes it easy to experiment.
| esbeeb wrote:
| I too have that same Dell Optiplex 3060 micro. I love it for
| experimenting also. Also use wireguard for remote access. I use
| incus for my Linux containers, preferring it to proxmox.
| fhennig wrote:
| I think it's great that people are getting into self-hosting, but
| I don't think it's _the_ solution to get us off of big tech.
|
| Having others run a service for you is a good thing! I'd love to
| pay a subscription for a service, but ran as a cooperative, where
| I'm not actually just paying a subscription fee, instead I'm a
| member and I get to decide what gets done as well.
|
| This model works so well for housing, where the renters are also
| the owners of the building. Incentives are aligned perfectly,
| rents are kept low, the building is kept intact, no unnecessary
| expensive stuff added. And most importantly, no worries of the
| building ever getting sold and things going south. That's what I
| would like for my cloud storage, e-mail etc.
| sroerick wrote:
| Hey, I was thinking about this same idea lately. What exactly
| would you want hosted by somebody?
|
| I was thinking about what if your "cloud" was more like a
| tilde.club, with self hosted web services plus a Linux login.
| What services would you want?
|
| Email and cloud make sense. I think a VPN and Ad Blocker would
| too. Maybe Immich and music hosting? Calendar? I don't know
| what people use for self hosting
| fhennig wrote:
| I don't actually need much, I think basically just encrypted
| cloud storage would be great. If there was something like
| proton mail, but ran as a co-op, I'd also use that (it has
| great calendar support too).
|
| I'd really focus on it being usable for non-techies, I don't
| think I'd want a linux login for anything. IMO, the focus
| should be on the basic infrastructure of digital life for the
| everyday person.
|
| tilde.club sounds interesting though! Hadn't heard of it
| before.
| tech_ken wrote:
| My (admittedly a bit tinfoil) take on the recent self-hosting
| boom is that it's highly compatible with individualist suburban
| capitalism; and that while there are elements of it that offer
| an alternative path to techno-feudalism, by itself it doesn't
| really challenge the underlying ideology. It's become highly
| consumerist, and seems more like a way of expressing
| taste/aesthetics than something that's genuinely revolutionary.
| Cooperative services (as you describe) seem like they offer a
| way more legitimate challenge, but I feel like that's a big
| reason why they don't see as much fete-ing in the mainstream
| tech media and industry channels.
|
| I say all this as someone who's been self-hosting services in
| one form or another for almost a decade at this point. The
| market incorporation/consumerfication of the hobby has been so
| noticeable in the last five years. Even this AI thing seems
| like another step in that direction; now even non-experts can
| drop $350+ on consumer hardware and maybe $100 on some network
| gear so that they can control their $50/bulb Hue lights and
| manage their expansive personal media collection.
| fhennig wrote:
| Interesting! I'm not sure how severe the consumerisation
| really is, but yeah I can totally see the whole home-
| automation thing playing into it too.
|
| I don't think mainstream tech media is deliberately omitting
| co-ops in their reporting due to them challenging the status
| quo. I think it's rather that actually, there aren't really
| many initiatives in the space.
|
| And I think that is due to a lot of tech people thinking that
| if only the technology becomes good enough, then the problem
| will be solved, then, finally, everyone can have their own
| cloud at home.
|
| I think that's wrong though, I think the solution in this
| case is that we organize the service differently, with power
| structured in a different way. We don't need more software to
| solve the problem. We know how to build a cloud services,
| technically. We know how to do it will. It's just that if the
| service is run for-profit, counter to the interests of the
| users, it will eventually become a problem for the users.
| That's the problem to fix, and it's not one to fix with
| technology, but just with organizing it differently.
|
| It works for housing, in some areas it also works for
| utilities like internet, there are also co-ops for food. Why
| shouldn't it also work for modern-day utilities like cloud
| storage and email?
|
| As a techie, don't be content with just running your own
| self-hosted service. Run it for your family, run it for your
| friends, run it for your neighborhood! Band together!
| tech_ken wrote:
| > It's just that if the service is run for-profit, counter
| to the interests of the users, it will eventually become a
| problem for the users. That's the problem to fix, and it's
| not one to fix with technology, but just with organizing it
| differently.
|
| 100% agree with you here, and yeah I'm definitely leaning a
| bit too conspiratorial about it. It's probably not actually
| intentional, and instead just a product of the larger
| dynamics.
|
| A while ago I read some interesting economic analysis about
| why more co-ops hadn't popped up specifically in the gig
| worker space, since it seems to natural to cut out the
| platform rent that eg. Uber extracts as profit. I'm failing
| to recall the specific conclusions, but IIRC the authors
| seemed to feel that there were some structural obstacles
| preventing co-ops from growing in those space. Something
| something capex and unit costs. It's certainly an area I'd
| be interested to see further analysis in.
|
| Also you sounds like you might get a kick out of
| mayfirst.coop (if you're not familiar with them already).
| It's not exactly what you're describing, but the spirit is
| there. I use them for my web-hosting needs and have been
| extremely satisfied.
| ibizaman wrote:
| What about self-hosting as a service? You get a server in your
| home which you own with your open source software and data in
| it. And you pay a subscription to have a remote sysadmin take
| care of maintenance for you and can train you on the software?
| What happens if you don't pay anymore is you keep everything.
| But like a good insurance, you'd keep the subscription because
| of top notch customer service.
| fhennig wrote:
| I want something that can work for non-techies too, that I
| can recommend to my friends as well.
| ibizaman wrote:
| I fully understand. That's my goal too and what I want to
| provide here. No technical knowledge is required.
| nojs wrote:
| This post is spot on, the combo of tailscale + Claude Code is a
| game changer. This is particularly true for companies as well.
|
| CC lets you hack together internal tools quickly, and tailscale
| means you can safely deploy them without worrying about hardening
| the app and server from the outside world. And tailscale ACLs
| lets you fully control who can access what services.
|
| It also means you can literally host the tools on a server in
| your office, if you really want to.
|
| Putting CC on the server makes this set up even better. It's
| extremely good at system admin.
| fassssst wrote:
| Umm, what happened to zero trust? Network security is not
| sufficient.
| thrownawaysz wrote:
| I went down the self host route some years ago but once critical
| problems hit I realized that beyond a simple NAS it can be a very
| demanding hobby.
|
| I was in another country when there was a power outage at home.
| My internet went down, the server restart but couldn't reconnect
| anymore because the optical network router also had some problems
| after the power outage. I could ask my folks to restart, and turn
| on off things but nothing more than that. So I couldn't reach my
| Nextcloud instance and other stuff. Maybe an uninterruptible
| power supply could have helped but the more I was thinking about
| it after just didn't really worth the hassle anymore. Add a UPS
| okay. But why not add a dual WAN failover router for extra
| security if the internet goes down again? etc. It's a bottomless
| pit (like most hobbies tbh)
|
| Also (and that's a me problem maybe) I was using Tailscale but
| I'm more "paranoid" about it nowadays. Single point of failure
| service, US-only SSO login (MS, Github, Apple, Google), what if
| my Apple account gets locked if I redeem a gift card and I can't
| use Tailscale anymore? I still believe in self hosting but
| probably I want something even more "self" to the extremes.
| cyberax wrote:
| Long time ago, it was popular for ISPs offer a small amount of
| space for personal websites. We might see a resurgence of this,
| but with cheap VPS. Eventually.
| SchemaLoad wrote:
| Free static site hosting and cheap VPSs already exist. Self
| hosting is less about putting sites on the internet now and
| more about replicating cloud services locally.
| Imustaskforhelp wrote:
| VPS's are really so dirt cheap that some of them only work
| because people dont use the servers 100% that they are
| allocated at or when people dont use the resources they
| have for most part because of economies of scale but vps's
| are definitely subsidized.
|
| Cheap vps servers 1 gb ram and everything can cost around
| 10-11$ per year and using something like hetzner's cheap as
| well for around 30$ ish an year or 3$ per month most likely
| while having some great resilient numbers and everything
|
| If anything, people self host because they own servers so
| upgrading becomes easier (but there are vps's which target
| a niche which people should look at like storage vps, high
| perf vps, high mem vps etc. which can sometimes provide
| servers for dirt cheap for your specific use case)
|
| The other reason I feel like are the ownership aspect of
| things. I _own_ this server, I can _upgrade this server_
| without costing a bank or like I can stack up my investment
| in a way and one other reason is that with your complete
| ownership, you don 't have to enforce t&c's so much. Want
| to provide your friends or family vps servers or people on
| internet themselves? Set up a proxmox or incus server and
| do it.
