5+ weeks of trying selfhost a cloud, and finally succeed! Best feeling in decades! reddit / selfhosted ---------------------------------------------------------------------- Little-Math5213 路 2023-11-10 21:25 Finally! After weeks fumbling with TrueNAS Core, Scale, tried Unraid and God knows what. My goal was setup a self hosted cloud, and make it as secure as I possibly can. I started with 0 skills within this field, even though I'm a 25+ years experienced as a Sysadmin, this side of IT was new to me. Challenge was a working cloud in my house's basement. Fronted by a strict pfSense, with always-on VPNs. NAT from WAN, with Virtual IP to HAProxy, for then flip traffic down to the basement. Works as a charm, with working ssl certs via pfsense Acme service, Let's encrypt, and all via Clodflare. Finally I solved the issues. The issue was not: - TrueNAS Core - TrueNAS Scale. - My n00b Ubuntu server skills. - pfSense settings too strict. - Always-on VPN (this also need some adjusting though) - HAProxy and them bugs, that you learn to work around. - Nginx reverse proxy. - Neither was it directly any config files in all above. Actually, IF I had started my research in the correct end. But I had no idea that was a correct end per se. Even though when I tried Mozilla's ssl generator page a week or two ago, and based on some of the errors I stumbled over in TrueNAS configs, them ssl, tls, and others, are probably top priority to learn!? After install OwnCloud for experiment, I thought to myself of unknown reasons, "research all you can on Cloudflare website, it seams important!" I did! 6 hours later, my cloud works from outside the house LAN! With working certs! I got goosebumps! It freaking works! My only regret is using a ESXI and all recourses now go to that appliance hehe. Almost tempting to go back to TrueNAS Core, since I now know where the hurdle is. Self hosting is awesome! I just needed to vent and brag to someone. Wife don't care so.. 馃檮 ---------------------------------------------------------------------- TheDiaryofaSoyBean 路 2023-11-10 21:49 I'll tell you good job! First home lab is always the hardest ---------------------------------------------------------------------- Mintfresh22 路 2023-11-10 21:51 Congrats on getting it all figured out. It is a great feeling when something finally works, ---------------------------------------------------------------------- No_Dragonfruit_5882 路 2023-11-10 22:01 Good job. Hope you secured your shit good, cause if not you will find out pretty soon. Good luck with more services ---------------------------------------------------------------------- thekrautboy 路 2023-11-10 22:01 Congrats! Now on to the next project! ---------------------------------------------------------------------- ElevenNotes 路 2023-11-10 22:19 What was your issue with ESXi? ---------------------------------------------------------------------- 00006969 路 2023-11-10 22:48 I dont want to be an ass but is it a cloud if it runs in the same DC/Lab? ---------------------------------------------------------------------- subven1 路 2023-11-11 00:01 It is not. It's just a server or /r/homelab. ---------------------------------------------------------------------- jordant2722 路 2023-11-11 05:43 Wait until you find out that you can host a cloud proxy manager and use something like tailscale for for free for your domains and certs. Then you won't need to open ports on pfSense. ---------------------------------------------------------------------- Little-Math5213 路 2023-11-11 05:54 Thanks for the mind tickler! Yeah, I really need to research tailscale. I know only the tip of the tip of the iceberg. ---------------------------------------------------------------------- Little-Math5213 路 2023-11-11 05:57 No issues what so ever. 95% of my issue was me not scholar myself about ssl, tls and other security protocols, before I tried peace together a system. Lessons learned the hard way (as usual with me) ---------------------------------------------------------------------- Little-Math5213 路 2023-11-11 05:58 You're right! For me, it's just a NAS disk in the basement. But for my family, that shall use this system for share family photos, I guess it's "the cloud" for them. ---------------------------------------------------------------------- Little-Math5213 路 2023-11-11 06:04 Thank you. Already thinking some. Not sure what yet. I have a 20 some TB media server. But I may be old fashion and don't adapt well to new stuff. I rather SMB them drives to my NUC's for Music, TV series, and movies. Dunno why, but browse files is faster than Plex. And I don't need all the extra fat. BUT!! That being said, maybe I will give Plex a new try out. Or test some other media server. Thanks for the gentle push 馃憤 ---------------------------------------------------------------------- Little-Math5213 路 2023-11-11 06:05 Thank you kindly! ---------------------------------------------------------------------- Little-Math5213 路 2023-11-11 06:08 Thank you kindly! Yeah that feeling was/is awesome. Now I feel I can conquer anything! So now I shall tear down this OwnCloud, and for giggles go for TrueNAS Core and NextCloud as first trial, because this is not supposed to work in Jails. But I shall give it my best to try! ---------------------------------------------------------------------- Little-Math5213 路 2023-11-11 06:12 Thanks for the reminder. That's a downside of selfhost. Always be on top with patches and harden everything as well as can be done. While knowing, it can always come a 0 day or other hacks. I shall do whatever I CAN do. Including as now, always have offline backups. One in my safe, and one at a family member. Also, I will never store anything else than family pictures. All be it, if a hack, 5-600gig of pictures lost in the internet isn't fun either. ---------------------------------------------------------------------- thekrautboy 路 2023-11-11 06:35 Maybe think about replacing pfSense, because **[fuck