What service one should NOT self host reddit / selfhosted ---------------------------------------------------------------------- SuperWill5633 · 2023-11-22 22:50 Like the title says, I'm new to self hosting world. 😀 while I was researching, I found out that many people dissuaded me to self host email server. Just too complicated and hard to manage. What other services that you think we should just go use the currently available providers in the market and why? 🙂thank you ---------------------------------------------------------------------- AnApexBread · 2023-11-22 23:01 Honeypots (at least from your home). Chances are that you don't have the time to properly monitor a honeypot to collect information on hackers. All you're doing is creating a vulnerable system and inviting hackers to come after you. ---------------------------------------------------------------------- the9engines · 2023-11-22 23:03 Email ---------------------------------------------------------------------- dev_all_the_ops · 2023-11-22 23:04 Hosting your own mailserver isn't just complicated and hard to manage, it is a security risk for others. Many ISPs specifically don't allow port 25 because they don't want to to accidentally become a spam relay. Besides mail you can host whatever you want as long as you understand the security risks. Webservers, database servers are common targets. Be real careful if you expose those to the internet. ---------------------------------------------------------------------- JPTHEBOLT · 2023-11-22 23:04 Supposed to email is not that bad as long as you use a mail relay ---------------------------------------------------------------------- Diligent_Ad_9060 · 2023-11-22 23:24 I've stayed away because of opinions like this. But isn't it very exaggerated? Why would you have an open unauthenticated relay? Why would things like dmarc, spf records, spamd etc be so much more complicated than everything else people are doing here? Is it really that hard to get right compared to other things? The only caveat I can come to think about is if you use a new domain that hasn't been "rated" yet your mail is likely going to end up in people's spam folders. ---------------------------------------------------------------------- Simplixt · 2023-11-22 23:25 E-Mail. And maybe unpopular opinion: 1) Any service that you use with port-forwarding, besides WireGuard. I would never access any self-hosted application without VPN. 2) Password manager. I want to minimize complexity with my most important data (that's why I'm using KeePass instead of Self-Hosted Bitwarden). ---------------------------------------------------------------------- Diligent_Ad_9060 · 2023-11-22 23:25 Some generic purpose LLM probably. ---------------------------------------------------------------------- xerker · 2023-11-22 23:29 Aside from other stuff mentioned here about email. I always assumed I'd become a target for spam that I'd have a harder time filtering out to the point it stops being worth it to have a custom email address. That and I can almost guarantee I would end up screwing up the backup of my inbox and losing everything rending the whole endeavour pointless. ---------------------------------------------------------------------- Accomplished-Lack721 · 2023-11-23 00:00 The login page to your NAS. ---------------------------------------------------------------------- JoeB- · 2023-11-23 00:01 Choosing a service to NOT selfhost is a subjective descision. I host 18 Proxmox VMs and 20 Docker containers at home. I also was selfhosting WebDAV for synchronizing my Joplin notes between devices and Vaultwarden for managing my Bitwarden vault, but decided to push the Joplin synchronization target to Dropbox [free] and to use Bitwarden's free cloud solution for my passwords and secure notes. I did this because I will need immediate access to these two critical sources of information should my house burn down, or get blown over by a tornado. I have extremely strong passcodes for these and trust the hosts. This was strictly a personal decision. YMMV. ---------------------------------------------------------------------- Teapeeteapoo · 2023-11-23 00:01 Gonna respectfully disagree, with the big fat asterisk that, its very expensive. A decent generalist model that you can integrate with your existing files without security risks or random censorship when you ask it about something entirely mundane is a prettynsolid use case. ---------------------------------------------------------------------- mrpeenut24 · 2023-11-23 00:09 I run 3 different mail servers. I don't understand why it's always so dissuaded, it's not much different than running any other service. That said, nearly 10 years in, I'm still finding my outgoing emails caught in spam filters, despite using a VPS that's not on any SBLs. Incoming mail, the only problem I have is sometimes legit servers get caught in the firewall and mail gets dropped. I also need to get around to setting up a store-and-forward caching server for when I lose power or perform upgrades. DMARC, DKIM, SPF, fail2ban, spamassassin, and proper firewall applications are all within the realm of DIYers, you just need to keep it segregated and stay on top of new technologies and attacks. ---------------------------------------------------------------------- thedawn2009 · 2023-11-23 00:11 Keeping a mail server secure is easy. Occasionally a misconfiguration happens and then you've got an open relay. There's a huge risk in the big providers blacklisting your servers ip block because others are spamming from servers in the same range. Big inconvenience if delivery stopped one day and you have to spend a week getting removed from Blacklists. The easy way around it is to use a relay service like SES, Mailgun, etc but that takes away from the self hosting "purity". I personally use Mailcow with SES as a relay. It works perfectly and I don't pay anything for SES because my volume sending is so small. ---------------------------------------------------------------------- mrpeenut24 · 2023-11-23 00:11 I run email servers at home. I get zero spam. I use one email address per website, and if I ever see the email address being used by a different domain, the address is removed and I either stop using the site or I create a new address and update the website. ---------------------------------------------------------------------- Simplixt · 2023-11-23 00:12 A comment of downvoters why disagree would be appreciated ;) ---------------------------------------------------------------------- chapel316 · 2023-11-23 00:15 I don’t necessarily agree fully with that. Unless you mean externally facing honeypots, then I’m on board fully. But running internal honeypots are a great idea. We don’t normally have time to secure our networks like we should, so to have a canary of sorts that can alert you to any strange things going on in your network that probably shouldn’t is not the worse idea. ---------------------------------------------------------------------- Accomplished-Lack721 · 2023-11-23 00:16 I mean, technically, yes, self-host it. But don't expose it to the Internet. ---------------------------------------------------------------------- erikerikerik · 2023-11-23 00:22 Early&mid 2000’s mind set that email servers are all honeypots in disguise ---------------------------------------------------------------------- JaJe92 · 2023-11-23 00:27 Clearly opening RDP port on internet. NEVER. ---------------------------------------------------------------------- dgibbons0 · 2023-11-23 00:30 Personally I don't think it's worth hosting recursive dns resolvers. Most of the options with ad blocking are single points of failure and when it breaks the household acceptance factor is just too low. ---------------------------------------------------------------------- timawesomeness · 2023-11-23 00:34 A properly configured authenticating reverse proxy over HTTPS is just as secure as a VPN and a lot less of a hassle to use ---------------------------------------------------------------------- mrpeenut24 · 2023-11-23 00:39 I certainly get a TON of login attempts. But fail2ban takes care of it after the first or second attempt. I've got 700 IPs being blocked currently, 90% of those from the last 24 hours. It's not really something I worry about much anymore. China mostly uses credential stuffing or "top 10 user/pass combos"-type attempts, and I keep an eye out for any of my accounts leaking. ---------------------------------------------------------------------- timawesomeness · 2023-11-23 00:40 Internet-accessible authoritative DNS nameserver(s) (unless you have a completely static public IP). ---------------------------------------------------------------------- erikerikerik · 2023-11-23 00:41 On any given day I’m blocking around 28~32k IPs. But that number is much less if you group the first 2 blocks together. ---------------------------------------------------------------------- Drumdevil86 · 2023-11-23 00:43 Or your 12 year old IP cam ---------------------------------------------------------------------- netvip3r · 2023-11-23 00:46 Traditionally setup email If your server is at home, your IP is likely blacklisted and/or your provider has blocked the necessary ports. Not to mention the layers of potential headaches dealing with potential spam block dbs, especially if you don't own your IP. You can of course do custom setups allowing you to skirt these restrictions, but can sometimes be a bit complicated and typically involve non-traditional customizations. ---------------------------------------------------------------------- MrAffiliate1 · 2023-11-23 00:53 I don't understand why people discourage this soo much. A mail server is like exposing any service to the internet. If it ain't configured properly or kept up to date then yes regardless what you are self hosting it's going to be attacked. It's not like there's no resources out there to guide you through the steps. I've been self hosting a mail server for 5 years. The first 2 years I configured the whole system myself, from dovecot, postfix, roundcube and etc. I then moved over to mailcow as it was just easier to manage. Once Dkim, Dmarc and SPF are all set up and you are using SSL/TLS or STARTLLS then you are fine. There are guides out there like any other service. There a few caveates, such as you cannot start mass sending a bunch of emails, outlook in general just blocks data center IPS so you may need a relay if you are sending to outlook mail accounts. ---------------------------------------------------------------------- Omni__Owl · 2023-11-23 00:56 Can you elaborate on what "random censorship" looks like when you do entirely mundane things? ---------------------------------------------------------------------- AnApexBread · 2023-11-23 00:57 I completely agree with everything you said. I generally don't consider Canary Tokens as honeypots. I was more specifically referring to running things like a vulnerable W2000 Server trying to log attacks. ---------------------------------------------------------------------- Teapeeteapoo · 2023-11-23 01:04 The attempt to align chatgpt made it stupid at points. Rather thsn just tell you somrthing, it'll give a speil with the clasdic "as an AI language model" stuff. There are plenty of examples like: write the gettysburg address in robot noises or generate top 10 anime deaths list that it'll complain about. There are workarounds ofc but its silly in the first place. ---------------------------------------------------------------------- SuperWill5633 · 2023-11-23 01:08 I'd not exposing it to the internet then how could I log in ? I looked it up and people suggest that I put this behind a proxy. Or maybe I could use client side certificate auth?? ---------------------------------------------------------------------- outtathesky_fellapie · 2023-11-23 01:09 VPN ---------------------------------------------------------------------- Accomplished-Lack721 · 2023-11-23 01:10 You can log in when you're already on your internal network. If you have a need to access it remotely, connect to your network via a VPN, and then access the login page as if you were on the internal network. Having a NAS's login page out at some domain on the Internet, whether behind a reverse