When/how to get serious reddit / selfhosted ---------------------------------------------------------------------- Mr_Evil_Sir · 2023-11-05 00:06 After some help/advice for things to consider when getting selfhosted services to a running standard. Right now my hosting has essentially been all play. I don't think there is any production data at all, nothing is deeply configured, and there is definitely no expectation that services work, reliable, available, etc. I'm considering changing this. I'm looking at a low power unit and doing a bunch of stuff that would suddenly impact on wife approval rating (router/firewall being the biggest). I'm also going to start using some items as primary sources (paperless and jellyfin, maybe immich). Does anyone have advice/suggestions? And to note one in advance, yes backup and restore are important - welcome any info about how people have set that up. ---------------------------------------------------------------------- zfa · 2023-11-05 00:10 My advice? Set up a prod and non-prod / 'homelab' environments. Let your family ues and rely on the prod stuff and have your own playground which doesn't impact them when you break stuff, which you will at some point. Both can be virtualised, sure, as long as you know what you can and can't do whilst maintaining service for the normies. ---------------------------------------------------------------------- Legitimate_Farm_3095 · 2023-11-05 00:15 https://www.reddit.com/r/selfhosted/search?q=getting+started&restrict_ sr=on&include_over_18=on&sort=relevance&t=all ---------------------------------------------------------------------- acid_etched · 2023-11-05 00:27 I accidentally sorta slid into the “serious” side of it and now I’m trying to untangle the stuff that needs uptime from the stuff I’m messing with. I would recommend anything that you use regularly be separated as others have described. ---------------------------------------------------------------------- MyriadAsura · 2023-11-05 00:40 Amazing advice. Awesome! ---------------------------------------------------------------------- zeitue · 2023-11-05 00:50 You could do something like what I did and get a small business setup with some services. I set up a server for parent's business which ended up being mainly nextcloud and a few other apps, this is a production environment but small, only two people. I later introduced several of the services to the company I work for and proposed switching off from the IT they had which did nothing for them but blame them for many issues that occurred. They accepted the proposed server setup and I and one other person began implementing it, since then we've migrated to the proposed setup and everything works better. ---------------------------------------------------------------------- shetif · 2023-11-05 00:52 Redundancy. Backup. Automation In that order. ---------------------------------------------------------------------- ithakaa · 2023-11-05 01:26 Proxmox, Proxmox Backup Server, a NAS for storage Build your own apps inside LXCs Tailscale for remote access control ---------------------------------------------------------------------- Psychological_Try559 · 2023-11-05 01:30 I've thought about this, and conceptually I like it. But how does this work in practice? Do you have a separate network? How do you address it? Setting up a separate Vlan for prod/dev is trivial...but setting up all separate VLANs is--still possible but more work. But h addressing them? I think I need a different... something? Maybe a separate server, maybe a separate router, maybe an entirely new network? I haven't dug too deeply into it but an obvious answer hasn't jumped out at me.... ---------------------------------------------------------------------- Psychological_Try559 · 2023-11-05 01:30 So what I'm hearing is that either we need a meta post or getting started is hard, quite possibly because people come from so many different perspectives and places. ---------------------------------------------------------------------- Psychological_Try559 · 2023-11-05 01:34 Are we supposed to be serious about this? I never got them memo!! But honestly, it depends what seriously means to you! You should start caring about data loss when (if not before) you have work/data you're worried about losing. You should care about security when you start preparing to expose stuff to the Internet. You should start caring about reliability when it bothers tou when stuff is down. You should start caring about doing stuff "right" when you start putting this on your resume. Not sure which of those is "serious" to you. ---------------------------------------------------------------------- adamshand · 2023-11-05 01:48 I’d recommend backups first. ---------------------------------------------------------------------- revereddesecration · 2023-11-05 03:46 Just use a VPN! ---------------------------------------------------------------------- Psychological_Try559 · 2023-11-05 04:01 Definitely a good choice if your usecase allows it (and not all do) as it can become the only thing internet facing. But you still have to make sure your VPN is working correctly. ---------------------------------------------------------------------- Psychological_Try559 · 2023-11-05 04:03 Hrm, I suppose you could effectively run two networks and VPN into dev? My initial response was to dismiss it, but maybe? I have to think about how to apply that to my setup.... ---------------------------------------------------------------------- Ouity · 2023-11-05 04:42 Use a different subnet. Your devices have some ip like 10.0.0.1, 10.0.0.2, etc, but if you make a new subnet 10.0.10.0, devices on that subnet won't be able to talk to the ones on your main network ---------------------------------------------------------------------- shetif · 2023-11-05 04:50 Well, if you don't have the hardware, yes. ---------------------------------------------------------------------- benbart01 · 2023-11-05 05:05 Wise advice ---------------------------------------------------------------------- No_Dragonfruit_5882 · 2023-11-05 06:58 Go with vlans. Different subnets do not prevent any attacks. They just separate 2 Networks. You can do the same with vlans and add security ---------------------------------------------------------------------- tech2but1 · 2023-11-05 10:09 Same! I started with a lab that has grown over the years. 