I keep getting stuck after begining my journey, then I begin again.. and again. reddit / selfhosted ---------------------------------------------------------------------- captaindongface · 2023-11-04 20:50 I have a relatively entry level understanding of linux and spent some time with with my command line driven debian server (perfect media server originally). I understand what docker is and how to use it in basic terms but am not very practiced. I have a **desktop pc** and a **distro**, and a **home network**. *Today*, I want everything only on my home network and available to users in my network. I want to host a file server; (all after dockerised) I want to run Jellyfin (seer etc), I want to run some type of cloud for people in my home when they are on the network (nextcloud I presume). Outside those main 3 uses, paperless; some basics in home assistant (bit by bit), trilium, immich (or equivalent), and such. My issue is this.. Every time in make progress in learning and using self hosted software (a cycle i have kickstarted several times in the last 5 years), I scare myself out of progress. Then comes the doubt and I refocus my interests elsewhere in life till I feel motivated to take another run at it. I hit the barrier that always boils down to the same thing: **Fear of networking**. I.e, not knowing if what I am doing is accessible and discoverable to those outside my network. I understand that if I'm targeted I can make access harder and have seem some guidance in what to learn and follow to reduce vulnerability / targetability. But I honestly just want to do things at home and not worry too much about people outside accessing our family files. Usually in get so far down the road, then when I'm troubleshooting something or learning something new I'll be hit with a wall of dread that I don't know what I'm doing and that everything I am doing is a lighthouse for easy targeting outside my network. I don't believe that in any of the programs I've had experience setting up and playing around with that I have explicitly configured outside access (if presented during set up), but what I don't know overpowers me and I am overcome by doubt. I've read comments like "yeah #selfhostedapp is always open to the outside, you need to set up your firewall, f2b, etc to mitigate" and thats it I spiral out, I doubt what I really need to do, how do I check my what access there is, where I am vulnerable. I don't know where to start so that I can overcome this fear, is there just a program which I can learn and will show me whats visible outside my home network, can I stake my family files on this? I understand that the easiest way into self hosting is to start playing around with programs and I do and enjoy this and have them working and doing, I enjoy troubleshooting, but I cannot escape this doubt that in my head the dangers of networking bring.. I run a busy life as a parent and barely have time to spend learning something that isn't the exact knowledge I need to make it work, I haven't yet landed on the relevant learning path.. Any advice, anyone travel a similar path on their journey? ---------------------------------------------------------------------- Plane_Resolution7133 · 2023-11-04 21:11 Unless you actively open ports on your firewall from the internet, you’re good. Install XCP-ng or Proxmox on a machine. Doesn’t have to be anything fancy. Say 8GiB RAM and up, and 500GiB drive. Install 2-3 servers on your hypervisor, and create internal only network(s) for your virtual servers. Before you’re trying something that might break something on your server(s), do a *snapshot*. It takes seconds. If something does break, rollback the snapshot. It takes just seconds again. Experiment away without fear. ---------------------------------------------------------------------- SatNav · 2023-11-04 21:26 >barely have time to spend learning something that isn't the exact knowledge I need Yeh, in my experience that's not how self-directed learning works. Often you don't know what you *need* to know until you learn it. Until then you just need to... Keep learning. Or else you need to find (IE. *pay*) someone to teach you what you need to know. That being said... > ...everything I am doing is a lighthouse for easy targeting outside my network. This is nonsense. As the other person said, it doesn't matter what you do inside your network - as long as you don't specifically *open ports* on your router, nothing can reach into your network and access your stuff. All your inbound ports are closed by default. Don't open them, and you'll be fine. ---------------------------------------------------------------------- Skotticus · 2023-11-04 21:36 First, getting started with self-hosting: If you've already been running a NAS, congrats, you've already been doing some self-hosting! You aren't starting, you're taking a next step! Based on what I gathered from your description of your self-hosting woes, it sounds like you are overwhelming yourself by being too ambitious and trying to do too much. Approach things a piece at a time: service by service, concept by concept. Start with a service you want to run, and work on getting that set up. Don't obsess about needing it to be up and working right away, just focus on learning what you need to know to get it working the way you want. You may or may not get it working perfectly right away. You may make decisions you later decide you don't like, leading you to change things around (this is how you will later learn about database management and how to upgrade or migrate databases). Since you mentioned Docker, you may want to decide how you will be managing your docker stack. You could use Docker Compose or a hypervisor like Portainer or Docker Swarm. As a novice Linux user, you may want to check out Unraid, which does a great job streamlining various aspects of running a NAS or server and has a pretty vibrant community of developers and content creators to help you get through setting up the first few services (even if you don't use Unraid, you will do well to check out the content of Spaceinvader One and IBRACORP). As far as networking, if you don't care about using FQDN to make readable addresses for each service, you don't really have to do anything to make sure nothing is accessible outside your network (assuming you at least have a router with a built in firewall with non-default admin credentials and you've disabled WPS and upnp). At first, the most important thing to understand about networking is what a port and port forwarding is, and if you have any ports forwarded on your network, what that port forward is for and why it was needed. If nothing is going to be exposed outside your network, you generally shouldn't have any ports forwarded. At some point you will probably decide you want to expose services to the internet so you and your users can access the services outside the home (immich will probably make you want to do this because users may be frustrated not being able to access photos on the server when they're away from the network). Before you do this, make sure to first look into how to harden your network and add security layers to apps that don't have credentialed logins or 2fa. From there, learn about VPNs and reverse proxies. Try not to expose anything for very long if you haven't secured that service yet. ---------------------------------------------------------------------- nightmareFluffy · 2023-11-04 21:53 > Approach things a piece at a time: service by service, concept by concept. This