proxy or otherwise, is just asking for a ransomware attack. ---------------------------------------------------------------------- HTTP_404_NotFound · 2023-11-23 01:23 Don't host your own email server. Just trust me. ---------------------------------------------------------------------- NikStalwart · 2023-11-23 01:23 Objection. Anyone capable of properly configuring a reverse proxy is equally capable of properly configuring and easily using a VPN. Everyone else are just following point-n-click tutorials mindlessly. Not something I would consider secure. I need to get into writing deliberately-malicious tutorials to see how many silly people fall for it. ---------------------------------------------------------------------- DIYSRE · 2023-11-23 01:24 Externally facing recursive DNS sure, but having one internally is very set-and-forget. If you're in a position to run opnSense as your networks firewall, unbound is quite reliable and supports dns rbl. If you're just looking to have a simple service running that handles local-only translations then bind9 is rock solid. Your biggest point of failure will be the machine running either. In the formers case, you have bigger issues than DNS. In the latters case, it will be extremely uncommon. ---------------------------------------------------------------------- usernamefindingsucks · 2023-11-23 01:25 At least where I am, If you're self hosting it from your own home not using a business account, you likely can't convince your connection provider to set the reverse DNS for the IP you are using. Assuming SPF, DKIM are all ok, missing or non-matching reverse DNS can send something to a spam folder ---------------------------------------------------------------------- NikStalwart · 2023-11-23 01:25 You have spoken against the hivemind. The hivemind need not explain itself. ---------------------------------------------------------------------- therealsimontemplar · 2023-11-23 01:26 I’ve seen far too many compromised Wordpress installations to ever consider installing it in my home dmz. ---------------------------------------------------------------------- usernamefindingsucks · 2023-11-23 01:28 Run two dns resolvers if you do it, that way you can restart/upgrade one at a time and the other will still function. Raspberry pi's are cheap for this. ---------------------------------------------------------------------- Other-Technician-718 · 2023-11-23 01:29 Amd that's why you host two dns resolvers, with different update times - if one breaks, you have between a few hours to days to fix things. ---------------------------------------------------------------------- f3xjc · 2023-11-23 01:38 Self hosted mail is dying. It's not just the configuration. It's the other side flagging you as spam, reputation etc. ---------------------------------------------------------------------- DSPGerm · 2023-11-23 01:39 Yeah I was going to say a website in general. Arguments can be made for why one should or can but in the end hosting is cheap(or free) for basic sites and I don't have to worry about staying on top of every single thing. ---------------------------------------------------------------------- kucksdorfs · 2023-11-23 01:40 That was a fun week for me. Luckily not one of my main domains... ---------------------------------------------------------------------- audero · 2023-11-23 01:50 Password manager. While some may cache on your client devices, by and large if your server goes down, no passwords. ---------------------------------------------------------------------- mkosmo · 2023-11-23 01:50 Email. It’s not worth the hassle. ---------------------------------------------------------------------- mkosmo · 2023-11-23 01:53 Reputation management for mail providers is a pain that most don’t seem to realize is something they need to do. ---------------------------------------------------------------------- arwinda · 2023-11-23 01:55 > then how could I log in In your LAN. If the files on your NAS are any important, consider that the best defense against a break-in is to not have the NAS available over the internet. Short of not making it accessible over the internet, make sure the NAS only listens to the VPN address. And make sure all updates are installed. ---------------------------------------------------------------------- arwinda · 2023-11-23 01:56 Especially if the mailserver is running on a dialup address. Many large ISPs block any mail coming from dialup ranges. ---------------------------------------------------------------------- Deses · 2023-11-23 02:06 That sounds very interesting. How would one go about setting one up? Just listing some names would be enough for me, I'd do the proper research on my own. :) ---------------------------------------------------------------------- ffimnsr · 2023-11-23 02:09 Just like everybody says EMAIL. Just don't be the spam relay that will have hackers spam other mail exchanges. ---------------------------------------------------------------------- madmouser · 2023-11-23 02:23 OSSEC here instead of fail2ban, but yeah. Black hole the offenders. ---------------------------------------------------------------------- Fratm · 2023-11-23 02:29 lol I don't trust you, and I have been hosting my own email for years. but I am also a sysadmin in my day job, so I actually know what I am doing. ---------------------------------------------------------------------- HTTP_404_NotFound · 2023-11-23 02:33 Cool story bro? But, I wasn't commenting on anyone's skill level at all. The reason(s) are... 1. You are going to miss on a lot of mail. Because google/other major mail providers, love to blacklist residential IP ranges. 2. Lots of ISPs actually like to block SMTP ports, regardless. 3. You will have mail delivery failures. Because, again, it's pretty common for big-mail providers to blacklist residential IP ranges. 4. Tracking down mail-delivery issues, is not much fun. Gets pretty old, pretty quick. DKIMs,SPF checks? That is the easy part. SRS schemes? Piece of cake. Getting your IP/Domain unblocked from other major providers because you tripped their spam filters? That is a PITA. ---------------------------------------------------------------------- foofusdotcom · 2023-11-23 02:38 Not only do I encourage people to run their own mail server, I think it's one of the absolute best things you can do at the beginning of a cyber security career to really get a full sense of security across the entire stack. Install your own server, your own mail server, secure it top to bottom and you'll have touched dozens of RFCs and attack surfaces. Once you intimately understand those things (which you will after a while!) You've got extremely good cyber security fundamentals to rely on. ---------------------------------------------------------------------- Server22 · 2023-11-23 02:47 Email. I always recommend AWS SES. Use it at as an SMTP relay and any internal services gets restricted access through IAM. ---------------------------------------------------------------------- Deadlydragon218 · 2023-11-23 02:47 Could have summed up with just “your NAS” with the addition of databases. Certain things such as storage should be heavily protected and never touch the internet. Like a root CA. ---------------------------------------------------------------------- Deadlydragon218 · 2023-11-23 02:50 Disagree with the email portion. As long as you do your research you can absolutely host your own e-mail server. Thats coming from someone who has managed email security gateways as a primary role. ---------------------------------------------------------------------- Deadlydragon218 · 2023-11-23 02:51 Disagree, you can use public lists to keep yourself fairly safe. +DMARC/DKIM/SPF. ---------------------------------------------------------------------- mkosmo · 2023-11-23 02:52 It's not about keeping yourself safe. It's about being able to send mail. None of the listed technologies do a damn to protect you in any direction - they simply prevent your mail domain from being spoofed by others. ---------------------------------------------------------------------- GOVStooge · 2023-11-23 02:52 ?? That's like the one of the easiest things to run. I have two pihole/unbound resolvers running and it's wonderful! Handles all my internal DNS resolutions so I don't have to worry about IPs and resolves everything outside on it's own. As someone else said though, don't expose them to the internet. ---------------------------------------------------------------------- Deadlydragon218 · 2023-11-23 03:12 I have had no issues sending mail from a residential IP. W/ comcast you can auth to their mail relays and send from your domain through their relays via your own comcast creds. ---------------------------------------------------------------------- gwillen · 2023-11-23 03:12 > I don't understand why it's always so dissuaded... > ... nearly 10 years in, I'm still finding my outgoing emails caught in spam filters, despite using a VPS that's not on any SBLs. Asked and answered, councillor. ---------------------------------------------------------------------- SomeDumbPenguin · 2023-11-23 03:14 Yeah, I have a Pi that notifies me if anything talks to it on my internal nets (have separate multiple ones) that's not directly internet accessible. It's aliased to some common IP's like x.x.x.1 & .254 that would be looked at. Gateway's on a nonstandard IP. Things on my smart home lan are usually the only stuff that scans to trigger it. Things like TV's, Alexa devices, and printers ---------------------------------------------------------------------- mrpeenut24 · 2023-11-23 03:17 Maybe 1% of emails. In most cases, it's easy to find the offending blocker (proofpoint was the latest) and request removal from their lists. And how often do you send emails anyway? I might send 5 emails a week, and most are to my family, who've already added me to their contacts. ---------------------------------------------------------------------- NoStructure371 · 2023-11-23 03:17 suricata is probably the most popular one ---------------------------------------------------------------------- mrpeenut24 · 2023-11-23 03:17 I keep snort out front, but it doesn't catch everything. ---------------------------------------------------------------------- mrpeenut24 · 2023-11-23 03:18 Yeah, I don't have reverse DNS on my home connection, but my VPS that I use for outgoing emails makes it real easy to set it up. ---------------------------------------------------------------------- zfa · 2023-11-23 03:25 I don't self host anything where it would impact me unduly if it went down while I was on holiday to the point where I'd have to break state and go fix stuff. I don't want to have to leave my beer and head off to fix things like an email server, restore a password manager etc. so anything critical to the point where an outage would prob need me to do so means I pay someone else. ---------------------------------------------------------------------- hhoverflow · 2023-11-23 03:27 Even with those authentications that require a token from the phone etc? ---------------------------------------------------------------------- Sensitive-Farmer7084 · 2023-11-23 03:30 I'm waiting for the big reveal that Wordpress was actually a long con honeypot this whole time. ---------------------------------------------------------------------- Sensitive-Farmer7084 · 2023-11-23 03:37 I think there's a hangup on the term "self-host" where some people are assuming it's going to be exposed to the Internet. I self-host a ton of stuff that is only available inside my home network or through my VPN, which is not publicly discoverable. I would never open a TCP port to the world from my home network. That's how you end up on shodan. So yeah, if it has to accept inbound connections from arbitrary other systems on the dirty internet (email, mastodon, etc), it's not happening on my network, and probably not at all because it's a pain in the ass to stay patched. ---------------------------------------------------------------------- RedFive1976 · 2023-11-23 03:41 Mail server or anything using RDP. ---------------------------------------------------------------------- opensourcecolumbus · 2023-11-23 03:59 A service which is hard to maintain. You don't want to host