|
| Most vps servers sometimes either outright ban reselling or
| if they allow, they might sometimes ban your whole account
| for something that someone else might have done so
| somethings are at jeopardy if you do this simply because
| they have to find automated ways of dealing with abuse at
| scale and some cloud providers are more lenient than others
| in banning matters. (OVH is relaxed in this area whereas
| hetzner, for better or for worse, is strict on its
| enforcement)
| SchemaLoad wrote:
| Self hosting for me is important because I want to secure
| the data. I've got my files and photos on there, I want
| to have the drive encrypted with my key. Not just sitting
| on a drive I don't have any control over. Also because it
| plugs in to my smart home devices which requires being on
| the local network.
|
| For something like a website I want on the public
| internet with perfect reliability, a VPS is a much better
| option.
| tehlike wrote:
| Starlink backup sounds fun now!
| thrownawaysz wrote:
| Way too expensive for that imo (but then again might as well
| just go all in). Probably a 5G connection is more than enough
| Imustaskforhelp wrote:
| Honestly I think that there must be adapters which can use
| unlimited 5g sim's data plans as fallback network or
| perhaps (even primary?)
|
| They would be cheaper than starlink fwiw and most
| connections can be robust usually.
|
| That being said, one can use tailscale or cloudflare
| tunnels to expose the server even if its behind nat which
| you mention in your original comment that you might be
| against at for paranoid reasons and thats completely fine
| but there are ways to go do that if you want as well which
| I have talked about it on the other comment I have written
| here in-depth.
| numpad0 wrote:
| Some SOHO branch office routers like Cisco ISR models can
| take cellular dongles and/or SIM. Drivers for supported
| models are baked into ROM and everything works through
| CLI.
| Imustaskforhelp wrote:
| man I have this vague memory that I was at a neighbour's
| house and we were all kids and internet wasn't that
| widespread (I was really young) and I remember that they
| had this dongle in which they inserted an sim card in for
| network access. This is why this idea has always
| persisted in my head in the first place.
|
| I don't know what's the name of dongle though, it was
| similar to those sd card to usb thing ykwim, I'd
| appreciate it if someone could help find this too if
| possible
|
| but also yeah your point is also fascinating as well,
| y'know another benefit of doing this is that atleast in
| my area, 5g (500-700mbps) is really cheap (10-15$) with
| unlimited bandwidth per month and on the ethernet side of
| things I get 10x less bandwidth (40-80mbps) so much so
| that me and my brother genuinely thought of this idea
|
| except that we thought that instead of buying a router
| like this, we use an old phone device and insert sim in
| it and access router through that way.
| tehlike wrote:
| I would do this on OPNSense - with a separate WLAN.
| Fairly easy to do.
| JamesSwift wrote:
| Well, its not a bottomless pit really. Yes you need a UPS.
| That's basically it though.
| bisby wrote:
| Power outages here tend to last an hour or more. A UPS
| doesn't last forever, and depending on how much home compute
| you have, might not last long enough for anything more than a
| brief outage. A UPS doesn't magically solve things. Maybe you
| need a home generator to handle extended outages...
|
| How bottomless of a pit it becomes depends on a lot of
| things. It CAN become a bottomless pit if you need perfect
| uptime.
|
| I host a lot of stuff, but nextcloud to me is photo sync, not
| business. I can wait til I'm home to turn the server back on.
| It's not a bottomless pit for me, but I don't really care if
| it has downtime.
| jmb99 wrote:
| Fairly frequently, 6kVA UPSs come up for sale locally to
| me, for dirt cheap (<$400). Yes, they're used, and yes,
| they'll need ~$500 worth of batteries immediately, but they
| will run a "normal" homelab for multiple hours. Mine will
| keep my 2.5kW rack running for at least 15 minutes - if
| your load is more like 250W (much more "normal" imo)
| that'll translate to around 2 hours of runtime.
|
| Is it perfect? No, but it's more than enough to cover most
| brief outages, and also more than enough to allow you to
| shut down everything you're running gracefully, after you
| used it for a couple hours.
|
| Major caveat, you'll need a 240V supply, and these guys are
| 6U, so not exactly tiny. If you're willing to spend a bit
| more money though, a smaller UPS with external battery
| packs is the easy plug-and-play option.
|
| > How bottomless of a pit it becomes depends on a lot of
| things. It CAN become a bottomless pit if you need perfect
| uptime.
|
| At the end of the day, it's very hard to argue you need
| perfect uptime in an extended outage (and I say this as
| someone with a 10kW generator and said 6kVA UPS). I _need_
| power to run my sump pumps, but that 's about it - if
| power's been out for 12-18 hours, you better believe I'm
| shutting down the rack, because it's costing me a crap ton
| of money to keep running on fossil fuels. And in the two
| instances of extended power outages I've dealt with, I
| haven't missed it - believe it or not, there's usually more
| important things to worry about than your Nextcloud uptime
| when your power's been out for 48 hours. Like "huh, that
| ice-covered tree limb is really starting to get close to my
| roof."
| Aurornis wrote:
| This is a great example of how the homelab bottomless pit
| becomes normalized.
|
| Rewiring the house for 240V supply and spending $400+500
| to refurbish a second-hand UPS to keep the 2500W rack
| running for 15 minutes?
|
| And then there's the electricity costs of running a 2.5kW
| load, and then cooling costs associated with getting that
| much heat out of the house constantly. That's like a
| space heater and a half running constantly.
| Aurornis wrote:
| UPS batteries don't last forever.
|
| So now you need to test them regularly. And order new ones
| when they're not holding a charge any more. Then power down
| the server, unplug it, pull the UPS out, swap batteries, etc.
|
| Then even when I think I've got the UPS automatic shutdown
| scripts and drivers finally working just right under linux, a
| routine version upgrade breaks it all for some reason and I'm
| spending another 30 minutes reading through obscure docs and
| running tests until it works again.
| JamesSwift wrote:
| Not sure what to say then. I run nixos on ~15 different VMs
| / minipcs, a total of I guess 6 physical machines. Never
| had to deal with a UPS battery dying, and havent had to do
| anything to address NUT breaking. I broadcast NUT via
| synology NAS though, so the only direct client of the UPS
| status is the NAS. Ive never once had an issue in the ~5
| years Ive had it setup like this.
| joshvm wrote:
| My home server doesn't need to be high availability, and the
| BIOS is set to whatever state prior to power loss. I don't
| have a UPS. However, we were recently hit with a telco outage
| while visiting family out of town. As far as I can tell there
| wasn't a power outage, but it took a hard reboot of the modem
| to get connectivity back. Frustrating because it meant no
| checking home automation/security and of course no access to
| the servers. I'm not at a point where my homelab is important
| enough that I would invest in a redundant WAN though.
|
| I've also worked in environments where the most pragmatic
| solution was to issue a reboot periodically and accept the
| minute or two of (external) downtime. Our problem is probably
| down to T-Mobile's lousy consumer hardware.
| JamesSwift wrote:
| As another commenter said (but got downvoted to oblivion
| for some reason), its not really about uptime for the
| homelab, its about graceful shutdown/restart. And theres
| well defined protocols for it (look up network ups tools,
| aka NUT).
| advael wrote:
| Yea I think my own preference for self-hosting boils down to a
| distrust of a continuous dependency on a service in control of
| a company and a desire to minimize such dependencies. While
| there are FOSS and self-hostable alternatives to tailscale or
| indeed claude code, using those services themselves simply
| replaces old dependencies on externally-controlled cloud-based
| services on new ones
| zrail wrote:
| My spouse and I work at home and after the first couple multi-
| day power outages we invested in good UPSs and a whole house
| standby generator. Now when the power goes out it's down for at
| most 30 seconds.
|
| This also makes self-hosting more viable, since our
| availability is constrained by internet provider rather than
| power.
| rootusrootus wrote:
| Yeah we did a similar thing. Same situation, spouse and I
| both work from home, and we got hit by a multiple day power
| outage due to a rare severe ice storm. So now I have an EV
| and a transfer switch so I can go for a week without power,
| and I have a Starlink upstream connection in standby mode
| that can be activated in minutes.
|
| Of course that means we'll not have another ice storm in my
| lifetime. My neighbors should thank me.
| kiddico wrote:
| Thanks for taking one for the team.
| VTimofeenko wrote:
| We had a 5 day outage last year, got a generator at the
| tail end of the windy season and made exact same jokes.
|
| A year later another atmospheric river hit and we had a 4
| hour outage. No more jokes.
|
| Make sure to run that generator once every few months with
| some load to keep it happy.
| rootusrootus wrote:
| Well, it's an EV with a big inverter, not a generator,
| but I get your point. And I do periodically fire it up
| and run the house on it for a little while, just to
| exercise the connection and maintain my familiarity with
| it in case I need to use it late at night in the dark
| with an ice storm breaking all the trees around us.