is the key, and exactly the same thing I was thinking when I read the port. Just do one thing at a time. There's a high chance that it's not the optimal way, and that you might have to change it later. That's fine. I've done that too. For example, I went from Cloudflare tunnels to Caddy to Nginx, each time learning a bit more. By the way, if you're not using Caddy/Nginx/something similar, and not forwarding ports on your router, you probably have nothing to worry about. Because you're keeping it all in your internal network. There are unexpected and one-off intrusions of course, but if you don't forward ports, the risk would be regardless if you're doing self- hosting stuff or not. It's like a risk everyone faces any time they do anything online. ---------------------------------------------------------------------- captaindongface · 2023-11-04 22:07 Thank you for the advice, unfortunately my networking knowledge is so limited that I didn't know that it is strictly manually opening ports that increases my vulnerability. I have no forwarding rules in my home firewall. Does this mean that if I set up servies that require ports to be configured in the app - that because there is nothing in my firewall then nothing can come at me? I tried proxmox previously, after initial amazement, one of the main reasons I went back to command driver debian was the simplicity. For things like passing through, I tied myself in knots with the mental loops. I may just give it another run. Thank you ---------------------------------------------------------------------- goobshnoop · 2023-11-04 22:23 This means that nothing from the outside internet can “come at” you. Devices connected to your internal network (WiFi/ethernet) can interact with your server or services. If you want to keep your server totally private from your internal network you will want to learn about subnets/VLANs and firewall rules. ---------------------------------------------------------------------- captaindongface · 2023-11-04 22:25 Yeah, I can appreciate this. I used the learn by doing philosophy but it took me a couple of re-runs to realize what exactly was causing me to drop interest and put distance between me and the subject - specifically the fear of the unknown "networking" dangers. Is there any specific course - based on my diagnosis that you feel I might turn my attention to - as it relates specifically to selfhosting with Linux? ---------------------------------------------------------------------- goobshnoop · 2023-11-04 22:26 Great answer! ---------------------------------------------------------------------- water_we_wading_for · 2023-11-04 22:31 I am similar in that I am stuck in a loop learning things for a while, giving up and then starting over. Although it so happens that I have been successful a few times at setting something up and am now "self- hosting" those things. This has happened enough times now that I feel fairly confident I can at least keep the things that are running, running. But I can't say that I understand them all that well. Also I am missing some things that others would consider essential like **backups** and **any kind of subnetting or VLANs**. Sometimes, I try to research how to do something new or different, I spend half a day opening up tabs and then discard the whole project. The positive take away is that even through all that, I've managed to learn some things. And when restarting, things are a little bit easier every time. ---------------------------------------------------------------------- DTea123 · 2023-11-05 00:44 Try using unraid as SpaceInvader One has wonderful guides on how to do a great many things and is a good starting point. I don't open up ports and use Tailscale to make things accessible outside my LAN. Granted, this is not a great way to learn how to do things 'right,' but as a fellow busy parent, it's a good way to get things set up that just work and are reasonably secure. ---------------------------------------------------------------------- chkpwd · 2023-11-05 00:48 I’m happy to offer help over discord. ---------------------------------------------------------------------- knook · 2023-11-05 02:59 Personally I feel like I made it a bit further every time I started over. Then at one point I got to a place where at least when I need to fix something or change something I didn't need to start over and could recover. ---------------------------------------------------------------------- CharkDocolate · 2023-11-05 05:08 Not OP but I’m in a similar boat - is there a good discord community for these type of network questions? Sometimes it can be difficult to know what exactly I’m trying to ask in a reddit post ---------------------------------------------------------------------- chkpwd · 2023-11-05 12:13 We usually hang out over at https://discord.com/invite/homelab Tell em chk sent ya! ---------------------------------------------------------------------- captaindongface · 2023-11-05 19:46 I really appreciate this response. I always kept my distance on Unraid, partially for the cost, partially the closed source. But I think ultimately I was (and remain) completely sold by original PMS stack by u/Ironicbadger, I remain sold on that and haven't really strayed too far. What does managing my docker stack give me that having a few compose files doesn't? Is it for keeping the containers updated? Do you reference docker management because there are tools which will assuage my networking fears? I followed Ibracorp specifically on some of the apps (Jellyfin), but I see now that their channel is very unraid focussed. I will have a look at some of the sales pitch videos they both seem to have on Unraid to see if they can sell me. I know I shouldn't be too precious about what I have learned in my own stack so far, as a lot of it will be transferrable. I have some resources queued now - focussing on ports / port forwarding. Motivated by this direction. ---------------------------------------------------------------------- Skotticus · 2023-11-05 21:53 >Do you reference docker management because there are tools which will assuage my networking fears? Mainly I'm referring to docker management because I've seen a lot of people bounce off self-hosting because running docker containers through cli can be frustrating. As for Unraid, it has a built-in docker management system that is really useful and helps you visualize what you have running. You can also install a plugin that adds Compose to the mix, so if you decide to, you can use the compose files you already have (with slight modification because you'll probably need to set PUID and PGUID to match Unraid). The downside is that certain things you can do fairly easily with Compose (assigning a container to multiple docker networks and using an ENV file) are somewhat more difficult with the base docker implementation, though not impossible. And of course you can always just use Docker Compose in conjunction. The biggest benefit to Unraid in my opinion is that it does a good job collecting and visualizing information about various aspects of managing a server. It's very easy to see and set up your array, caches, and pools, and it's very easy to track errors, time spun up, and a hundred other pieces of info about the health of your storage devices. I'm not really looking to sell you on Unraid— it's just one of many good options, and if you're heavy into VMs, it's capable but probably wouldn't be the best option. Just try some stuff out and go with what *feels* right to you.