that. It could be due to many reasons * Your lack of knowledge in that particular domain or tech * The project is not mature * A tech/domain that goes through major changes frequently ---------------------------------------------------------------------- bbyboi · 2023-11-23 04:05 Email ---------------------------------------------------------------------- Scared_Bell3366 · 2023-11-23 04:10 I’ve run my own in the past. There are good install packages like iRedMail that will set things up in a good manner. The biggest issue is that this is the one service where a static IP is a must. For me, it’s more cost effective to pay someone to host my mail than get a static IP address. As far as reverse DNS issues, craigslist was the only place that I had issues. No other mail server I sent to cared about that. The only other thing I will add is that looking at mail server logs is a bit scary. It will be constantly hammered by attacks 24/7. On the flip side, you’ll have a handy list of default user names and passwords for products you didn’t know existed. ---------------------------------------------------------------------- CompetitiveYam6697 · 2023-11-23 04:30 True, which is why I have cloudflare 1.1.1.3 as my secondary dns. If I see ads, my pihole is down. Not an ideal solution but it works for me ---------------------------------------------------------------------- CompetitiveYam6697 · 2023-11-23 04:33 For me that's just unnecessarily complicating things. These days I just use mailgun with gmail as an inbox. ---------------------------------------------------------------------- PirateParley · 2023-11-23 04:40 canary tokens - look on youtube lawrence systems ---------------------------------------------------------------------- D0ublek1ll · 2023-11-23 05:03 I have an internal honey pot that, when accessed, cuts the power to my router using a smart plug. I self host a lot of things so this is a good way to ensure automatic safety inside of my network by breaking the physical chain required for an attacker to jump between networks or access the outside. ---------------------------------------------------------------------- crazy_gambit · 2023-11-23 05:18 I don't think that's true. I self host Bitwarden and if my server goes down the app on my phone still works perfectly. New passwords wouldn't sync to other devices, but I can live with that. It's been super reliable. ---------------------------------------------------------------------- miteycasey · 2023-11-23 05:36 Email ---------------------------------------------------------------------- dgibbons0 · 2023-11-23 05:54 It doesn't really function though, having a full second added on to every dns query basically makes desktops unusable. It's even worse on unix systems, as the default timeout is 5 seconds. and these aren't stateful. So it's not 5 seconds ONCE and then it defers to the secondary. It's 5 seconds for each resolution. ---------------------------------------------------------------------- Novel_Plum · 2023-11-23 05:54 But what if you change the port? ---------------------------------------------------------------------- KN4MKB · 2023-11-23 05:57 An externally facing Honeypot is not really "vulnerable". Modern honeypots only appear that way on purpose. But the types of people who are usually running honeypots are cyber security researchers, who should know what to do with the data. Usually they emulate vulnerabilities within containerized or fake environments. With a proper Honeypot + IPS you can increase the security of your network by blocking bad actors network wide as soon as they trip something within the Honeypot. Most scanners and bad actors can pick up honeypots anyways, and usually get you added to a sort of blacklist by the bad actors as they assume you are bad news for them, so it can actually decrease potential threat actors. ---------------------------------------------------------------------- dgibbons0 · 2023-11-23 05:58 Cool, how do you keep the settings in sync between them? Because as of last I checked pihole didn't support any option for syncing settings, which meant manually managing multiple configurations as well as block/allow lists. Maybe that works if you're the only person who uses it but that's completely unusable if you're supporting a household of users. Trying to educate my users that if they get blocked they have to dig through two different systems logs to determine what the hostname that was blocked... again pretty unreasonable. ---------------------------------------------------------------------- KN4MKB · 2023-11-23 06:01 If your NAS is properly updated, and SSL is used, then the login screen it just as safe as any other web app with regular updates. I would ask why someone would want that. ---------------------------------------------------------------------- KN4MKB · 2023-11-23 06:04 Meh, been doing it for 5 years now with minimal issues. Had one issue come up where my domain was flagged as malicious, but was solved in a few days and some emails to security vendors. I think it's important that those who can, and are educated enough to keep it running properly do host their own. Hosting your own email should be encouraged if capable because it helps reduce the monopoly, and keep a little bit of power for those who want to retain email privacy. ---------------------------------------------------------------------- dgibbons0 · 2023-11-23 06:07 Neither is user friendly to allow someone who's not me to make allowlist updates in the event they get blocked by something they want access to. And just throwing more load on a router seems a questionable solution to a SPOF. Nextdns.io lets me enable custom profiles for different users, each of which can have their own allowlists and also protects mobile devices. It's just better than the self-hosted options, across the board. ---------------------------------------------------------------------- lilolalu · 2023-11-23 06:09 Anything that has high peak guaranteed bandwidth requirements like video conferencing, video streaming etc. ---------------------------------------------------------------------- KN4MKB · 2023-11-23 06:09 Anything I host in production can't really go down unless the house burns up. Then it's a 1 day turn around to get encrypted backups in the cloud running. High availability, backup redundancy, and failover internet will solve that. ---------------------------------------------------------------------- pendorbound · 2023-11-23 06:09 Core Wordpress with auto update enabled is reasonably secure. The compromises mostly come from crufty third party plugins written by coders who wouldn’t know a sql injection from a hole in the ground. ---------------------------------------------------------------------- pendorbound · 2023-11-23 06:10 Then it’ll last approximately 1.5 milliseconds longer before somebody starts hammering on it. ---------------------------------------------------------------------- ProfessionalAd3026 · 2023-11-23 06:19 A CDN ---------------------------------------------------------------------- Comakip · 2023-11-23 06:34 Look into Tailscale ---------------------------------------------------------------------- eirsik · 2023-11-23 06:38 Not a problem, here you go: https://github.com/vmstan/gravity-sync One pihole as master and one as slave, shit on master gets synced to slave ---------------------------------------------------------------------- Traditional_Wafer_20 · 2023-11-23 06:49 Bitwarden. This is damn too critical for me to rely on just my ISP. ---------------------------------------------------------------------- Piddoxou · 2023-11-23 06:49 What about Overseerr? ---------------------------------------------------------------------- lannistersstark · 2023-11-23 06:51 > so I actually know what I am doing. All it takes is Microsoft arbitrarily deciding you're spam for it to fuck up for you. ---------------------------------------------------------------------- gamble4846 · 2023-11-23 06:52 i use tailscale to access my remort desktop is that fine or should i remove that too? ---------------------------------------------------------------------- lannistersstark · 2023-11-23 06:52 >Can you elaborate on what "random censorship" looks like when you do entirely mundane things? Like Claude 2.1 refusing to write a script to "kill python processes" because it's harmful to the system. ---------------------------------------------------------------------- kmaster360 · 2023-11-23 06:54 I tried hosting a rdp server behind traefik reverse proxy once. Same port 443 as all my other services, you basically had to know the subdomain in order to connect to it. Rdp defender still got triggered somehow by unsuccessful login attempts by randos. Luckly no successful logins happened, and I didn't even leave it up that long, but I learned my lesson. ---------------------------------------------------------------------- rainformpurple · 2023-11-23 06:57 That's fine. ---------------------------------------------------------------------- Toutanus · 2023-11-23 06:58 Globally I'd say do not self host what you can't manage to lost. ---------------------------------------------------------------------- NobodyRulesPenguins · 2023-11-23 07:00 That's the thing, if we leave 1. Continue to grow more and more there will be no place for us at the end, and the place is already small. Sure it's impossible, but "ideally", if everybody selfhost mail, who care about what is blacklisted by the major mail providers, If everybody send mail to others selfhosted mail services instead! That will probably never be, but they already almost dictacte how mail should work, and that is bad. ---------------------------------------------------------------------- PotatoGroomer · 2023-11-23 07:08 Right but you mentioned neither of those originally; you just made a blanket statement about self hosting a recursive DNS server which is what I was replying to. It only matters to a household that contains people who want that functionality. You should mention this if you're going to make a blanket statement like you did. Using a third party is not a better solution overall, just for your use case. Having DNS on an opnSense box is fine. DNS by itself doesn't product any significant load. It would be a very fringe case if running DNS on an opnSense box caused any measurable decrease in DNS resolution, or it would be an entirely different issue entirely. ---------------------------------------------------------------------- DIYSRE · 2023-11-23 07:09 Right but you mentioned neither of those originally; you just made a blanket statement about self hosting a recursive DNS server which is what I was replying to. It only matters to a household that contains people who want that functionality. You should mention this if you're going to make a blanket statement like you did. Using a third party is not a better solution overall, just for your use case. Having DNS on an opnSense box is fine. DNS by itself doesn't product any significant load. It would be a very fringe case if running DNS on an opnSense box caused any measurable decrease in DNS resolution, or it would be an entirely different issue entirely. ---------------------------------------------------------------------- mirisbowring · 2023-11-23 07:11 Isnt this for media? ---------------------------------------------------------------------- Piddoxou · 2023-11-23 07:11 What I mean is, this is also running a website ---------------------------------------------------------------------- mirisbowring · 2023-11-23 07:13 And then there is mailcow that automates or at least supports you in all these steps ---------------------------------------------------------------------- Verum14 · 2023-11-23 07:14 that’s actually kinda fuckin smart screw a canary, we’re going full dead mans switch ---------------------------------------------------------------------- Diligent_Ad_9060 · 2023-11-23 07:18 I was more talking about the idea of self hosting something like "ChatGPT at home". At a company level where it's trained on internal data seems like a great idea though. ---------------------------------------------------------------------- majordingdong · 2023-11-23 07:21 Sounds like security by obscurity. ---------------------------------------------------------------------- borg286 · 2023-11-23 07:29 Push notifications. It is fine hosting a service that gets requests then talks to FCM or the iOS version. But a service that one's phone stays connected to 24/7 is really hard, and not kill one's battery. ---------------------------------------------------------------------- r4nchy · 2023-11-23 07:32 email service ---------------------------------------------------------------------- Tivin-i · 2023-11-23 07:46 That's an awesome idea 💡! Going to adopt it. ---------------------------------------------------------------------- HecateRaven · 2023-11-23 07:46 I'm doing it on a bm I rent for 10 years now without issues with spf, dmarc, dkim and everything from scratch (no docker bloat) ---------------------------------------------------------------------- ro55mo · 2023-11-23 07:51 Personally, a WireGuard VPN which is also self hosted. ---------------------------------------------------------------------- FlockSystem · 2023-11-23 07:52 What do you mean by "clearly". Open RDP without password protection? I have an RD ---------------------------------------------------------------------- foshi22le · 2023-11-23 07:52 Do you have a tutorial for setting that up? ---------------------------------------------------------------------- aeroverra · 2023-11-23 07:55 So just set them up for people you don't like when they ask to fix their printer? ---------------------------------------------------------------------- vkapadia · 2023-11-23 07:55 What is wrong with that? Don't they still need correct credentials to connect? ---------------------------------------------------------------------- foshi22le · 2023-11-23 07:55 The only port open on my network is for Plex server, is that risky? ---------------------------------------------------------------------- Tivin-i · 2023-11-23 07:56 Any public facing service that other (services) depend on should not be running on a public IP (especially ones that translate addresses, and ones you have to manually update). You could run an authoritative NS "hidden" where only your secondary NS can reach out to for zone transfers. You could also escape having a public IP if you configure rsync or scripts to update secodary host files on every IP change. ---------------------------------------------------------------------- Carilion · 2023-11-23 08:05 6 u6 ---------------------------------------------------------------------- Simplixt · 2023-11-23 08:07 The reverse proxy might be secure. The applications behind not. I would say most of these small projects are not hardned for security or reviewed all the time. You can mitigate with 2FA via Forward proxy of course ... Also it's much more complex to keep multiple apps up to date all the time, when just the VPN. ---------------------------------------------------------------------- Simplixt · 2023-11-23 08:08 The reverse proxy might be secure. The applications behind not. I would say most of these small projects are not hardned for security or reviewed all the time. You can mitigate with 2FA via Forward proxy of course ... Also it's much more complex to keep multiple apps up to date all the time, when just the VPN. ---------------------------------------------------------------------- Im1Random · 2023-11-23 08:16 I did it anyway some time ago and I'm really happy with it. I'm using my own email addresses for absolutely anything by now. ---------------------------------------------------------------------- frogotme · 2023-11-23 08:35 It's not exactly hard to set up an email server. I doubt your fancy sysadmin job helps that much short of bribing Google and Microsoft ---------------------------------------------------------------------- one-joule · 2023-11-23 08:35 The password isn't enough. It's not a hardened protocol and [vulnerabilities are found in it with some regularity.](https://stack.watch/product/microsoft/remote-desktop/) There have been unauthenticated RCEs before, ie nightmare scenario. ---------------------------------------------------------------------- d_maes · 2023-11-23 08:37 Tarpits on the other hand, are huge fun. I run ssh on a different port, for the sole reason of keeping my logs cleaner, and run endlessh on port 22. Always happy to slow down some bots and keep them busy instead of attacking others. ---------------------------------------------------------------------- Omni__Owl · 2023-11-23 08:38 Sounds fairly niche to me. Mundane I'd think would be "what's the weather today", "who was the lead singer of abba" or "write me a recipe for cornbread". ---------------------------------------------------------------------- cyborgborg · 2023-11-23 08:44 mail from that server would be marked as spam by all the other email providers so that would be annoying. and the addition that email is an inherently unsecure unencrypted messaging protocol doesn't help any mail you send will be viewable by whoevers email provider you send them to. Protonmail etc do offer end to end encryption but thats only between protonmail users (or skiff or whatever) and them saying that they store your emails encrypted just means they receive it, can look into it and then encrypt it. ---------------------------------------------------------------------- Vogete · 2023-11-23 08:47 A password manager because if anything goes wrong, you'll be completely screwed. What you SHOULD absolutely self host though is a password manager, so you can be in control of your most sensitive data. Regarding email, I think everyone should absolutely self host it, but it's less and less viable in this google/Microsoft duopoly world. But ideally everyone would self host it. The reason why people advise against it really comes down to lack of real competition, and the two tech giants dictating how we violate every RFC possible. ---------------------------------------------------------------------- InsaneNutter · 2023-11-23 08:48 > That said, nearly 10 years in, I'm still finding my outgoing emails caught in spam filters, despite using a VPS that's not on any SBLs. That's why I don't. You can do everything 100% correctly, however you will never register as a pin drop in the ocean for some larger providers. BT Internet is a good example in the UK, you will never get an email to anyone who has an inbox with them and their is no one you can contact there about this. If you only ever email people with Outlook or Gmail accounts you probably can get away with self hosting as you can provisionally whitelist your IP with Microsoft for example. ---------------------------------------------------------------------- Kila_Bite · 2023-11-23 08:51 Plex. Despite everything be supposedly self hosted, they are spying on what you're watching and sharing that info with 3rd parties, your friends and your family. Use Kodi instead or if you're old school like me, an old fashioned smb share running on a pi. ---------------------------------------------------------------------- HashtagMOMD · 2023-11-23 08:51 I have a load balancer on my network that has opened one port on my home network. The load balancer is connected over the cloud flare and is encrypted on both sides. Is that okay? ---------------------------------------------------------------------- JASH_DOADELESS_ · 2023-11-23 08:52 Email ---------------------------------------------------------------------- Vogete · 2023-11-23 08:52 Just....set up two RPIs with Pihole instead of one? Chances are your router can have a fallback DNS. Sure, you have to update the rules in both places, but honestly it's not a big deal, and you now have redudancy. I'm running 2 powerdns recursors and authoritative servers, and 2 piholes (long story why so many), and none of them have failed on me so far, and when I took one of them offline, I didn't notice anything because the other took over. And if anything REALLY fails, I'll just switch my router back to using cloudflare or Google or quad9 temporarily, and at least Internet access will be restored so people can at least browse the internet. This is really something that's super easy to self host, and mitigate if something goes wrong. Especially since that commercial router is already a single point of failure for most households. ---------------------------------------------------------------------- graemep · 2023-11-23 09:07 I know purists will say it is not real self-hosting, but there is no reason you cannot run a mail server on a VPS or a server in a data centre. It may not be quite as good as running it from your own premises, but it is a huge improvement on someone else running the system in terms of privacy and security. ---------------------------------------------------------------------- graemep · 2023-11-23 09:09 Even without one, and a very simple setup, the only issue I ahve had is delivering to MS services. ---------------------------------------------------------------------- Cart0gan · 2023-11-23 09:14 Not really an option when I'm providing file hosting services to a bunch of my friends. ---------------------------------------------------------------------- D0ublek1ll · 2023-11-23 09:15 I don't, but it's just done with an automation in home assistant that is triggered by calling a webhook from the honey pot on successful login. I built the honey pot myself, its just a socket that triggers the chain above whenever someone sends a packet with any kind of data to it. All be it an ssh attempt or an http packet. ---------------------------------------------------------------------- slykethephoxenix · 2023-11-23 09:16 For hardware at least, you could use a Shelly or similar plug. ---------------------------------------------------------------------- TBT_TBT · 2023-11-23 09:16 Docker is the antithesis of „bloat“. ---------------------------------------------------------------------- TBT_TBT · 2023-11-23 09:18 Self hosting doesn’t only mean „host it at home“. You can also self host on dedicated or virtual servers you rent. ---------------------------------------------------------------------- Cart0gan · 2023-11-23 09:19 Not necesarily. If you self host SyncThing and use it to synchronise your password database across devices (for example KeePassXC's .kdbx file) only the synchronisation goes down with your server. ---------------------------------------------------------------------- Cart0gan · 2023-11-23 09:21 Child porn, obviously ---------------------------------------------------------------------- ProfessionalTop229 · 2023-11-23 09:24 Hi I'm very interested in this project, Wouldn't you be willing to make a tutorial ons this project Regards ---------------------------------------------------------------------- D0ublek1ll · 2023-11-23 09:26 Any kind of plug that works with wifi that also has a local api could be directly controlled by the honeypot. If you already have some sort of home automation running (trough home assistant or anything alike) you can use that to save yourself a lot of programming. You just need a smartplug with hardware thats compatible. Personally, I use zigbee plugs because they're not reliant on my wifi and they can't be controlled through any service I don't directly control myself. ---------------------------------------------------------------------- D0ublek1ll · 2023-11-23 09:30 I could try to put it in a chart or something so you can see the steps I took to realize this. But my setup is very specifically built for my internal network, its not general purpose or widely compatible. It's easy to make tho, even for someone relatively new to programming. ---------------------------------------------------------------------- Drwankingstein · 2023-11-23 09:32 I know this might be a bit controversial, but IMO a beginner should not self host passwords, and at least not the sole backup for photos and videos. I think self hosting them in general is good, but until you know for sure, "Ok, my back-up system is working fine, even if my stuff goes down, I have little downtime for bringing it back up". If you can't say for sure this is you, Don't self host your passwords, bitwarden is great and encrypted so I highly doubt issues will be had there. Also make sure to use a different/seperate hosting service for pictures. I personally recommend using google drive + rsync since rsync can encrypt all your pictures. I've seen more then