| VTimofeenko wrote:
| Oh, I see! Genuinely curious -- what kind of EV has a
| battery to power a house for a week?
|
| > maintain my familiarity with it in case I need to use
| it late at night in the dark with an ice storm breaking
| all the trees around us.
|
| That's the way to do it. I usually did my trial runs
| during the day with light readily available but
| underestimated how much I needed to see what I am doing.
| Now there's a grounding plug and a flashlight in the "oh
| shit kit".
| Nextgrid wrote:
| > what kind of EV has a battery to power a house for a
| week?
|
| Assuming their heating, cooking and hot water is gas, a
| house doesn't actually consume that much. With a 50kWh
| battery you can draw just under 300W _continuously_ for a
| week. I 'd expect the average house to draw ~200W with
| lighting and a few electronics, with a lean towards the
| evenings for the lighting.
| VTimofeenko wrote:
| On paper the numbers look right, but a week off _50kWh_
| EV battery feels off.
|
| What follows is back of the napkin calculations, so
| please treat it as such and correct me if I am wrong.
|
| 1. Inverters are not 100% efficient. Let's assume 90%
|
| 2. Let's also assume that the user does not want to draw
| battery to 0 to not become stranded or have to do the
| "Honda generator in the trunk" trick. Extra 10%?
|
| 3. 300W continuous sounds a bit low even with gas
| appliances. Things like the fridge and furnace blower
| have spiky loads that push the daily average. Let's add
| 100W to the average load? I might be being too generous
| here, but I used 300W, not the 200W lower bound.
|
| 4. Vehicle side might need some consumption. If powering
| off the battery, it would probably need to cool the
| battery or keep some smarts on to make sure it does not
| drain or overheat? Genuinely not sure how to estimate
| this, let's neglect it for now.
|
| Math is (50kw - 10%(inverter loss) - 10%(reserve)) / 0.4
| = 100 (hours), ~ 4 days.
|
| The above calculations assume a sane configuration
| (proper bidirectional wire, not suicide cord into 12v
| outlet). Quick skim of search for cars with bidirectional
| charging support for home shows batteries between
| ~40kWh(Leaf) to 250 kWh (Hummer).
|
| So looks like one should be looking for ~80kWh battery,
| which actually most of the cars in the list have.
|
| Again, very back of the napkin, would probably wanna add
| 20% margin of error.
| Nextgrid wrote:
| Actually yes one thing I didn't consider in my
| calculation is the fridge (mostly because it's a spiky
| load that rarely comes on and I based it off my own
| apartment's instantaneous consumption at the time which
| was ~100W since the fridge compressor wasn't running).
|
| Indeed with the fridge it pushes it a bit. But to address
| some of your other points:
|
| > it would probably need to cool the battery
|
| I'd expect if you're in a storm then you probably don't
| need any cooling - not to mention a 300W load is
| _nothing_ for an EV battery compared to actually moving
| the vehicle. I 'd expect some computers in the vehicle to
| be alive but that should be a ~10-20W draw.
|
| On the other hand, my calculation assumes ~300W
| continuous. I expect the consumption to lean into the
| evenings due to the extra lighting, and drop off during
| other times.
|
| But yes 80kWh might very well be what the OP has; I
| intentionally picked 50kWh as the lowest option I found
| on a "<major ev brand> battery kwh" search.
| gorgoiler wrote:
| 2025 was the year of LiFePo power packs for me and my family.
| Absolute game changers: 1000Wh of power with a multi-socket
| inverter and UPS-like failover. You lose capacity over a gas
| genny but the simplicity and lack of fumes adds back a lot of
| value. If it's sunny you can also make your own fuel.
|
| https://www.ankersolix.com/ca/products/f2600-400w-portable-s.
| ..
| Imustaskforhelp wrote:
| Hey, if tailscale is something you are worried about. There are
| open source alternatives to it as well but I think if your
| purpose is to just port forward a simple server port, wouldn't
| ssh in general itself be okay with you.
|
| You can even self host tailscale via headscale but I don't know
| how the experience goes but there are some genuine open source
| software like netbird,zerotier etc. as well
|
| You could also if interested just go the normal wireguard
| route. It really depends on your use case but for you in this
| case, ssh use case seems normal.
|
| You could even use this with termux in android + ssh access via
| dropbear I think if you want. Tailscale is mainly for
| convenience tho and not having to deal with nats and everything
|
| But I feel like your home server might be behind a nat and in
| that case, what I recommend you to do is probably A) run it in
| tor or https://gitlab.com/CGamesPlay/qtm which uses iroh's
| instance but you can self host it too or B (recommended): Get a
| unlimited traffic cheap vps (I recommend Upcloud,OVH,hetzner)
| which would cost around 3-4$ per month and then install
| something like remotemoe https://github.com/fasmide/remotemoe
| or anything similar to it effectively like a proxy.
|
| Sorry if I went a little overkill tho lol. I have played too
| much on these things so I may be overarchitecting stuff but if
| you genuinely want self hosting to the extreme self,
| tor.onion's or i2p might benefit ya but even buying a vps can
| be a good step up
|
| > I was in another country when there was a power outage at
| home. My internet went down, the server restart but couldn't
| reconnect anymore because the optical network router also had
| some problems after the power outage. I could ask my folks to
| restart, and turn on off things but nothing more than that. So
| I couldn't reach my Nextcloud instance and other stuff. Maybe
| an uninterruptible power supply could have helped but the more
| I was thinking about it after just didn't really worth the
| hassle anymore. Add a UPS okay. But why not add a dual WAN
| failover router for extra security if the internet goes down
| again? etc. It's a bottomless pit (like most hobbies tbh)
|
| Laptops have in built ups and are cheap, Laptops and
| refurbished servers are good entry point imo and I feel like
| sure its a bottomless pit but the benefits are well worth it
| and at a point you have to look at trade offs and everything
| and personally laptops/refurbished or resale servers are that
| for me. In fact, I used to run a git server on an android tab
| for some time but been too lazy to figure out if I want it to
| charge permanently or what
| CGamesPlay wrote:
| Thanks for the shout-out! If you have any experiential
| reports using QTM, I'd love to hear them!
| Imustaskforhelp wrote:
| Oh yeah this is a really funny story considering what
| thread we are on, but I remember asking chatgpt or claude
| or gemini or anything xD to make QTM work and none of them
| could figure out
|
| But I think in the end what ended up working was my
| frustration took over and I just copy pasted the commands
| from readme and if I remember correctly, they just worked.
|
| This is really ironical considering on what thread we are
| on but in the end, Good readme's make self hosting on a
| home server easier and fun xD
|
| (I don't exactly remember chatgpt's conversations, perhaps
| they might have helped a bit or not, but I am 99% sure that
| it was your readme which ended up helping and chatgpt etc.
| in fact took an hour or more and genuinely frustrated me
| from what I remember vaguely)
|
| I hope QTM reaches more traction. Its build on solid
| primitives.
|
| One thing I genuinely want you to perhaps take a look at if
| possible is creating an additional piece of software or
| adding the functionality where instead of the careful dance
| that we have to make it work (like we have to send two
| large data pieces from two computers, I had to use some
| hacky solution like piping server or wormhole itself for
| it)
|
| So what I am asking is if there could be a possibility that
| you can make the initial node pairing (ticket?) [Sorry, I
| forgot the name of primitive] between A and B, you use
| wormhole itself and now instead of these two having to send
| large chunks of data between each other, they can now just
| send 6 words or similar
|
| Wormhole: https://github.com/magic-wormhole/magic-wormhole
|
| I even remember building some of my own CLI for something
| liek this and using chatgpt to build it xD but in the end
| gave up because I wasn't familiar with the codebase or how
| to make these two work together but I hope that you can add
| it. I sincerely hope so.
|
| Another minor suggestion I feel like giving is to please
| have asciinema demo. I will create an asciinema patch if
| you want between two computers but a working demo gif from
| 0 -> running really really would've helped me save some/few
| hours
|
| QTM has lots of potential. Iroh is so sane, it can run
| directly on top of ipv4 itself and talk directly if
| possible but it can even break through nats and you can
| even self host the middle part itself. I had thought about
| building such a project when I had first discovered QTM and
| you can just imagine my joy when I discovered QTM from one
| of your comments a long time ago for what its worth
|
| Wishing the best of luck of your project! The idea is very
| fascinating. I would appreciate a visual demo a lot though
| and I hope we can discuss more!
