What is for you the perfect infrastructure setup for one server? reddit / selfhosted ---------------------------------------------------------------------- nkls · 2023-11-04 06:57 I'm still not there yet, but for me it would be something like - Firewall that automatically detects abuse and blocks it + notifications (Todo) - SSO with multiple users (Todo) - Reverse Proxy (Nginx Proxy Manager, done) - VPN (wg-easy, done, but blocked by some wifis) - hidden VPN over port 80 or 443 (Todo, is this even possible?) - Automatic updates (watchtower, done, notifications are sent to ntfy) - Automatic Back ups (Todo, with notifications, external storage) - Uptime Tool (uptime Kuma, done, with notifications to ntfy) - Traffic filter for ads and tracking (adguardhome, done, connected to my VPN) How is your setup? Is there anything I'm missing, and what tools do you use for all of this? Any good / bad experiences? ---------------------------------------------------------------------- dazchad · 2023-11-04 07:53 Automatic backups and internal network detached from outside network. Plus another network for IoT. ---------------------------------------------------------------------- zfa · 2023-11-04 08:17 > hidden VPN over port 80 or 443 (Todo, is this even possible?) You can run OpenVPN over port 443, ditto Shadowsocks with xray, cloak etc. ---------------------------------------------------------------------- Do_TheEvolution · 2023-11-04 10:03 >Firewall that automatically detects abuse and blocks it + notifications (Todo) yeah, still have it on my to-do list for opnsense, setting up [this dashboard](https://github.com/bsmithio/OPNsense-Dashboard) and investigating and setting up suricata, zenarmor, sensei or whatever terms are being thrown around when discussing it >SSO with multiple users (Todo) dont really care for that, I dont give access to my shit to people where I want them to have access everyhwere >Reverse Proxy (Nginx Proxy Manager, done) caddy is love, caddy is life, I actually learned prometheus, loki and grafana to have [nice dashboard](https://github.com/DoTheEvo/selfhosted-apps- docker/tree/master/prometheus_grafana_loki#caddy-reverse-proxy- monitoring) of who and when access what through my reverse proxy >VPN (wg-easy, done, but blocked by some wifis) wg-easy is 100% deserving its name and fucking cool >hidden VPN over port 80 or 443 (Todo, is this even possible?) dont care >Automatic updates (watchtower, done, notifications are sent to ntfy) had it setup, realized I fear more failure and unplanned dealing with shitty update that requires extreme amount of work (shoutout nextcloud!) than outdated containers >Automatic Back ups (Todo, with notifications, external storage) invested time in to [kopia](https://github.com/DoTheEvo/selfhosted- apps-docker/tree/master/kopia_backup) and in to [veeam](https://github.com/DoTheEvo/veeam-prometheus-grafana), am pretty happy >Uptime Tool (uptime Kuma, done, with notifications to ntfy) yeap got that, bonus point is setting it up on [oracle free tier cloud](https://github.com/DoTheEvo/selfhosted-apps- docker/tree/master/free_cloud_hosting_VPS), so that you actually know when you main home shit goes down. >Traffic filter for ads and tracking (adguardhome, done, connected to my VPN) never much cared for that kind of adblocking >How is your setup? Is there anything I'm missing, and what tools do you use for all of UPS monitoring? I plan to setup some NUT server? Homerserver is a black hole of work put in, with frigate for cameras and monitoring rooms and shit. I am not on esxi, and my major plan is leaving someday for proxmox, but so far when everything works it seems like too much bother ---------------------------------------------------------------------- FibreTTPremises · 2023-11-04 10:39 * [CrowdSec](https://github.com/crowdsecurity/crowdsec) with the remidation agent on router (to-do). * [Authentik](https://goauthentik.io/). Very daunting at first, but if you can learn it, it's the best self-hosted identity provider out there. (and yes, you can decide which user can access which applications.) * [Caddy](https://caddyserver.com/) with CrowdSec log-reading; to-do when it finally [gets fixed](https://github.com/crowdsecurity/hub/pull/806). Much more customisable than Nginx Proxy Manager, but lacks a GUI (fine for me). * [WireGuard](https://www.wireguard.com) hosted on the