a couple people fail the backup part, *even when they thought they were fine before hand*. ---------------------------------------------------------------------- c_one · 2023-11-23 09:34 Yes please that would be awesome!! ---------------------------------------------------------------------- Drwankingstein · 2023-11-23 09:37 Docker is horrid for duplication. Unless you use a filesystem with good deduplication, docker can hurt a lot on your storage. ---------------------------------------------------------------------- KeyBlogger · 2023-11-23 09:46 Half the worlds Wordpress instamces Run on php5.7 which ist deprecated AS Well AS php7 ---------------------------------------------------------------------- kon_dev · 2023-11-23 09:47 Why you chose to open a port, if you use cloudflare? Couldn't you use cloudflare tunnel in that case? ---------------------------------------------------------------------- user3872465 · 2023-11-23 09:49 Honestly, Email. Its such a bother to setup at home. With all the stuff you may not be able to do like set a PTR on you public IP if you even get one. Its far esier and cheaper and less of a hedace to set it up with a Webhoster or something like Proton. Especially if you have important stuff running on it like account verificatin etc. ---------------------------------------------------------------------- Teapeeteapoo · 2023-11-23 09:53 Even a personal one isn't that bad an idea. One of the main reasons about self hosting is for privacy, also ig being able to do thinks offline or whenever openai doesn't have the compute (or nearly falls apart) ---------------------------------------------------------------------- TheFluffiestRedditor · 2023-11-23 10:07 I see we've moved on from screwing pooches to screwing canaries. Nod, smile, move along. ---------------------------------------------------------------------- Beastmind · 2023-11-23 10:07 Also it's illegal in some country ---------------------------------------------------------------------- TheFluffiestRedditor · 2023-11-23 10:08 That's what I used to call Joomla. Wordpress is actually more secure, which is a >shudders< ---------------------------------------------------------------------- TheFluffiestRedditor · 2023-11-23 10:09 I giggled. ---------------------------------------------------------------------- TheFluffiestRedditor · 2023-11-23 10:10 Backups. Well, host some backups but also outsource them to at least one other vendor. ---------------------------------------------------------------------- adriy32 · 2023-11-23 10:16 CloudFlare, mail ​ Mail is a waste of time, and it's take the risk to don't receive important in time. ---------------------------------------------------------------------- Richmondez · 2023-11-23 10:16 I agree with the sentiment but Kodi isn't really a direct replacement for a plex server, it's a client replacement. You want Jellyfin or at least a mysql backend for Kodi to get the shared watched status and such. ---------------------------------------------------------------------- DIBSSB · 2023-11-23 10:17 What do you use to send and receive email on your domain then ? ---------------------------------------------------------------------- DIBSSB · 2023-11-23 10:17 Which ? ---------------------------------------------------------------------- AttackCircus · 2023-11-23 10:19 A lot of people will tell you it's email. However there are a lot of admins running their own email servers successfully. I'd say "a TOR exit node" or any other service that has a high chance the police pays you a visit to confiscate ALL your equipment. ---------------------------------------------------------------------- Jims-Garage · 2023-11-23 10:22 Emails, you'll likely end up losing important messages and not having them land in people's inbox due to domain trust issues. Honeypots, don't make yourself a target 🎯 Cloudflare Tunnels (controversial!). Privacy concerns, plus you're punching a hole through your firewall. ---------------------------------------------------------------------- rgnissen202 · 2023-11-23 10:30 I'd say backups. At least it shouldn't be only local. I follow the rule of threes: two local copies and one off site with backblaze. Yeah, it ties up a not insignificant amount of disk space I could use for other things, but dammit, I'm not loosing my wedding photos, important system configurations, etc. ---------------------------------------------------------------------- sk1nT7 · 2023-11-23 10:32 Tor exit node ---------------------------------------------------------------------- tech2but1 · 2023-11-23 10:34 So you need them to be able to login to the admin interface to do this? Sounds like you're doing it wrong. ---------------------------------------------------------------------- tech2but1 · 2023-11-23 10:40 That's not how you set up multiple DNS servers for fault tolerance. If you set it up properly in HA mode then you get none of these issues. Sounds like your issue is more that you don't understand DNS than DNS being an issue. ---------------------------------------------------------------------- tech2but1 · 2023-11-23 10:43 > Chances are your router can have a fallback DNS. Chances are it can't. You can probably set multiple DNS servers (anywhere, not just routers) but they aren't a primary/secondary sort of deal. Most traffic might be weighted towards the first one in a list but you will find traffic still hits the others. ---------------------------------------------------------------------- tech2but1 · 2023-11-23 10:45 Same with Bit/vaultwarden, all clients grab a copy of the vault from the server when they sync so if the server is offline all clients still "just work". ---------------------------------------------------------------------- tech2but1 · 2023-11-23 10:47 What is the issue with hosting it yourself? If your server goes down the clients still work, all clients have a local copy of the vault. Also if mine goes down I can have it restored from backup in a matter of minutes, and if the entire lab goes down well syncing new passwords to Bitwarden is the least of my troubles! ---------------------------------------------------------------------- Korlus · 2023-11-23 10:49 The service itself is insecure. You need to hide it behind a more secure setup if you want to expose it to the internet. It's been a long while since I tried, but I have some foggy memories of an RDP Server that would encapsulate the connection in an SSL tunnel and forward the connection to the remote machine rather than exposing the RDP client itself to the internet. Definitely do your research on how to do it securely before you just set it up and open it to the wild. ---------------------------------------------------------------------- tech2but1 · 2023-11-23 10:49 > Aside from other stuff mentioned here about email. I always assumed I'd become a target for spam that I'd have a harder time filtering out to the point it stops being worth it to have a custom email address. Can't work out how or why hosting it at home would mean more spam? Your email address gets on a list that gets pulled by spam merchants, hosting it at home doesn't make any difference here. ---------------------------------------------------------------------- tech2but1 · 2023-11-23 10:51 Not a problem for those of use with decent internet. Even when it was less than stellar I had no issues sharing Plex and doing remote desktop etc. ---------------------------------------------------------------------- tech2but1 · 2023-11-23 10:51 B2. ---------------------------------------------------------------------- TheFluffiestRedditor · 2023-11-23 10:53 [rsync.net](https://rsync.net) , an excellent provider ---------------------------------------------------------------------- lilolalu · 2023-11-23 10:54 That's not high bandwidth applications. I was talking about video streaming with multiple clients, not your family watching 2 streams from Plex in parallel. ---------------------------------------------------------------------- xerker · 2023-11-23 10:57 It's an assumption, not based on evidence. I've never done it and not looked into the software solutions so I assume a FOSS selfhosted email solution wouldn't have the inbuilt antispam stuff that mainstream providers, say outlook, who host probably millions of email addresses would have. ---------------------------------------------------------------------- tech2but1 · 2023-11-23 10:58 Still, same applies. My home internet is better than most business lines. ---------------------------------------------------------------------- tech2but1 · 2023-11-23 10:59 It's an incorrect assumption. ---------------------------------------------------------------------- Critical_Egg_913 · 2023-11-23 11:04 What honeypot are you using? tpot? ---------------------------------------------------------------------- lilolalu · 2023-11-23 11:11 You wouldn't selfhost a video streaming server on most business servers either. That's why there are hosting providers and CDN eoviders that have servers closer to the backbone and the users. ---------------------------------------------------------------------- GolemancerVekk · 2023-11-23 11:14 Don't self-host email SMTP or public DNS. They're hard to set up properly, hard to maintain, easy to compromise and end up used in internet attacks. Don't expose anything directly to the internet if you're not willing to constantly monitor the vulnerability announcements, update to new releases as soon as they come out, monitor the container for intrusions and shenanigans, take the risk that the constant updates will break something etc. If you must expose a service use a VPN (Tailscale is very easy to set up and use.) Don't self-host anything with important data that takes uber-geek skills to maintain and access. Ask yourself, if you were to die suddenly, how screwed would your non-tech-savvy family be, who can't tell a Linux server from a hot plate? Would they be able to keep functioning (calendar, photos, documents etc.) without constant maintenance? Can they still retrieve their files (docs, pics) with only basic computing skills? Can they migrate somewhere else when the server runs down? ---------------------------------------------------------------------- tech2but1 · 2023-11-23 11:24 Fair enough. I wasn't really thinking of enterprise level self hosting here but I guess it's a valid thing. ---------------------------------------------------------------------- Plastivore · 2023-11-23 11:36 I think it just depends on many aspects. I used to run my own mail server (with backup holding server that would just hold messages and forward them if I was doing some maintenance on the main) until about 2015, because before that I was very eager to run my own (my hosting service allowed to personalise reverse DNS, which helped a lot with reputation since the reverse DNS domain matched my email addresses'). But then 2 things made me reconsider that decision: I was getting more and more responsibilities at work and just didn't have as much time to do this anymore, and I was also hosting some family members' emails, and I just didn't want to risk any problem for them. When I was just hosting my own email, it was all fun, and I know the risks I was facing if doing something wrong and losing all my emails, but losing my parents' emails… that's another story. I've learnt a lot by running my own email server, and had lots of fun tinkering with it, but it's arguably much more complicated to configure and secure than a web server. If I had more time, I might try to delve into it again for 'shits and giggles' domain, but honestly I don't think I can bother anymore. ---------------------------------------------------------------------- lilolalu · 2023-11-23 11:38 After all it's easy to calculate, take your uplinks overall bandwidth (-20% or so) and divide it by the highest bitrate you are streaming and if that number is less than what you hoped for, don't stream video from home. Or use p2p streaming with something like peertube. ---------------------------------------------------------------------- _murb · 2023-11-23 11:40 Tailscale or VPN ---------------------------------------------------------------------- KXfjgcy8m32bRntKXab2 · 2023-11-23 11:41 I assume you don't work from home. Getting an internet