|
| Edit: I remember that qtm docs had this issue of where they
| really felt complex for me personally when all I wanted was
| one computer port mapped to another computer port and I
| think what helped in the end was the 4th comment if I
| remember correctly, I might have used LLM assistance or not
| or if it helped or not, I genuinely don't remember but it
| definitely took me an hour or two to figure things out but
| its okay since I still feel like the software is definitely
| positive and this might have been a skill issue from my
| side but I just want if you can add asciinema docs, I can't
| stress it enough if possible on how much it can genuinely
| help an average person to figure out the product.
|
| (Slowly move towards the complex setups with asciinema
| demos for each of them if you wish)
|
| Once again good luck! I can't stress qtm and I still
| strongly urge everyone to try qtm once
| https://gitlab.com/CGamesPlay/qtm since its highly relevant
| to the discussion
| CGamesPlay wrote:
| You aren't actually supposed to ever need to deal with
| tickets manually, unless you are trying to get a tunnel
| between two machines and neither can SSH into the other.
| It could be streamlined with something like Magic
| Wormhole, though. I'll add that to the backlog and see if
| there's interest. The normal way is to use SSH / docker
| exec / any remote shell to let QTM swap the tickets over
| it.
|
| I've added an asciinema to the README now
| <https://asciinema.org/a/z2cdsoVDVJu0gIGn>, showing the
| manual connection steps. Thanks for the kind words. Hope
| you find it useful!
| Imustaskforhelp wrote:
| well my use case is the fact of connecting two servers
| behind nat. If I were to be able to gain ssh lets say,
| then I could've simply port forwarded in the first place.
|
| Wow the asciinema is really good and very professional,
| thanks for creating it, I found it very helpful (in the
| sense that if I ever were to repeat my experiment, now I
| got your asciinema server) and I hope more people use it
|
| > It could be streamlined with something like Magic
| Wormhole, though. I'll add that to the backlog and see if
| there's interest
|
| To be really honest, its not that big of a deal
| considering one can do that on their own but I just had
| this idea for my own convenience when I was using QTM
|
| I really like QTM a lot! Thanks for building it once
| again, I would try to integrate it more often and give
| you more feedback when possible from now.
| CGamesPlay wrote:
| I really enjoy self-hosting on rented compute. It's
| theoretically easy to migrate to an on-prem setup, but I don't
| have to deal with the physical responsibilities while it's in
| the cloud.
| Gigachad wrote:
| Depends what you are trying to host. For many people it's
| either to keep their private data local, or stuff that has to
| be on the home network (pi hole / home assistant)
|
| If you just want to put a service on the internet, a VPS is
| the way to go.
| newsclues wrote:
| I have a desktop I use but if I had to start again, I'd build a
| low power r pi or n100 type system that can be powered by a
| mobile battery backup with solar (flow type with sub 10ms
| switching and good battery chemistry for long life) that can do
| the basic homelab tasks. Planning for power outages from the
| get go rather than assuming unlimited and cheap power
| ekianjo wrote:
| > I was in another country when there was a power outage at
| home.
|
| If you are going to be away from home a lot, then yes, it's a
| bottomless pit. Because you have to build a system that does
| not rely on the possibility of you being there, anytime.
| altmanaltman wrote:
| I mean you're right in terms of it being a demanding hobby. The
| question is, is it worth the switch from other services.
|
| I have 7 computers on my self-hosted network and not all of
| them are on-prem. With a bit of careful planning, you can
| essentially create a system that will stay up regardless of
| local fluctuations etc. But it _is_ a demanding hobby and if
| you don 't enjoy the IT stuff, you'll probably have a pretty
| bad time doing it. For most normal consumers, self-hosting is
| not really an option and the isn't worth the cost of switching
| over. I justify it because it helps me understand how things
| work and tangentially helps me get better my professional
| skills as well.
| digiown wrote:
| Tailscale has passkey-only account support but requires you to
| sign up in a roundabout way (first use an SSO, then invite
| another user, throw away the original). The tailnet lock
| feature also protects you to some extent, arguably more so than
| solutions involving self-hosting a coordination server on a
| public cloud.
| gessha wrote:
| Tailscale recently added passkey log in. Would that alleviate
| the SSO login?
|
| Tailscale also has a self-hosted version I believe.
| Aurornis wrote:
| I thought I was smart because I invested in UPS backup from the
| start.
|
| Then 5 years later there was a power outage and the UPS lasted
| for about 10 seconds before the batteries failed. That's how I
| learned about UPS battery maintenance schedules and the
| importance of testing.
|
| I have a calendar alert to test the UPS. I groan whenever it
| comes up because I know there's a chance I'm going to discover
| the batteries won't hold up under load any more, which means I
| not only have to deal with the server losing power but I have
| to do the next round of guessing which replacement batteries
| are coming from a good brand this time. Using the same vendor
| doesn't even guarantee you're going to get the same quality
| when you only buy every several years.
|
| Backup generators have their own maintenance schedule.
|
| I think the future situation should be better with lithium
| chemistry UPS, but every time I look the available options are
| either exorbitantly expensive or they're cobbled together from
| parts in a way that kind of works but has a lot of limitations
| and up-front work.
| kalaksi wrote:
| My APC UPS self-tested and monitored battery status
| automatically. Then started to endlessly beep when it noticed
| the battery needed replacing (could be muted though).
| Eventually, I stopped using UPS since I rarely needed it and
| it was just another thing to keep and maintain.
| richwater wrote:
| Check out some non-lead acid battery solutions like:
| https://www.ecoflow.com/us/blog/use-portable-power-
| station-a...
|
| Another maker is Goldenmate (less I be accused of being an
| ad)
| baq wrote:
| I went with home assistant and zigbee smart plugs to restart
| the router and the optical terminator.
| timwis wrote:
| You can self-host Pocket ID (or another OIDC auth service) on a
| tiny $1/mo box and use that as your identity provider for
| Tailscale. Here's a video explaining how:
| https://www.youtube.com/watch?v=sPUkAm7yDlU
| 4k93n2 wrote:
| syncthing might be worth looking into. ive been using that more
| and more the last few years for anything that i use daily,
| things like keepass, plain-text notes, calendars/contacts, rss
| feeds, then everything else that im "self hosting" are just
| things that i might only use a few times a week so its no big
| deal if i lose access.
|
| its so much simpler when you have the files stored locally,
| then syncing between devices is just something that can happen
| whenever. anything that is running on a server needs user
| permissions, wifi, a router etc etc, its just a lot of
| complexity for very little gain.
|
| although keep in mind im the only one using all of this stuff.
| if i needed to share things with other people then syncthing
| gets a bit trickier and a central server starts to make more
| sense
| neoromantique wrote:
| For this reason I have hybrid homelab, with most stuff hosted
| at home, but critical things I'd need to have running are on a
| VM in cloud. Best of both worlds.
| _the_inflator wrote:
| I made the same revelation.
|
| Self hosting sounds so simple, but if you consider all the
| critical factors involved, in becomes a full time job. You own
| your server. In every regard.
|
| And security is only one crucial aspect. How spam filters react
| to your IP is another story.
|
| In the end I cherrish the dream but rely on third party server
| providers.
| didntknowyou wrote:
| idk exposing your home network to the world and trusting AI will
| produce secure code is not a risk I want to take
| Dbtabachnik wrote:
| How is readcheck any different than using raindrop.io?
| journal wrote:
| none of you have what it takes to self host your perfect self
| hosting fantasy because most of you won't cooperate with others.
| keep waiting for that unicorn you wouldn't see standing right in
| front of you.
| Sirikon wrote:
| Self hosting post. Tailscale.
|
| Its comedic at this point.
| teiferer wrote:
| Can just "self host" documents, email and chat on google
| workspace.
| wantlotsofcurry wrote:
| Was this article written entirely by Claude for the most part? It
| definitely reads like it was.
| jordanf wrote:
| No
| jaime-ez wrote:
| has any one experience using cloudflare tunnels in a (small scale
| - 5000 user/day) self hosted web service? I just got 2 dynabook
| XJ-40 (32 gb ram, 512 gb ssd) for 200 usd each and I'm going to
| replace my DO droplets with them (usd150+ per month). I plan to
| use cloudflare tunnel to make the service available to the
| internet without exposing my home network. Any downsides ?
| (besides that cloudflare will be MITM for the service but it is
| not a privacy focused business)
| dpe82 wrote:
| I've recently begun moving the systems I administer to Claude-
| written NixOS configs. Nix is great but can be a real pain to
| write yourself; Claude removes the pain.
| hooo wrote:
| Me too... using that same logic.