router. Getting it set up on OpenWrt was difficult. * WireGuard can be hosted on any port (not needed for me). Use 443 since UDP 443 will look like QUIC traffic (unless inspected). * [Diun](https://github.com/crazy-max/diun). No auto-updates because they may contain breaking changes. * [Kopia](https://kopia.io) (to-do; nowhere to backup to). * [Uptime Kuma](https://github.com/louislam/uptime-kuma) (to-do because I don't really need it). * [AdGuard Home](https://github.com/AdguardTeam/AdGuardHome). I also use it as an internal DNS server; it rewrites requests to my domain name to answer with Caddy's local IP instead of my external IP, so that I don't have to expose DNS records to personal services in Cloudflare. What do you mean by "connected to your VPN"? > Is there anything I'm missing? A password manager ([Vaultwarden](https://github.com/dani- garcia/vaultwarden)), [Glances](https://github.com/nicolargo/glances), oh and everything on [Awesome Selfhosted](https://github.com/awesome- selfhosted/awesome-selfhosted). ---------------------------------------------------------------------- lilolalu · 2023-11-04 10:50 If you put something like pfsense in front of your server, you have most boxes ticket already since it brings either natively or via plugin: - a firewall - wireguard server - certificate management - proxy server (HAproxy) - ad blocking / traffic filter (PFBlocker) - intrusion detection (Snort / Suricata) Personally I think it's a good idea to seperate this functionality from your main "server" since you want this functionality for any device on your network, not just the "server". Running the services, back up etc, that's the task for your server. ---------------------------------------------------------------------- revereddesecration · 2023-11-04 10:56 Ubuntu with UFW. I don’t need to “detect abuse” because my private key is ECDSA and won’t be cracked any century soon. ---------------------------------------------------------------------- lilolalu · 2023-11-04 11:04 Intrusion detection systems like snort or suricata are designed to detect and block attacks that nobody yet knows about, like 0-day exploits etc. There might be a a bug in ssh, than it doesn't matter how secure your private key is. ---------------------------------------------------------------------- DerelictData · 2023-11-04 15:54 > UDP 443 will look like QUIC traffic (unless inspected) This is really slick, great idea! Thanks!! ---------------------------------------------------------------------- HoustonBOFH · 2023-11-04 16:50 For VPN I would look at SoftEther first. You can still have wireguard as normal, but also a tls VPN on 443 that will look like web traffic. More options means more likely to work. https://www.linuxbabe.com/ubuntu/set-up-softether-vpn-server ---------------------------------------------------------------------- HoustonBOFH · 2023-11-04 16:52 pfSense is not what I would be recommending for Wireguard... :) [https://www.servethehome.com/pfsense-and-freebsd-pull-back-on-kernel- wireguard-support/](https://www.servethehome.com/pfsense-and-freebsd- pull-back-on-kernel-wireguard-support/) Take a long look at OPNsense first. But I agree, that the firewall should stand alone. ---------------------------------------------------------------------- lilolalu · 2023-11-04 16:57 Old info. Thats fixed for a while now (aka years?) ---------------------------------------------------------------------- HoustonBOFH · 2023-11-04 17:07 Only one example, and the person who has made those choices over and over is still there. There is a reason so many of the developers ( Including Chris) left... ---------------------------------------------------------------------- lilolalu · 2023-11-04 17:11 Afaik this was not a pfsense caused problem but a code quality problem of the underlying BSD wireguard kernel module, which is unfortunate but long solved. ---------------------------------------------------------------------- HoustonBOFH · 2023-11-04 17:39 This is a long history of the person in charge doing things is a way others find unpalatable. This was just one example. You can find others... But I found it ironic that one of the things you recommended pfSense for was one of the controversies. ---------------------------------------------------------------------- lilolalu · 2023-11-04 17:43 Well, I must admit that I didn't know about that person