disconnection every time a stupid bot scans or attempt whatever on the honeypot seems brutal. Now automating an IP blocking in your firewall would make more sense. ---------------------------------------------------------------------- questionablejudgemen · 2023-11-23 11:49 Like fully exposed ports to the internet, or canary tokens and maybe some other intrusion detection alert device honeypots? ---------------------------------------------------------------------- AlexMelillo · 2023-11-23 11:52 For most people, self hosting email is a terrible idea ---------------------------------------------------------------------- AdmiralPoopyDiaper · 2023-11-23 11:58 Ok it was three crows, if you must know! ---------------------------------------------------------------------- lucaprinaorg · 2023-11-23 12:03 the one you don't use it ---------------------------------------------------------------------- ilikestreet · 2023-11-23 12:07 What kind of ports or http request will do the kill switch? ---------------------------------------------------------------------- No-Needleworker-9890 · 2023-11-23 12:08 Passwords: \-> You want to have immediat access to them, even if your house burns down Notes: \-> You want to be able to read the documentation how to fix your selfhosted service, even when your selfhosted services are down Public Reverse proxy: \-> A reverse proxy is only as safe as the applications behind. And NO, most selfhosted-applications are not hardened or had security audits (reverse proxy with a forward authentication proxy is something different) ---------------------------------------------------------------------- AdmiralPoopyDiaper · 2023-11-23 12:09 I did for years quite successfully. Ultimately blocklists did me in however - I don’t have the knowledge to resolve those timely and it became a headache I couldn’t tolerate at that time. ---------------------------------------------------------------------- AdmiralPoopyDiaper · 2023-11-23 12:11 I’ve heard something like “it’s not a backup unless it exists in at least two different places across both time and space.” So, have you some local copies, but you can’t *not* have remote as well. M ---------------------------------------------------------------------- DIBSSB · 2023-11-23 12:12 I don’t understand the pricing and the solution is their a layman version on understanding it ? ---------------------------------------------------------------------- AdmiralPoopyDiaper · 2023-11-23 12:13 That’s an underrated razor. Not the whole decision tree for me, but a huge part of it. ---------------------------------------------------------------------- fourstepper · 2023-11-23 12:13 I try to NOT self-host any service that: 1. Is open-source and provides a hosted solution 1. Doesn't have some technical/price requirement (like a media library/photo library where you pay per GB) to use the mentioned hosted version - if this is the case, I donate to the project I'm using instead ---------------------------------------------------------------------- Cybasura · 2023-11-23 12:23 Email Well, unless you use a vps, but you still gotta put alot of care ---------------------------------------------------------------------- Cybasura · 2023-11-23 12:23 I literal circuit breaker? Impressive ---------------------------------------------------------------------- amarao_san · 2023-11-23 12:27 Self-hosted internet is pain in the ass. Cellular services too. ---------------------------------------------------------------------- DutchOfBurdock · 2023-11-23 12:31 Email can be challenging; but, that's what makes it fun. Start with a simple domain, not one needed for anything essential. Start making accounts and sending and receiving emails to ensure all your settings are right (SPF, DKIM, TLS for both in/out etc). and you're not getting flagged as spam with major providers. Now, get yourself some spam. Let one of that domains emails loose on the web, ya know those dodgy you won something click baits. Wait for the spam to flood in, start building milters. Check for issues and get the noise down, silence your MTA for spam it does detect (so not to respond to the spam host at all) and you're half way ready. ---------------------------------------------------------------------- Zoenboen · 2023-11-23 12:47 Mail servers are pretty easy - they just take a decent amount of steps to setup. Once going, they don't require any real maintenace. [https://workaround.org/](https://workaround.org/) ---------------------------------------------------------------------- Zoenboen · 2023-11-23 12:49 They are not hard to setup, easy to keep running (once going they pretty much just work). If you follow the right steps you can avoid being undeliverable and keep people from abusing your sending server (as a relay). https://workaround.org/ ---------------------------------------------------------------------- ItLone · 2023-11-23 12:49 I was handling a lot of zimbra server for an old company, handling reputation is so hard that I ended up creating a batch of always warm IP address that send maybe 5% of outgoing and fully filtered mail and when a client IP was listed I simply change the outgoing IP to on I had in stock until the IP was removed from BL. Main factor of listing was hacked email used for spam, sadly can't do much when the client refuse 2FA and other security practices. ---------------------------------------------------------------------- D0ublek1ll · 2023-11-23 12:49 Any tcp connection with some actual data in it will trigger. ---------------------------------------------------------------------- D0ublek1ll · 2023-11-23 12:50 Its an internal honey pot. Its not exposed. This is to help detect misc stuff going on inside my home network. ---------------------------------------------------------------------- Zoenboen · 2023-11-23 12:51 Just for others, posted above... [https://workaround.org/](https://workaround.org/) Setting up email isn't impossible, just takes time and if you follow a good guide you'll get it done. Securely. ---------------------------------------------------------------------- D0ublek1ll · 2023-11-23 12:52 Nothing public, its really just a socket started on common ports (21, 22, 53, 80, 443, etc) that trips the flow whenever it gets a connection with some actual data. ---------------------------------------------------------------------- Zoenboen · 2023-11-23 12:53 I'm running Ollama, the LLAMA2 port for Mac. I hosted an LLM for a site that generated the next line of story, no issues. There's no reason to hide from running an LLM at home if you can, people should, the source is out there for a reason. ---------------------------------------------------------------------- Zoenboen · 2023-11-23 12:54 for those not afraid, it's not hard: https://workaround.org/ ---------------------------------------------------------------------- Zoenboen · 2023-11-23 12:55 If you don't get spoofed you'll be fine - that's the point of those services. If you setup the mail server the way it's supposed to be setup you'll avoid all those headaches. https://workaround.org/ ---------------------------------------------------------------------- Zoenboen · 2023-11-23 12:56 Anti-spam was invented in FOSS self-hosted setups. https://workaround.org/ ---------------------------------------------------------------------- teem · 2023-11-23 12:58 Lol, I work at an attack surface scanning company. Every freaking company I talk to, with very few exceptions, has at least one of these. If not a whole infrastructure. Then they cry, "how did we get ransomware?" ---------------------------------------------------------------------- teem · 2023-11-23 12:59 Over the Internet? Outside your network? I would never. ---------------------------------------------------------------------- MadAndriu · 2023-11-23 12:59 This, and you can even export your whole dB from the clients, e.g., if you need to set up a new server from scratch you can import your vault from your phone or tablet apps ---------------------------------------------------------------------- teem · 2023-11-23 12:59 VPN FTW ---------------------------------------------------------------------- teem · 2023-11-23 13:00 Security through obscurity doesn't actually work. ---------------------------------------------------------------------- linkthepirate · 2023-11-23 13:04 Psa for you guys that rdp over the net, turn that off, and use a VPN like wire guard or tail scale, or use something like apache guacamole. ---------------------------------------------------------------------- fedroxx · 2023-11-23 13:09 Mine was compromised and the script kiddie was using it to send spam. Moved to static pages. He got mad. Started sending threatening emails. ---------------------------------------------------------------------- Simplixt · 2023-11-23 13:11 Do you have an example? "Open Source + hosted" always involves trust, as you can only look into the Github repository, not if the running hosted application is running identically. Only exception: It's an E2EE encrypted solution, and everything else happens client-side (example: Bitwarden) ---------------------------------------------------------------------- Accomplished-Lack721 · 2023-11-23 13:13 Why is anything of concern happening inside your home network? ---------------------------------------------------------------------- Cr4zyPi3t · 2023-11-23 13:15 I have a nextdns subscription, but I'm currently working back on switching back to selfhosted PiHole. Doesn't rely on my internet connection, has lower latency due to being in my local network, is open-spurce, respects my privacy and supports more complex features. ---------------------------------------------------------------------- linkthepirate · 2023-11-23 13:16 There is also the fact that you'll only successfully send to half your recipients, and of the other half, half of those will be sent to junk folder and the other half never get delivered because the mail provider filters it. Oh and many services you sign up for won't recognize it as legitimate, and most of those don't support delimited addresses or even domains that aren't Gmail, Yahoo, AOL. ---------------------------------------------------------------------- ficskala · 2023-11-23 13:20 I wasn't aware you could do something like this on kodi, i remember it being basically just a client for viewing content, not a web based server ---------------------------------------------------------------------- linkthepirate · 2023-11-23 13:21 Or just one of the alts like Emby or Jellyfin. ---------------------------------------------------------------------- linkthepirate · 2023-11-23 13:26 I'll add to the philosophy side and say anything critical. It's so much less stressful to just pay for M365 businesses, it's encrypted at rest and in transit. You have onedrive, SharePoint sites, Azure devops for git and wiki, onenote, and of course email, plus you get shared mailboxes, groups/teams. Then use a hosted password manager that doesn't suck. Then self-host all media and things that can be replaced. I use devops git for my docker-compose directory and gitignore all the Metadata stuff. ---------------------------------------------------------------------- zekrysis · 2023-11-23 13:32 If another one of his servers or services gets compromised it would prevent lateral movement and further exploitation/exploration ---------------------------------------------------------------------- Accomplished-Lack721 · 2023-11-23 13:35 Thanks, that makes sense. (It's weird that people get downvoted just for asking questions, though) ---------------------------------------------------------------------- SpongederpSquarefap · 2023-11-23 13:46 More specifically, WireGuard I highly recommend the Linuxserver.io WireGuard Docker image Easy to set up and it's frequently updated ---------------------------------------------------------------------- zekrysis · 2023-11-23 13:48 Answers to questions like yours are pointedly obvious to anyone with knowledge of the subject, but many people dont acknowledge that not everyone here has the same knowledge as them and are here to learn such things. ---------------------------------------------------------------------- GOVStooge · 2023-11-23 13:48 yup.. this. ---------------------------------------------------------------------- SpongederpSquarefap · 2023-11-23 13:50 Don't try to be clever and change the port from 3389 to something else either Scanners can fingerprint traffic and just blast the other ports instead I (foolishly) did this a few years ago and luckily I had account lockout enabled Constant attempts all day long - they were even able to enumerate local users and try to log in as them (fortunately they never could cause the passwords were random keepass ones) Don't do it, seriously ---------------------------------------------------------------------- lorenzomofo · 2023-11-23 13:50 Is Wordpress a necessary evil in this world? It seems like even large companies will inevitable have some department which uses Wordpress somewhere. Maybe too many people are too accustomed to it. ---------------------------------------------------------------------- lorenzomofo · 2023-11-23 13:52 > 20 Docker containers at home Kubernetes or just docker compose? ---------------------------------------------------------------------- GOVStooge · 2023-11-23 13:52 I had to make groups and assign clients to them. Lets me set individuals up for more or less restrictive depending on who they are (kids) or what they feel is acceptable ad levels. For instance, someone was mad I blocked the amazon ads the pop up in search, I just put them on the wide open group. ---------------------------------------------------------------------- ProfessionalTop229 · 2023-11-23 13:57 Please do.... Can always change my settings around to make it work ---------------------------------------------------------------------- ProbablePenguin · 2023-11-23 13:58 My benchmark is kinda "how annoying or disruptive would it be if it broke and I didn't feel like fixing it for a few days" So email for example, I could selfhost, but I'd rather just have someone else do it so I don't have to worry about it. ---------------------------------------------------------------------- user3872465 · 2023-11-23 13:58 Since I am located in Germany, I use Netcup. They have to adhere to german data protection laws. And I am renting their Webhosting Package. Which includes 6 .de domains 500G for databases and mails. 1000 Mail addreses and the likes. Its like 6 Euros/m for that I cant be bothered checking and adhereing to all the needed requirements to get Mail to function properly at home. And neither can I be bothered getting to the same redundancy at home. Also I get a nice web managment interface to just set it up in a couple clicks. Not sure if it would count as selfhosting, probably not. But even getting a VPS managing a software to mailhost would be to much effort for my mails to endup in a spamfilter somwhere, because of xyz. ---------------------------------------------------------------------- random74639 · 2023-11-23 14:07 Emails ---------------------------------------------------------------------- Korlus · 2023-11-23 14:09 Oh sure, VPN is definitely the preferred way if you already have the infrastructure in place. My experience with the front-end RDP server was years ago as the sysadmin for a company. My experience is likely very out of date, and was very corporate-focused, rather than for an enthusiast. Nowadays I try not to touch Windows, and haven't used RDP in years. ---------------------------------------------------------------------- lvlint67 · 2023-11-23 14:20 Just to re-iterate the old advice: REALLY think hard before self hosting email... Especially email that will be tied to banks/cards/etc. ---------------------------------------------------------------------- ZAFJB · 2023-11-23 14:20 #Email ---------------------------------------------------------------------- hickupper · 2023-11-23 14:22 Murdered the murder? ---------------------------------------------------------------------- Spielopoly · 2023-11-23 14:22 For actual security you‘d have to consider way more stuff than just TCP connections. Maybe an attacker uses a completely different protocol? It might be okay if your honeypot only has vulnerabilities for that type of connection and you regularly update it so other security vulnerabilities get fixed. ---------------------------------------------------------------------- TheQuantumPhysicist · 2023-11-23 14:23 I've been doing it for over 10 years with postfix. I feel like a gigachad xD ---------------------------------------------------------------------- lvlint67 · 2023-11-23 14:24 i suspect in the next 10 years (maybe 5) we'll see more of a mass exodus from the monolithic CMS platforms for websites of any size. MOST companies that are using platforms like wordpress or drupal, are using them as essentially templating engines and then bolting a couple features to the side. Some of the frontend tooling is good enough, to ditch such platforms.. and the, "the sales team needs to be able to make direct changes to the website" mind set is slowly and painfully starting to show signs of dying off. ---------------------------------------------------------------------- lvlint67 · 2023-11-23 14:25 Security through obsurity can't be your only layer of defense** ---------------------------------------------------------------------- Accomplished-Lack721 · 2023-11-23 14:28 Multifactor authentication is a good thing in general, although doing it via SMS is about the worst option, since SMS itself isn't very secure. But there's still no good reason to expose the login page of a NAS to the Internet directly. ---------------------------------------------------------------------- lvlint67 · 2023-11-23 14:31 moving a port like this off the deault port is generally categorically more secure than leaving it on the default port. **It's not a huge gain though**. You wipe out a massive portion of "lazy" scanners that just try the default port and move on... but there are bots scanning full port ranges and doing service detections on open ports. You can't move a port and then decide "alright. Problem solved" **additionally**... moving something like ssh from port 22 to port 2222 can be extremely dangerous. port 22 on a linux system is a priviledged port. You need to be root to listen on that port. If your ssh server listens on port 2222... a malicous user on your system COULD find a way to crash your ssh daemon and they would be free to hijack the port while your service restarts. Generally speaking.. moving ports like this is better for reducing "noise" than it is for mitigating REAL attacks. ---------------------------------------------------------------------- Accomplished-Lack721 · 2023-11-23 14:33 There are much better ways of doing this than exposing the login page of your NAS to the Internet. You could run a NextCloud or Seafile instance in a Docker container. In the container setup, you can limit which folders and resources the instance itself has access to, and then further lock down their accounts as you see fit within the app. You could put everyone on a shared VPN with something like Tailscale or a self-hosted Wireguard server, and give them shares on a your NAS or any other server inside the network. There's no need for your NAS administration page to be sitting out on the Internet where it could be discovered and attacked. Even if you need access to it, that's best done by first connecting to your network via a VPN. ---------------------------------------------------------------------- SpongederpSquarefap · 2023-11-23 14:34 Disagree, I think Bitwarden can work offline without the server and you can restore from the local copy on your phone for example That said, I still prefer KeePass ---------------------------------------------------------------------- Accomplished-Lack721 · 2023-11-23 14:37 It's not. SSL in itself doesn't make any exposed service safe, just safer. An updated service isn't necessarilu free of vulnerabilities. The difference between exposing your login page and most other services is the attack surface. If someone gets into your NAS administration, game over. You're getting hit with ransomware or worse. If someone gets into my Calibre Web server, for instance, my vulnerability is much more limited. That runs in a docker container that only has access to the resources and folders is absolutely needs. The paths to doing harm to anything besides my ebook library are limited. I of course still use SSL, with my Calibre Wev behind a reverse proxy, with long complex passwords, and I'll probably soon move it to an OATH login where I can use MFA (since it doesn't support it natively itself). And there are more measures I could take beyond that, if I chose. ---------------------------------------------------------------------- xkumropotash · 2023-11-23 14:38 Mail servers. Never ever self host mail servers. ---------------------------------------------------------------------- Accomplished-Lack721 · 2023-11-23 14:39 Hey, the answer was even obvious to me, once you'd said it. I just hadn't had my coffee yet :) ---------------------------------------------------------------------- zekrysis · 2023-11-23 14:40 Definitely know that feeling, happens to the best of us ---------------------------------------------------------------------- antek2220 · 2023-11-23 14:41 You give your friends access to your nas admin page? ---------------------------------------------------------------------- JoeB- · 2023-11-23 14:50 Single host - Just Docker run + Portainer - Also using Macvlans so most containers have hostnames and static IPs on my LAN. K8s is cool, but I have no need for container orchestration. ---------------------------------------------------------------------- ATLHivemind · 2023-11-23 14:53 E-mail. When I was a corporate sysadmin with self-hosted exchange servers, keeping up with the RBLs sending our outgoing mail to spam filter bit buckets or spam folders was a full time job. On top on top of foi g the same for inbound mail. M365 was a godsend. M365 + Barracuda for home (Barracuda also covers my custom domains handled at Protonmail). Bitwarden is another. In short, the stuff that Must Work. ---------------------------------------------------------------------- sangfoudre · 2023-11-23 15:10 While mail is definitely doable, imho it's not worth the hassle, you'll always have to maintain it, that's definitely not a launch and forget solution. ---------------------------------------------------------------------- ilikestreet · 2023-11-23 15:11 hmm. Sounds interesting and inspired to me😊 ---------------------------------------------------------------------- ShellDude01 · 2023-11-23 15:13 Smtp isn't that bad so long as you ensure you're not operating an open relay. Really bad stuff will happen once exploited and it will take major work on your part to undo ranging from getting removed from block lists like XBL to possibly having to renegotiate your ISP contract if they have to get involved. ---------------------------------------------------------------------- vtKSF · 2023-11-23 15:16 What would be the problem with a hacked containerized wordpress site? ---------------------------------------------------------------------- DIBSSB · 2023-11-23 15:17 Nice How do I find a similar service for USA or my local country or a reputable site ? ---------------------------------------------------------------------- pogky_thunder · 2023-11-23 15:18 >A password manager because if anything goes wrong, you'll be completely screwed. >What you SHOULD absolutely self host though is a password manager, so you can be in control of your most sensitive data. Wot? ---------------------------------------------------------------------- paulsmithkc · 2023-11-23 15:27 Primary backups ---------------------------------------------------------------------- gpzj94 · 2023-11-23 15:33 E-mail ---------------------------------------------------------------------- dlm2137 · 2023-11-23 15:47 This is pretty cool and the first I’ve heard of this idea. Curious, did you come up with it yourself or get inspired somewhere? ---------------------------------------------------------------------- Independent_Emu5190 · 2023-11-23 15:47 RDP = Ransomware Deployment Protocol See it all of the time…. ---------------------------------------------------------------------- Cheesecaketree · 2023-11-23 15:56 surprisingly my custom email address gets by far the least amount of spam. I had maybe 