| dpe82 wrote:
| Now if only there were a Nix-like system for FreeBSD! :)
| HarHarVeryFunny wrote:
| Interesting use case for Claude Code, or any similar local
| executor talking to a remote AI (Gemini suggests that "Hybrid-
| Local AI Agent" is a generic name for these, although I've never
| heard it called that before).
|
| I wonder if a local model might be enough for sysadmin skills,
| especially if were trained specifically for this ?
|
| I wonder if iOS has enough hooks available that one could make a
| very small/simple agentic Siri replacement like this that was
| able to manage the iPhone at least better than Siri (start and
| stop apps, control them, install them, configure iPhone, etc) ?
| Finbarr wrote:
| I used Codex to set up a raspberry pi as a VPN with WireGuard. I
| had no similar experience before and it was super easy. I used
| Claude Code to audit and clean up a 10+ year old AWS account-
| patching security, shutting down redundant services, simplifying
| the structure. I want Claude Code to replace every bad UI out
| there. I know what outcome I want and don't need to learn all the
| details to get there.
| tamimio wrote:
| Nope, never trust AI to do such things, it's imminent to cause
| issues. Maybe as an assistant only but never installed on the
| same server and worse, the privilege to access/execute commands.
| tkgally wrote:
| I used Claude Code just yesterday in a similar way: to solve a
| computer problem that I previously would have tried googling.
|
| I had a 30-year-old file on my Mac that I wanted to read the
| content of. I had created it in some kind of word processing
| software, but I couldn't remember which (Nexus? Word? MacWrite?
| ClarisWorks? EGWORD?) and the file didn't have an extension. I
| couldn't read its content in any of the applications I have on my
| Mac now.
|
| So I pointed CC at it and asked what it could tell me about the
| file. It looked inside the file data, identified the file type
| and the multiple character encodings in it, and went through a
| couple of conversion steps before outputting as clean plain text
| what I had written in 1996.
|
| Maybe I could have found a utility on the web to do the same
| thing, but CC felt much quicker and easier.
| krupan wrote:
| Oh my gosh, everything you want to host comes with a docker
| compose file that requires you to tweak maybe two settings. Caddy
| as your web proxy has the absolute simplest setup possible. You
| don't need AI to help you with this. You got this. You want to
| make sure you understand the basics so you (or your LLM doesn't
| do anything brain dead stupid). It's not that hard, you can do
| it!
| jawns wrote:
| Remember: In all likelihood, your residential ISP does not permit
| you to operate a server.
|
| Granted, that's rarely enforced, but if you're a stickler for
| that sort of thing, check your ISP's Acceptable Use Policy.
| megous wrote:
| My idea of fun is deeply tied to understanding how things work--
| learning them, then applying that knowledge in my own way, as
| simply as possible. That process gives me a sense of ownership
| and control, which is not something I get from an approach where
| AI does things for me that I do not understand.
| walterraj wrote:
| I have a hard time reading things like "The last one is the real
| unlock." or "That alone justified the box." without immediately
| thinking of an AI trying to explain something. Not to say this
| was written with one, but the frequency with which I see phrasing
| like this nowadays is skyrocketing...
| drnick1 wrote:
| Reminder: If you are using Tailscale or a VPS you aren't really
| self-hosting.
| teiferer wrote:
| Or a non-local LLM to keep it all maintained.
| legojoey17 wrote:
| I just got around to a fresh NixOS install and I couldn't be
| happier as I've been able to do practically everything via Codex
| while keeping things concise and documented (given it's nix, not
| a bunch of commands of the past).
|
| I recently had a bunch of breakages and needed to port a setup -
| I had a complicated k3s container in proxmox setup but needed it
| in a VM to fix various disk mounts (I hacked on ZFS mounts, and
| was swapping it all for longhorn)
|
| As is expected, life happens and I stopped having time for
| anything so the homelab was out of commission. I probably would
| still be sitting on my broken lab given a lack of time.
| ibizaman wrote:
| You might be interested in checking out my project
| SelfHostBlocks which allows you to declaratively setup quite a
| few services with declarative LDAP and SSO integration with
| LLDAP and Authelia. Even if you don't end up using it, it might
| inspire you. Also, all integrations are tested with NixOS VM
| tests using playwright to ensure no breakage.
|
| https://github.com/ibizaman/selfhostblocks
| visageunknown wrote:
| I find LLMs remove all the fun for me. When I build my homelab, I
| want the satisfaction of knowing that I did it. And the learning
| gains that only come from doing it manually. I don't mind using
| an LLM to shortcut areas that are just pure pain with no reward,
| but I abstain from using it as much as possible. It gives you the
| illusion that you've accomplished something.
| lurking_swe wrote:
| > It gives you the illusion that you've accomplished something.
|
| What's the goal? If the act of _building_ a homelab is the fun
| then i agree 100%. If _having_ a reliable homelab that the
| family can enjoy is the goal, then this doesn't matter.
|
| For me personally, my focus is on "shipping" something reliable
| with little fuss. Most of my homelab skills don't translate to
| my day job anyway. My homelab has a few docker compose stacks,
| whereas at work we have an internal platform team that lets me
| easily deploy a service on K8s. The only overlap here is docker
| lol. Manually tinkering with ports and firewall rules, using
| sqlite, backups with rsync, etc...all irrelevant if you're
| working with AWS from 9-5.
|
| I guess I'm just pointing out that some people want to build it
| and move on.
| visageunknown wrote:
| If your sole goal is to have a homelab that self-hosts
| services, I completely agree. I'm speaking for those who are
| interested in developing their skills and knowledge, and
| believe that building something with AI somehow does that.
|
| I'll agree to disagree on it not being applicable. Having
| fundamental knowledge on topics like networking thru
| homelabbing have helped me develop my understanding from the
| ground up. It helps in ways that are not always obvious. But
| if your goal is purely to be better at your job at work, it
| is not the most efficient path.
| Gigachad wrote:
| I don't give them direct access to my computer. I just use them
| as an alternative to scrolling reddit for answers. Then I take
| the actions myself.
| cyberrock wrote:
| Getting it up and running is fun but I find maintaining some
| services a pain. For example, Authelia has breaking
| configuration changes every minor release, and fixing that
| easily takes 1-X hours every time. I gave up for 4.38 and just
| tossed the patch notes into NotebookLM.
| visageunknown wrote:
| Definitely. That's a great use case. How do you use
| NotebookLM? First I'm hearing about it
| torginus wrote:
| The thing about anything that actually gets used, is what
| removes the fun the quickest is when it breaks and people who
| actually want to use it start complaining.
|
| In that case, it's not about the 'joy of creation', but
| actually getting everything up and running again, in which case
| LLMs are indispensable.
| visageunknown wrote:
| I don't disagree. All depends on what you're looking to get
| out of it.
| lee_ars wrote:
| >I don't mind using an LLM to shortcut areas that are just pure
| pain with no reward...
|
| Enlightenment here comes when you realize others are doing the
| exact same thing with the exact same justification, and
| everyone's pain/reward threshold is different. The argument you
| are making justifies their usage as well as yours.
| visageunknown wrote:
| That may be true. Ultimately, what I'd advise is for people
| to be cognizant of their goals and whether AI does or does
| not help to achieve them.
| jordanf wrote:
| yeah. I wrote a little about that here: https://fulghum.io/fun2
| valcron1000 wrote:
| > When something breaks, I SSH in, ask the agent what is wrong,
| and fix it.
|
| > I am spending time using software, learning
|
| What are you actually learning?
|
| PSA: OP is a CEO of an AI company
| enos_feedler wrote:
| you are learning what it takes to keep a machine up and
| running. You still witness the breakage. You can still watch
| the fix. You can review what happened. What you are implying
| from your question is that compared to doing things without AI,
| you are learning less (or perhaps you believe nothing). You
| definitely are learning less about mucking around in linux.
| But, if the alternative was not ever running a linux machine at
| all because you didn't want to deal with running it, you are
| learning infinitely more.
| croes wrote:
| How can you review if you don't know in the first place?
|
| You can watch your doctor, your plumber, your car mechanic
| and still wouldn't know if they di something wrong if you
| don't know the subject as such.
| doctoboggan wrote:
| You can learn a lot from watching your doctor, plumber or
| mechanic work, and you could learn even more if you could
| ask them questions for hours without making them mad.
| defrost wrote:
| You learn less from watching a faux-doctor, faux-plumber,
| faux-mechanic and learn even less by engaging in their
| hallucinations without a level horizon for reference.
|
| Bob the Builder doesn't convey much about drainage needs
| for foundations and few children think to ask. Who knows
| how AI-Bob might respond.
| rkomorn wrote:
| > You can learn a lot from watching your doctor [...]
| work
|
| Very true but I'll still opt for that general
| anesthesia...