20 years ago I had an IPCop box, then I added an old PC with FreeNAS then I added another desktop downloading ISOs 24/7. Eventually I started sharing services to family (Vaultwarden, Seafile, Windows desktops/thin client solutions). Now it's a mix of lab and prod, and I'm trying to make it prod level reliable. I do have 2 servers, admittedly both in the same rack but I try and keep critical services on one and the less important stuff on the other but usually if anything goes down it's something like the router or DNS so it's largely down to needing HA rather than a split of services. The rack itself is pretty reliable. ---------------------------------------------------------------------- Legitimate_Farm_3095 · 2023-11-05 13:04 meta post maybe, but they can also polish their search skills and do things like read documentation, search the sub first, etc. ---------------------------------------------------------------------- Ouity · 2023-11-05 13:22 OP's requirements didn't seem to have much to do with security, and if he isn't sure how to describe making a different network, it might be a better start to learn about subnets and then move on to VLANs? Feels like the cart before the horse talking about the security OP would be implementing on his test bench. ---------------------------------------------------------------------- dazchad · 2023-11-05 14:55 Backup. Monitoring/alerts. Automation. Redundancy. ---------------------------------------------------------------------- acid_etched · 2023-11-05 15:54 Nice! Yeah I started way too big with rackmounted stuff I never turned on because I didn’t know what to do with them and they were loud. Downsized to my old desktop and now that I’m vaguely aware of what I’m doing it’s time to upscale again, this time I’m looking to make a mini pc cluster. ---------------------------------------------------------------------- cjwebster93 · 2023-11-05 18:31 I like VLANs too, but subnetting is just fine if you only want a soft barrier between the two groups. Frankly if you’re ok with internal users finding your stuff if they go looking for it, then why complicate? ---------------------------------------------------------------------- wally40 · 2023-11-06 00:54 I've done this with multiple VM's. Prod is a specific VM that I don't make many changes to. Second VM is all out crash and burn most nights. ---------------------------------------------------------------------- h311m4n000 · 2023-11-06 06:49 For the waf, she has a rule any any to the internet and the granular stuff to the inside 😜 ---------------------------------------------------------------------- rad2018 · 2023-11-06 18:19 For me, I have segregated networks, both electronically and electrically. I have a home data center, not a lab. I operate a small business out of my home, so it's two-fold for having a home- based data center: (1) business needs to control my own servers; and, (2) I don't trust anyone outside of me, myself, and I. Everyone these days wants a slice of the pie, no matter how small. Any data that they can snarf up can and will be exploited by them. Google is probably the worst; and, for that, I host my own everything - DNS, web, email, etc. Everything. ---------------------------------------------------------------------- rad2018 · 2023-11-06 18:22 I don't trust VLANS...and neither does NSA. Every network is electrically and electronically isolated. Each switch is its own network. Period. I have more than enough power to host a plethora of network switches, and do so to keep the hot side hot, and the cold side cold. No exceptions. ---------------------------------------------------------------------- No_Dragonfruit_5882 · 2023-11-06 18:23 Lmao. Until you have 300 Vlans.... ---------------------------------------------------------------------- rad2018 · 2023-11-06 18:24 The same is to be said about networking. Too many issues with VLANS. I don't trust VLANS...and neither does NSA. I have more than enough power for multiple switches. Each switch is its own subnet. Currently, I have 9 subnets, so that means 9 switches. It's easier to do the math with /24, too. ---------------------------------------------------------------------- rad2018 · 2023-11-06 18:30 For a small data center, it works. I use small, DIN-rail mounted 1 Gbit switches that consume < 0.2A of power. A single 5A power supply can handle more than a dozen of these small switches. Of the 9 networks, 6 of them only require a few IPs. The remaining 3 are DMZs, in which one is using 2x 48-port switches, and the other is 1x 48-port switch. If the need arises for more than a 24-port small form factor switch, then I switch to larger switches that are powered directly with AC as opposed to DC ---------------------------------------------------------------------- rad2018 · 2023-11-06 18:32 I think that my total power consumption right now is about 2.5A. Not much for a 60A circuit. I've allocated upwards of 10A for the network, with the remaining 50A for the servers and whatnot (KVM, serial->Ethernet converters for OOB, etc.). ---------------------------------------------------------------------- No_Dragonfruit_5882 · 2023-11-06 20:02 I mean electricity is not a Problem in any case i know. But the number of Switches. Nobody will take 300 Switches for 300 vlans. Either: Trust your Vlan Or Vlan + Radius authentication Buying more Switches is just stupid as fuck if you ask me. Aws / Microsoft / Cloudflare / Hetzner use VLAN's aswell as any other enterprise or datacenter u/SevenEleven id like to know your 2 Cents about this topic if thats ok for you ---------------------------------------------------------------------- ElevenNotes · 2023-11-06 21:44 Where's my bat light? Was about to go to bed. /u/rad2018 is paranoid. Yes there have been issues in the past with firmware where a switch did pass 802.1ad frames in an access port, **but** you can easily test that and I have never seen it in the wild, not even on cheap managed switches. VLAN's are as safe as two separate switches, otherwise as you said basically the entire cloud would not work. Wait till /u/rad2018 learns about VXLAN! ---------------------------------------------------------------------- rad2018 · 2023-11-06 22:26 It's no lie - I \*am\* paranoid. If you've seen the things that I've seen over the years, and how many hundreds of thousands of attacks that I receive every hour, every day, you'd think differently. ---------------------------------------------------------------------- rad2018 · 2023-11-06 22:30 For home labs or small data centers, avoiding VLANs isn't or shouldn't be a trouble. For VxLANs, I'll wait until it becomes a more utilized technology. It's great for validating newer technology, but when you do work for the fed govt, or have extremely sensitive data on your systems, properly separating your networks without using VLANs makes more sense. If all you're looking for is running personal stuff like Jellyfin and other non-business, family-based applications sure, go use VLANs or VxLANs. ---------------------------------------------------------------------- ElevenNotes · 2023-11-07 02:17 So why don't I then? Why do I happy VLAN/VXLAN away?