when I started using pfsense like years ago. I heard about the wireguard controversy, but 1. It's open source 2. As long as it works I am too lazy to switch 3. Apparently it still has more features like pfblocker, that I use. ---------------------------------------------------------------------- malferro · 2023-11-04 19:12 >WireGuard can be hosted on any port (not needed for me). Use 443 since UDP 443 will look like QUIC traffic (unless inspected). This is exactly what I'm doing with my Wireguard VPN and have had no issues. ---------------------------------------------------------------------- HoustonBOFH · 2023-11-04 21:50 The owner has a long history of playing fast and loose with Open Source rules. You can not easily get access to the source, and it is even harder to get access to the build chain. It is about trust... ---------------------------------------------------------------------- lilolalu · 2023-11-04 21:52 Definitely a red flag, if I just wasn't so lazy change the absolutely essential parts of my home network... ---------------------------------------------------------------------- Ironicbadger · 2023-11-04 22:51 A really excellent list this. I'm curious what drew you to Kopia specifically over some of more well-known options like restic or borg? ---------------------------------------------------------------------- HoustonBOFH · 2023-11-05 00:06 That's fair... But if you are looking for a new firewall, look at OPNsense over pfSense. ---------------------------------------------------------------------- dd027503 · 2023-11-05 02:31 single server: dell optiplex something or other. i7, 16gb of memory. internal 512GB ssd that i don't remember where it came from. additional dual nic card for pfsense. proxmox for hypervisor with docker installed adjacently. portainer running to visualize docker. vm 1: pfsense using the two nics listed above as WAN and LAN. this admittedly took some work to set up but it works great now. pfsense has pfblockerng for network wide ad blocks. I did like the visualizer in pi-hole more though. also runs my openvpn that i can connect to if i'm out and have some random need to connect in to home. vm 2: an "acquired" win2012R2 running AD and the AD cert authority. I did this initially to be able to test gpo's and use as a central LDAP auth point but I admittedly use it less and less. vm 3: my torrent box with my vpn. everything else is docker. plex, emby, airsonic, nextcloud, uptime- kuma. I've tinkered with other stuff but this is what I fall back on using. VM backups are to my NAS via proxmox backup and for docker configs i wrote some simple bash scripts to move what needed to be preserved also to the NAS. scheduled via cron on the host OS, nothing fancy. Use nginx reverse-proxy with a LE companion for exposed stuff with https and certs. every so often i'll dump some backups up in s3 IA tier and I should probably script this. ---------------------------------------------------------------------- Low-Chapter5294 · 2023-11-05 02:57 Wireguard is very easily identified using DPI. There is no attempt to hide the fact that it's wireguard. ---------------------------------------------------------------------- FibreTTPremises · 2023-11-05 03:38 Ethernet over HTTPS looks very, very interesting. ---------------------------------------------------------------------- FibreTTPremises · 2023-11-05 03:40 I haven't actually set it up yet, but I found it a long time ago on GitHub's trending and starred it. I've never actually looked into backup services because I knew Kopia existed and was somewhat popular. ---------------------------------------------------------------------- AConcernedCoder · 2023-11-05 04:29 I don't know about ideal, but I'm kind of proud of my 13th gen, 20 thread mini pc I picked up for a week's worth of savings. So far I've managed to convert it into a dual purposed workstation and remote dev server optional headless boot configuration, remote management services, and automated, compressed incremental backups. Ideally I'm just going to skip most of the security related work by keeping it offline except for those occasions where I need to access services via iaas as needed. ---------------------------------------------------------------------- HoustonBOFH · 2023-11-05 04:47 If you are in a Cisco shop, ocserv is a Cisco AnyConnect clone, but it is a bit challenging to set up.