| xboxnolifes wrote:
| The primary way humans learn _anything at all_ is by
| watching and mimicking. Sure, there will be mistakes, but
| that doesn 't preclude learning.
| ruszki wrote:
| Your hypothetical situation would cause all progress to
| halt. Nobody would be able to fix genuine problems.
| jordanf wrote:
| who cares if I'm the CEO of an AI company? I didn't mention
| anything related to my company once in the post.
|
| Wrote about learning and fun here: https://fulghum.io/fun2
| q3k wrote:
| It's (at least) common courtesy to declare potential
| conflicts of interest.
| jordanf wrote:
| I would have if there were potential conflicts.
| fhennig wrote:
| I personally find this information quite relevant to get
| the full picture and I'm glad someone else provided it.
| allarm wrote:
| The full picture of what exactly? How that fact is even
| relevant to this post? Do you expect anyone affiliated
| with AI to mention that every time they talk about AI?
| That's just ridiculous.
| fhennig wrote:
| I expect someone writing a blog about AI agents help you
| run your home server to disclose that they are "helping
| companies automate operations with AI" as their job,
| which they get money for.
|
| Why wouldn't you bring it up, or even lead with it?
|
| Doesn't it make sense to want to know this? It's not far
| fetched at all that there is a conflict of interest. How
| can they be unbiased in the validity of the approach if
| this is exactly the same stuff they sell for money?
| le_meer wrote:
| Just got a home-server. Immich is awesome! How's Caddy working
| out though? I need a way to expose immich to public internet (not
| just a VPN). Something like photos.domain.com
|
| For now I'm just using Cloudflare tunnels, but ideally I also
| want to do that myself (without getting DDoS)
| digiown wrote:
| Look up mutual TLS / client authentication. Caddy and Immich
| supports it. Then you can expose it to the internet reasonably
| securely.
| kilobaud wrote:
| I am curious what you mean by doing it yourself, i.e., do you
| mean (as perhaps an oversimplification) having a DNS record
| pointing at your home IP address? What are you wanting to see
| as the alternative to a Cloudflare tunnel?
| windex wrote:
| I had problems with tailscale being flaky about a year ago and it
| would stop responding taking down networking with it. I've since
| ripped it out and went with a VPS based wireguard for all PCs and
| mobiles. Stable since then.
| mintflow wrote:
| This is the reason why I am creating a Debian VM on my macOS to
| let Claude code in yolo mode to do some experiment:)
| catlifeonmars wrote:
| > I have flirted with self-hosting at home for years. I always
| bounced off it - too much time spent configuring instead of
| using. It just wasn't fun.
|
| No judgement, but wanting to tinker/spend time on configuration
| is a major reason why many people do self-host.
| jordanf wrote:
| yeah, for sure! i realize that and respect it. i wrote a little
| bit about it here actually: https://fulghum.io/fun2
| teiferer wrote:
| Opens with "self-hosting" and then brings claude code into the
| mix. You realize it's not actually running locally right? Privcy-
| wise that's a nightmare. A non-deterministic blackbox running in
| somebody's AI cloud is controlling your server. Congrats.
| csomar wrote:
| Vibe-setting up a home network server with VaultWarden is beyond
| reckless. LLMs have tendency to overlook security in order to get
| things working. You are, thereby, exposing your passwords (and
| potentially your 2FA as bitwarden supports that) to the whole
| world. This is beyond stupid. Even before LLMs my main concern
| with setting up BitWarden on my own server was two folds:
| security and availability. LLMs doesn't fix the second point but
| they make the first point much worse.
| teiferer wrote:
| Vibe-maintaining is even worse than vibe-setting up.
|
| And ironically all in the name of "self hosting". Claude code
| defies both words in that.
| Fokamul wrote:
| >Your home server's new sysadmin: Claude Code
|
| Lol, no thank you. Btw do your knees hurt?
| timwis wrote:
| Great article! I think a paragraph on your backup strategy would
| make it even more complete and compelling, particularly given you
| put your passwords and photos in there.
| jordanf wrote:
| thanks. I fleshed that out a bit more. appreciate the feedback.
| pmihaylov wrote:
| I also built a "devops" agent on top of claude code like that - I
| deployed it on my server and let it debug all the gnarly infra
| issues for me.
|
| I route it through a familiar interface like slack tho as I don't
| like to ssh from phone or w/e using a tool I built -
| https://www.claudecontrol.com/
| apexalpha wrote:
| I am in the process of doing the same. I have a Netbird mesh
| (Tailscale but open source) with 3 k3s nodes. They are
| geographically separated for HA.
|
| Claude and Gemini have been instrumental in helping me understand
| the core concepts of kubernetes, how to tune all these enterprise
| applications for high latency, think about architecture etc...
|
| My biggest "wow, wtf?" moment was ben I was discussing the
| cluster architecture with Claude. It asked: want me to start the
| files?
|
| I thought it meant update the notes, so replied 'yes'.
|
| It spit out 2 sh files and 5 YAMLs that _completely_ bootstrapped
| my cluster with a full GitOps setup using ArgoCD.
|
| Learning while having a 24/7 senior tutor next to me has been
| insane value.
| geooot wrote:
| I also liked using AI agents to do sysadmin stuff, especially
| with Nix OS. On top of Nix being great, the configuration of a
| system being files gives the agent good context on the current
| state the system is. Then when it does make changes, its great to
| be able to review its work via diffs.
| elitan wrote:
| Been using Claude Code to build a small deployment tool (Frost)
| for exactly this use case. The meta experience is interesting -
| using an AI agent to build tooling that makes self-hosting
| easier.
|
| What I've found: Claude Code is great at the "figure out this
| docker/nginx/systemd incantation" part but the orchestration
| layer (health checks, rollbacks, zero-downtime deploys) still
| benefits from purpose-built tooling. The AI handles the tedious
| config generation while you focus on the actual workflow.
|
| github.com/elitan/frost if curious
| sgt wrote:
| Try Claude and LVM, Linux software RAID and partitions though,
| it's hilariously bad at it.
| everlier wrote:
| I use coding agents for similar kind of problem very frequently.
| It makes wonders debugging obscure system issues related to
| components that I have no faintest idea about. Also building a
| homelab very soon. I think you may find this project useful:
| https://github.com/av/harbor
| Havoc wrote:
| I'd suggest rather asking it to write you bash scripts
|
| And ideally doing it via lxc or vm.
|
| Extra complication but gives you something repeatable that you
| can stick on git
| bilekas wrote:
| I recently got a zimaboard2 and have been blown away how powerful
| it is, x86 and 16GB I think it was around 250$. I have it running
| proxmox. Dedicated GPU for transcoding, all working out of the
| box with the ZimaOS.. And no AI needed.
| zmmmmm wrote:
| it's kind of fascinating, LLMs suddenly are making the Linux
| Desktop waaay more accessible, of all things.
|
| All those fancy GUIs in Mac and Windows designed to be user
| friendly (but which most users hate and are baffled by anyway)
| are very hostile for models to access. But text configuration
| files? it's like a knife through butter for the LLMs to read and
| modify them. All of a sudden, Linux is MORE user friendly because
| you can just ask an LLM to fix things. Or even script them -
| "make it so my theme changes to dark at night and then back to
| light each morning" becomes something utterly trivial compared to
| the coding LLMs are being built to handle. But hey, if your OS
| really doesn't support something? the LLM can probably code up a
| whole app for you and integrate it in.
|
| I think it's going to be fascinating to see if the power of text
| based interfaces and their natural compatibility with LLMs
| transfers over into an upswing in open source operating systems.
| duttish wrote:
| I've been building a home library system mainly for personal use,
| I want to run it cheaply so a $4 black Friday sale OVH vps is
| perfect.
|
| But I wanted decent deployments. Hosting a image repository cost
| 3-4x of the server. Sending over the container image took over an
| hour due to large image processing python dependencies.
|
| Solution? Had a think and a chat with Claude code, now I have
| blue-green deployments where I just upload the code which takes 5
| seconds, everything is then run by systemd. I looked at the
| various PaaSes but they ran up to $40/month with compute+database
| etc.
|
| I would probably never have built this myself. I'd have gotten
| bored 1/3 through. Now it's working like a charm.
|
| Is it enterprise grade? Gods no. Is it good enough? Yes.
| Draiken wrote:
| This summarizes what LLMs are best at: hobby projects that you
| care mostly about the outcome and won't have to actively
| maintain forever.
|
| When using them with production code they are a liability more
| than a resource.
| compounding_it wrote:
| I don't really understand this post completely.
|
| >I am spending time using software, learning, and having fun -
| instead of maintaining it and stressing out about it.