pfSense](https://www.reddit.com/r/selfhosted/comments/17i1dns)** xD ---------------------------------------------------------------------- No_Dragonfruit_5882 路 2023-11-11 08:13 You are already better than some companys i know buddy. You will be fine, trust me ---------------------------------------------------------------------- ElevenNotes 路 2023-11-11 08:26 >My only regret is using a ESXI and all recourses now go to that appliance hehe. but you regret using it? ---------------------------------------------------------------------- leonida_92 路 2023-11-11 11:32 Before going for Plex, I would suggest you have a look at jellyfin. Free, open source and does exactly what you need. ---------------------------------------------------------------------- 00006969 路 2023-11-11 12:27 I know I sound demeaning but I don't want to cast a shade on your achievement. This is awesome! Keep at it brother. ---------------------------------------------------------------------- user01401 路 2023-11-11 14:57 Check out OpenWrt ---------------------------------------------------------------------- thekrautboy 路 2023-11-11 15:06 Its mentioned in that thread. ---------------------------------------------------------------------- originalodz 路 2023-11-11 17:01 Because it never ends, right? 馃槃 ---------------------------------------------------------------------- lev400 路 2023-11-11 17:38 Running services inside a VM is a good idea. Best to best to run a hypervisor like ESX on the hardware rather than a more complex OS. Well done 馃憦 ---------------------------------------------------------------------- TheDiaryofaSoyBean 路 2023-11-11 18:39 Exactly, a year later now I host Bitwarden, Gitea, firezone, Nextcloud, bookstack, mailcow, jellyfin and ferdium for about 20 people haha ---------------------------------------------------------------------- Little-Math5213 路 2023-11-11 19:39 Because you KNOW the feeling. This is the way! ---------------------------------------------------------------------- Little-Math5213 路 2023-11-11 19:43 Appreciated! ---------------------------------------------------------------------- Little-Math5213 路 2023-11-11 19:45 Gotta love them snapahots. Saved my behind more than once. And being so simple and rock stable at the same time. ESX is a God send. ---------------------------------------------------------------------- Little-Math5213 路 2023-11-11 19:54 I wrote it wrong. I regret using all resources for one appliance Normally I have a whole Domain on one ESXI. Even dual DC's. Print Server, File Server, Up to 10 servers when I lab hard enough. Felt weird having only one resource for that blade. But.. I repurposed a older tower, with 12gig RAM and a decent cpu. Perfect for TrueNAS core with now working inna jail, exposed from the dark side. Way less power usage than the "Big Boy Mr Blade" ---------------------------------------------------------------------- Little-Math5213 路 2023-11-11 19:57 I know! I smell Bitwarden at least as next. That is IF it's in TrueNAS Core. I fell in love with Core. SSH in to jails native from Win pcs is very handy. I read many dislike Core, but I'm quite a fan boy by now. ---------------------------------------------------------------------- Little-Math5213 路 2023-11-11 20:02 I shall at least go for Bitwarden too. What's worst case scenario? I guess you don't sync with real Bitwarden as a backup? But we coooiuld? Or what's your backup plan if shtf? Cold restore of server? ---------------------------------------------------------------------- TheDiaryofaSoyBean 路 2023-11-11 20:05 I鈥檇 recommend supporting the project by buying the family subscription, then using bitbetter to get all the enterprise features depending on how far you want to go with Bitwarden. That鈥檚 what I do at least, because I wanted Duo but obviously can鈥檛 afford the enterprise version. And for backup, I have two highly available MSSQL servers, one at my house and one at my friends house that Bitwarden uses, and then every night the entirety of both VM鈥檚 that鈥檚 running the SQL servers gets encrypted and backed up to back blaze ---------------------------------------------------------------------- Little-Math5213 路 2023-11-11 20:05 Haven't had a reason to try. Other than lab a few Cisco ones, pfSense won my heart. Perfect with them addons, Acme, HAProxy, OpenVPN, Wireguard, Snort, pfBlocker. I hate ads.. ---------------------------------------------------------------------- Little-Math5213 路 2023-11-11 20:06 It's on my list with Bitwarden, thanks for the reminder. ---------------------------------------------------------------------- thekrautboy 路 2023-11-11 20:08 You can do all of that with other software too, without supporting a horrible company like Netgate lead by garbage people. ---------------------------------------------------------------------- Little-Math5213 路 2023-11-11 20:20 Been supporting them since day 1 I found out about them. Worth every cent for a privacy aware person. It seams I know only the tip of the iceberg there too! Interesting about them features. I pay for my family's sub, but I've never dove in to read what else there is. That sounds like an great backup plan, Mr. I wrote that down in my task list. Probably saved me a week or two of researching that. Thanks, brother. I owe you a beer! ---------------------------------------------------------------------- TheDiaryofaSoyBean 路 2023-11-11 20:29 Haha no problem at all! I also run automated jobs everything that just backup the SQL database too. I forgot about that. It鈥檚 incredibly helpful if you have a friend who鈥檚 into home labs as well and has some storage available, you can do an IPSEC tunnel between networks and have an SMB share or an iSCSI drive for your VM鈥檚 ---------------------------------------------------------------------- TheDiaryofaSoyBean 路 2023-11-11 20:44 And BackBlaze B2 buckets are incredibly cheap, I have like 200 something gigs in a bucket right now and pay like 23 cents a month. Yes, cents. Not dollars.