|
| Using software, learning and having fun with with what?
| everything is being done by Claude here. The part of fun and
| learning is to learn to use and maintain it in the first place.
| How will you learn anything if Claude is doing everything for you
| ? You are not understand how things work and where everything
| goes.
|
| This post could be written or at least modified by an LLM, but
| more importantly I think this person is completely missing the
| point of self hosting and learning.
| dannersy wrote:
| They get to feel like hackerman without understanding any of
| it. Also, this feels like a security nightmare. I wouldn't self
| host anything without understanding what you're opening
| yourself up to.
| Draiken wrote:
| LLMs give you that dopamine hit without the effort.
|
| I did it! Except you didn't and you don't know anything about
| what it did or learned anything along the way. Success?
| jordanf wrote:
| hi, OP here. people have different reasons/motivations for
| doing stuff, right? i wrote about it here:
| https://fulghum.io/fun2
| HeartofCPU wrote:
| Great until Claude decides to delete your storage and all your
| containers are gone
| hmontazeri wrote:
| Love this. I run also all my stuff by myself and I'm not an infra
| expert by all means just know enough to self host my app and
| services. I also built an remote monitoring agent using Go and
| rails I call it https://bareagent.io which monitors servers,
| docker containers and sends notifications when in any of those
| containers an error occurres as it is attached to the container
| logs
| pixelbyindex wrote:
| I also started started experimenting with self-hosting in the
| last few years. Started with a simple Plex server, then gradually
| evolved my little setup into a handful of open-source apps that
| now cover most of what I use during my day to day.
|
| There are a few important things to consider, like unstable IPs,
| home internet limits, and the occasional power issue. Cloud
| providers felt overpriced for what I needed, especially once
| storage was factored in.
|
| In the end, I put together a small business where people can run
| their own Mac mini with a static IP: https://www.minimahost.com/
|
| I'm continuing to work on it while keeping my regular software
| job. So far, the demand is not very high, or perhaps I am not
| great at marketing XD
| fergie wrote:
| I see why this is easy and fun, but is it really "self-hosting"
| if you are dependent on a $1200 a year AI-service to build and
| maintain it?
| micw wrote:
| For me the most important benefit is that the agent can keep the
| docs up to date. When I do a change, I let it document what is
| changed, how and why.
| InfinityByTen wrote:
| I was just thinking I should write something about this, because
| the words needs spreading.
|
| I cannot say how happy I am configuring my own immich server on a
| decade old machine. I just feel empowered. Because despite my 9
| years of software development, I haven't gotten into the nitty
| gritties of networking, VPN and I always see something non-
| standard while installing an open source package and without all
| of this custom guidance, I always would give up after a couple of
| hours of pulling my hair apart.
|
| I really want to go deeper and it finally feels this could be a
| hobby.
|
| PS: The rush was so great I was excitedly talking to my wife how
| I could port our emails away from google, considering all of the
| automatic opt in for AI processing and what not. The foolhardy me
| thought of even sabbatical breaks to work on long pending to-do's
| in my head.
| Maledictus wrote:
| Email is endgame, I suggest you get more experience self
| hosting in other areas first.
| InfinityByTen wrote:
| I concur. I did mention there was a rush and foolhardiness.
| That's my mid 30s excitement. Let me revel a bit :P
|
| I do want to be able to take control; with photos and Google
| not giving me a folder view to manage them was the last straw
| that pushed me deep into the self hosted world. I just want
| to de-google as much as reasonable.
| lee_ars wrote:
| > PS: The rush was so great I was excitedly talking to my wife
| how I could port our emails away from google, considering all
| of the automatic opt in for AI processing and what not. The
| foolhardy me thought of even sabbatical breaks to work on long
| pending to-do's in my head.
|
| I've been email self-hosting for a decade, and unfortunately,
| self-hosting your email will not help with this point nearly as
| much as it seems on first glance.
|
| The reason is that as soon as you exchange emails with anyone
| using one of the major email services like gmail or o365,
| you're once again participating in the data collection/AI
| training machine. They'll get you coming or they'll get you
| going, but you _will_ be got.
| InfinityByTen wrote:
| Words of wisdom. Hear hear!
| chromehearts wrote:
| Me personally; I have a similar mini pc with kubuntu installed,
| coolify to deploy my projects & cloudflare tunnels to expose them
| to the internet. the mini pc is still usable for daily use so
| that's great too
| bambax wrote:
| I self-host many things on a NAS (Asustor) using Portainer (a
| Docker UI/facilitator). It all works perfectly and has a marginal
| cost of about zero, since I need the NAS in any case.
|
| But I wouldn't give the keys of the house to Claude or any LLM
| for that matter. When needed, I ask them questions and type
| commands myself. It's not that hard.
| oulipo2 wrote:
| I would also suggest the great Karakeep for read-it-later :)
| hendry wrote:
| Timely! I just re-setup my Pi5 with the help of Claude.
| https://github.com/kaihendry/ai-pi
|
| Tbh I did the mistake of throwing away Ansible, so testing my
| setup was a pain!
|
| Since with AI, the focus should be on testing, perhaps it's
| sensible to drop Ansible for something like
| https://github.com/goss-org/goss
|
| Things are happening so fast, I was impressed to see a Linux
| distro embrace using a SKILL.md!
| https://github.com/basecamp/omarchy/blob/master/default/omar...
| mzhaase wrote:
| Instead of the vibe-admin approach, why not have the LLM write an
| Ansible playbook? At least its repeatable and auditable that way.
| tomashubelbauer wrote:
| I have a love-hate relationship with Home Assistant. I love its
| mission and I love it in spirit, but whenever I need to add or
| change something in it, I don't love the process. Without
| disparaging the work already done on improving it in recent
| years, I still find the UI and UX to be lacking. Claude Code has
| been shifting my perception much closer to the love end of the
| axis, because it allows me to side-step the boring parts of
| managing my Home Assistant instance and it is able to carry out
| the changes I want very reliably.
|
| I still struggle with letting go of writing code and becoming
| only a full-time reviewer when it comes to AI agents doing
| programming, but I don't struggle in the slightest with assuming
| the position of a reviewer of the changes CC does to my HA
| instance, delegating all the work to it. The progress I made on
| making my house smart and setting up my dashboards has
| skyrocketed compared to before I started using CC to manage HA
| via its REST and WS APIs.
| khalic wrote:
| To the tailscale promotion team: can you guys please dial it
| back? The half hidden ads are seriously annoying
| nickdothutton wrote:
| On the one hand, self-hosting, even at home, is more accessible
| than it has ever been. Hardware, software, and agents to help
| with setup and maintenance. While at the same time ISPs, the big
| email providers, and even (in the UK) government legislation
| makes it more difficult or risky than it has ever been. We have
| gained much but also lost much since the mid 1990s.
| alexdns wrote:
| "another few hundred USD for 8TB in NVMe SSD" lol
| mr-karan wrote:
| I've landed on a similar philosophy but with a slightly different
| approach to orchestration. Instead of managing everything
| interactively, I built a lightweight bash-based deployment system
| that uses rsync + docker compose across multiple machines.
|
| The structure is dead simple:
| `machines/<hostname>/stacks/<service>/` with a `config.sh` per
| machine defining SSH settings and optional pre/post deploy hooks.
| One command syncs files and runs `docker compose up -d`.
|
| I could see Claude Code being useful for debugging compose files
| or generating new stack configs, but having the deployment itself
| be a single `./deploy.sh homeserver media` keeps the feedback
| loop tight and auditable.
| neoromantique wrote:
| I have very similar setup, but I use komo.do with netbird.
|
| Which basically accomplishes same thing, but gives a bit more
| UI for debugging when needed.
| Draiken wrote:
| I use Ansible.
|
| It's simple enough and I had some prior experience with it, so
| I merely have some variables, roles that render a docker-
| compose.yml.j2 template and boom. It all works, I have easy
| access to secrets, shared variables among stacks and run it
| with a simple `ansible-playbook` call.
|
| If I forget/don't know the Ansible modules, Claude or their
| docs are really easy to use.
|
| Every time I went down a bash script route I felt like I was
| re-inventing something like Ansible.
| river_otter wrote:
| Next level up is self hosting your LLM! I put LM Studio on a mac
| mini at home and have been extremely happy with it. Then you can
| use a tool like opencode to connect to that LLM and boom, Claude
| Code dependency is removed and you just got even more self-
| hosted. For what you're using Claude Code for, a smaller open-
| weight model would probably work fine
| NicoJuicy wrote:
| Well, to a limit. I have an RTX 3090 24gb that enables a lot of
| use-cases.
|
| But for what i'm using Agents right now, claude code is the
| tool to go.
| river_otter wrote:
| makes sense. You could look at something like
| https://github.com/musistudio/claude-code-router if at some
| point you're interested in going down that path. I've been
| using gpt-oss-20b which would fit on your GPU and I've found
| useful for basic tasks like recipe creation and agentic tool
| usage (I use it with Notion MCP tools)
| fnwbr wrote:
| why does a post from january 2026 recommend ubuntu version 22.04?
| piqufoh wrote:
| I'm working on something very similar, but I've found that if I'm
| not doing the work - I forget what has been set up and how its
| running a lot faster.
|
| For example - I have ZFS running with a 5-bay HDD enclosure, and
| I honestly can't remember any of the rules about import-ing /
| export-ing to stop / start / add / remove pools etc.
|
| I have to write many clear notes, and store them in a place where
| future me will find them - otherwise the system gets very flaky
| through my inability to remember what's active and what isn't.
| Running the service and having total control is fun, but it's a
| responsibility too
| Maledictus wrote:
| Which enclosure do you use, and can you recommend it?
| Draiken wrote:
| Write scripts for everything.
|
| If you need to run the command once, you can now run it again
| in the future.
|
| It's very tempting to just paste some commands (or ask AI to do
| it) but writing simple scripts like this is an amazing solution
| to these kinds of problems.
|
| Even if the scripts get outdated and no longer work (maybe it's
| a new version of X) it'll give you a snapshot of what was done
| before.
| mvanbaak wrote:
| This is the reason one should always ask the LLM to create
| scripts to complete the task. Asking it to do things is fine,
| but as you stated you will forget. If you ask the LLM to do
| something, but always using a script first, and if you ask:
| 'Create a well documented shell script to <your question
| here>', you will have auto documentation. One could go one step
| further and ask it to create a documented
| terraform/ansible/whatever tooling setup you prefer.
| ibizaman wrote:
| This is the reason I adore NixOS. The documentation is the
| code. Seriously.
| sambuccid wrote:
| And if you prefer to learn well how to do it without AI, you can
| always try to do it manually the old way but then use AI at the
| end to review your config and spot any security issues
| drchaim wrote:
| My workflow is a bit different in the sense I open my claude
| session in my laptop, at the directory of my ansible homelab
| code, and I also give Claude access to ssh to my homelab. But at
| the end it's almost the same, great tool.
| jeena wrote:
| I self host a lot of stuff myself:
| https://uptime.jeena.net/status/everything
|
| And until now without AI, but I'm kind of curious but afraid that
| it will bring my servers down and then I can't roll back :D But
| perhaps if I would move over to NixOS, then it would be easy to
| roll back.
| larodi wrote:
| System Concierge, not sysadmin.
| timwalz wrote:
| "easy and fun" as an ongoing bowel disease.
| tietjens wrote:
| This is very cool and I'm doing something similar but without the
| Claude interface as the contact point for manipulating the
| server. What happens if one day Claude is down, or it becomes too
| expensive, or it is purchased by another company, etc.
|
| In this case you will be completely unable to navigate the
| infrastructure of your homeserver that your life will have become
| dependent on.
|
| But a homeserver is always about your levels of risk, single
| points of failure. I'm personally willing to accept Tailscale but
| I'm not willing to give the manipulation of all services directly
| over to Claude.
| donatj wrote:
| I have been self hosting since the late 90s, but I've always just
| installed everything on Bare metal. I hear more and more about
| these elaborate Docker setups. What does a setup like this
| actually look like?
|
| Is it just a single docker-compose.yml with everything you want
| to run and 'docker compose up'?
| abc123abc123 wrote:
| And why would I bother with a home setup? Sure, for industrial
| IT go for it, VM:s and/or containers, but for my own personal
| stuff, baremetal, packages, and good old fashioned way is more
| than enough.
| jordanf wrote:
| yeah basically.
| reactordev wrote:
| I just recently wrote my own agent that can gdb, objdump, nasm,
| cc, make, and more.
|
| Agents are powerful. Even more so with skills and command line
| tools they can call to do things. You can even write custom tools
| (like I did) for them to use that allows for things like live
| debugging.
|
| The tailscale piece to this setup is key.
| tbyehl wrote:
| My favorite genre of post in r/homelab and r/selfhosted this past
| year has been "I used AI to set all this stuff up and something
| broke so I asked AI to fix it and now all my data is gone."
|
| There are so many NAS + Curated App Catalog distros out there
| that make self-hosting trivial without needing to Vibe SysAdmin.
| jordanf wrote:
| I keep hearing this, and asking for examples, and there aren't
| really any.
| iLoveOncall wrote:
| I've broken my internet many times by asking ChatGPt for help
| setting up PiHole as a DHCP server. I'll post conversation
| excerpts later if I remember.
|
| It was just giving commands to run that were plain wrong and
| extremely destructive, and unless you already knew what they
| were doing you were screwed.
|
| Here: https://chatgpt.com/share/696539b6-65f0-8010-9324-5e35d
| a42ee...
|
| I have 4-5 more conversations like this. It's honestly almost
| a piece of art, the LLM keeps spouting out shit like "Ah got
| it, your issue is clear now", and digging deeper into the
| wrong direction.
| WiSaGaN wrote:
| I have a similar experience when I found out that claude code can
| use ssh to conect to remote server and diagnose any sysadmin
| issue there. It just feels really empowered.
| stuaxo wrote:
| Is everyone just running claude code not even in a container,
| letting it go wild and change stuff?
| raxxorraxor wrote:
| I use Cursor and quickly let it run pretty wild. Claude doesn't
| seem to mind to extract auth info from everywhere. Cursor
| usually blacklists some files for AI access depending on
| language and environment, but Claude just queries environment
| variables without even simulating a bad conscience. Probably
| info that gets extracted by the next programmer using it. Well,
| whoops...
| legoxx wrote:
| I am building a homelab with the help of various AI services. I
| started with ChatGPT, then moved to Claude, and I am now working
| with Cursor and Gemini.
|
| In my experience, this approach works extremely well--I would not
| have been able to accomplish this much on my own. However, there
| is an important caveat: you must understand what you are doing.
| AI systems sometimes propose solutions that do not work, and in
| some cases they can be genuinely dangerous to your data integrity
| or your privacy.
|
| AI is therefore a powerful accelerator, not a replacement for
| expertise. You still need to critically evaluate its suggestions
| and veto roughly 10% of them.
| yyaakkqq wrote:
| "piping everything to sudo bash makes a home server easier and
| fun"
| FatherOfCurses wrote:
| Telling us you did all this without sharing how is just bragging.
| kissgyorgy wrote:
| My non-technical friend, never learned coding, doesn't know
| Linux, zero sysadmi experience does this and he can do anything
| and doesn't even know what Clause is doing. He learned some
| concepts recently like Docker, SSH, but that's basically it.
| loufe wrote:
| Threads like this one make me feel at home. Last night I spent an
| hour trying to figure out a way to adjust tailscale to allow me
| access to containers on a MacVLAN on my NAS when I connect in
| away from home. Claude's an excellent tool to help me make
| informed decisions. I find the knowledge needs to be double
| checked more than some domains (I'm a big fan of requesting
| Claude search online for information before using its discourse
| as a basis for any decisions) but I still feel like I'm learning
| the WHY and HOW because I can still ask.
|
| I share a lot of the same hesitations as others in the thread -
| using a giant US-based tech giant's tool for research as well as
| another US giant's tool to manage access, but it's really a game
| change and I'd be unable to find the time to do everything I want
| if I didn't have access to these otherwise.
|
| I'm not even a software guy by engineering, my network is already
| complicated enough that learning and correctly securing things
| otherwise would simply just not be feasible with the time and
| energy I'd like to dedicate to it.
| cyber_kinetist wrote:
| No, 2026 is definitely not the year of home servers, because
| hardware has become too expensive.
|
| Maybe viable if you have a bunch of spare parts laying around.
| But probably not when RAM and storage prices are off the charts!
| tech_ken wrote:
| I think this is a good idea so long as you ensure you've got a
| good backup going or don't put anything super critical on there.
| I think it's seriously outside odds that Claude `rm -rf /`s your
| server, but definitely not 0%.
| kzahel wrote:
| As an added bonus you could add on a mobile-first claude code UI
| on top of claude. I've been working on this and use it on my pi5
| at home. https://yepanywhere.com/
|
| (and no, this product is not against TOS as it is using the
| official claude code SDK unlike opencode
| https://yepanywhere.com/tos-compliance.html)
| noncoml wrote:
| Any opinions on Readeck vs Karakeep?
___________________________________________________________________
(page generated 2026-01-12 23:01 UTC)