20 spam mails over the last year. Meanwhile my gmail address sometimes gets that every single day lol ---------------------------------------------------------------------- bzImage · 2023-11-23 15:56 | Just too complicated and hard to manage. ​ lol.. and now its easy.. i remember doing m4 macros for sendmail, now with postfix + dovecot its easier than ever. ---------------------------------------------------------------------- Large___Marge · 2023-11-23 16:15 PiVPN is another great way to setup Wireguard or OpenVPN. I have it running in an LXC container like a charm. I have my devices connect to it automatically on any unrecognized wifi network. ---------------------------------------------------------------------- MrSliff84 · 2023-11-23 16:16 Not only that, youre also risking getting cut off by your ISP. ​ Did not happen to me, but i got quite many reports from my ISP ---------------------------------------------------------------------- D0ublek1ll · 2023-11-23 16:23 Well, killing the upstream connection is the most effective way of killing an ongoing hack. When i was much younger I used to skirt the edge of what was legal and what wasn't and have had to cut the connection multiple times cuz I'd download some rat or something alike. Ever since then I've always had a preference to secure now, diagnose later. I used to have my network connection run over my desk so I could just unplug my pc from the network, these days I just have a central switch that, when powered off, turns everything off as well. But I also now have this honeypot. It really came to me because I had some a leftover smartplugs. ---------------------------------------------------------------------- daMustermann · 2023-11-23 16:27 More are better. Better for the network and for the security and safety of the users and other nodes ---------------------------------------------------------------------- D0ublek1ll · 2023-11-23 16:28 Yeah, I'm aware. I'm by no means a security expert, I have some base level knowledge. I suppose it wouldn't be much work to also add some udp sockets that do the same thing. I may or may not decide to do so and publish it on github. It seems this setup has sparked a lot of interest. ---------------------------------------------------------------------- SpongederpSquarefap · 2023-11-23 16:28 What client do you use for that on iOS or Android? ---------------------------------------------------------------------- usernamefindingsucks · 2023-11-23 16:36 With a DigitalOcean droplet priced at $4/month, I completely agree with you. ---------------------------------------------------------------------- Unfair-Plastic-4290 · 2023-11-23 16:50 it provides no layer of defense. ---------------------------------------------------------------------- KN4MKB · 2023-11-23 16:51 I'll leave with this. ANY service exposed publicly or not should not have vulnerabilities. If there is any hint that your NAS webserver has vulnerabilities, it shouldn't even be used internally. So to me, it does not matter. I don't expose my NAS webserver because I have no reason to increase my attack surface that wide. But I'm comfortable exposing any of my internal services as needed because I've personally checked the source code for vulnerabilities, and have proper checks in place on top of regular security updates. I understand why others wouldn't think the same way, as this takes a high level of confidence in your ability to assess the security posture of your systems and network. ---------------------------------------------------------------------- Unfair-Plastic-4290 · 2023-11-23 16:52 dont host anything you cant properly secure. ---------------------------------------------------------------------- crabapplesteam · 2023-11-23 16:57 Woah. That’s actually incredible. ---------------------------------------------------------------------- Accomplished-Lack721 · 2023-11-23 17:02 It would be nice if we, and apps' developers, always knew what the vulnerabilities are. They generally exist because the developer doesn't know about them yet, or hasn't found a solution yet (though ideally has been transparent about that). Zero-day exploits happen. There's always a first person or group discovering a flaw. If being up to date and using SSL was all it took, security would be a lot simpler. No one security measure is ever foolproof, other than taking everything offline. But multiple used in tandem make it somewhere between inconveniently and impractically difficult to breach a system. ---------------------------------------------------------------------- Stevieflyineasy · 2023-11-23 17:09 These comments dont really answer the question or make sense , "RDP" & "NAS login page", can be self hosted and secured properly. OP is asking what should you not self host properly on your home network, the only thing i can think would be a high traffic web page, where it would require increased ISP bandwidth/internet bill ... or a server that requires 300watts of power to run idle for example(coming from experience)...just not cost effective hosted nodes pretty much, thats what the cloud is for. ---------------------------------------------------------------------- Cart0gan · 2023-11-23 17:11 Not the admin page, the login page. I use Nextcloud. ---------------------------------------------------------------------- Ostracus · 2023-11-23 17:13 Porn. :-D ---------------------------------------------------------------------- kuerious · 2023-11-23 17:16 *albeit ---------------------------------------------------------------------- outtathesky_fellapie · 2023-11-23 17:16 Wireguard has an android app ---------------------------------------------------------------------- therealsimontemplar · 2023-11-23 17:19 Any number of issues, depending on the network architecture and other variables. Is there storage mounted to the container? Or network access to/from the container for admin access, etc? Anything else on the dmz rail in the blast radius of the infected server? ---------------------------------------------------------------------- FlockSystem · 2023-11-23 17:22 Those vulnerabilites come from humans clicking on files they're not supposed to click on. How is any other way of communication secure against that? RDP offers 2FA and has an encrypted connection. It's fine! ---------------------------------------------------------------------- coldblade2000 · 2023-11-23 17:23 This is true. I once locked myself out of my account (fucked up with my new Yubikey), and support told me to use my phone to make a vault backup, delete my account, start another one and restore from backup. ---------------------------------------------------------------------- Large___Marge · 2023-11-23 17:31 The official iPhone app ---------------------------------------------------------------------- SungrayHo · 2023-11-23 17:32 after reading the answers here I feel like a honeypot is definitely something I'd actually want lol. ---------------------------------------------------------------------- dgibbons0 · 2023-11-23 17:32 If you setup primary and secondary dns servers on your clients or via DHCP that's how they work. That's literally how the **client side** resolution behaves. If you're talking about using VRRP/ucarp or something to share a single endpoint with multiple servers sure, but now you're back all of the issues i posted in my other reply about trying to manage adguard or pihole with multiple block/allow lists and trying to educate users that they have to login to multiple systems in order to modify those settings. I'm speaking as someone who's run various recursive dns servers across multiple organizations over 20 years. There's a reason why the meme is 'It's always dns'. Trying to pretend that it's not is a seriously weird headspace y'all is in. ---------------------------------------------------------------------- dgibbons0 · 2023-11-23 17:37 Interesting, I don't think that existed last time I evaluated Pi hole, I dropped it after HA deprecated their pi hole addon in favor of adguard ([https://community.home-assistant.io/t/home-assistant- community-add-on-pi-hole/33817](https://community.home- assistant.io/t/home-assistant-community-add-on-pi-hole/33817)) Didn't realize it had been that many years ago. ---------------------------------------------------------------------- vtKSF · 2023-11-23 17:43 Everything is containerized and isolated. ---------------------------------------------------------------------- SpongederpSquarefap · 2023-11-23 17:47 Ah, lucky bastard iOS has a lovely WireGuard feature like you say where if you're not on your main network, it'll enable the VPN I don't know why, but Android doesn't have that yet ---------------------------------------------------------------------- SpongederpSquarefap · 2023-11-23 17:47 Oh I know, I use it iOS has a lovely WireGuard feature where if you're not on your main network, it'll enable the VPN I don't know why, but Android doesn't have that yet ---------------------------------------------------------------------- rad2018 · 2023-11-23 17:52 Unless you're performing a small, very specialized research project, I would \*NOT\* recommend it. Like [AnApexBread](https://www.reddit.com/user/AnApexBread/) said, you're only inviting the sharks to your door... ---------------------------------------------------------------------- TBT_TBT · 2023-11-23 17:54 WTF? You obviously don't understand Docker at all. \- Docker and Docker images provide the absolute mimimum environment which is necessary to run an application. Containers don't have reserved resources, so only what is really used is used. A VM has a lot more overhead, as a whole computer plus complete OS are emulated. \- There is not much to deduplicate because there is no redundant storage going on. Only the bare OS essentials plus the app are stored. There are some base OS containers (e.g. Alpine Linux) which are <10 Mbytes in size. \- If containers themselves are "big", you are doing Docker wrong and store data inside of a container and not externally of the container in volumes or the host filesystem. With the next container pull, that data would be lost. \- no idea what " just not work often due to due to already deduplicated extent stuff" is supposed to mean. That does not even make sense. ---------------------------------------------------------------------- NightH4nter · 2023-11-23 17:55 an email server ---------------------------------------------------------------------- rad2018 · 2023-11-23 17:55 I was asked to perform a pentest for a friend who \*thought\* that he was secure (he had a homelab, too). All I had to do was run about a dozen NMAP scans against his subnet...then POOF, hackers were attempting brute force attacks at his front door. Needless to say...he wasn't as secure as he thought. He had a few choice words to say to me, too. The fact is, there are TONS of "listening posts" out there. Draw too much attention, and WHAM, they're at your front door. Again, not advisable. ---------------------------------------------------------------------- tgkad · 2023-11-23 17:55 But then you would have to trust the VPS and have multiple points of failure. I'd rather trust Bitwarden and have only one. ---------------------------------------------------------------------- rad2018 · 2023-11-23 17:59 You left out VNC... 😉 ---------------------------------------------------------------------- CincyTriGuy · 2023-11-23 17:59 Is there any advantage to doing this if I already have native VPN setup on my Ubiquit DMP? ---------------------------------------------------------------------- vkapadia · 2023-11-23 18:02 Ah thanks that makes sense. I do have mine behind a Remote Desktop Gateway. ---------------------------------------------------------------------- rad2018 · 2023-11-23 18:04 Wireguard is a good alternative. 👍 ---------------------------------------------------------------------- rad2018 · 2023-11-23 18:06 I agree with [KN4MKB](https://www.reddit.com/user/KN4MKB/). I've been hosting my own mail server for decades. Not one issue. I use that in lieu of a mail service provider (Google immediately comes to mind), as their EULA service agreement will tell you that - since you're using their service, on their servers - anything goes. Read the fine print on Gmail, and you'll see. 😉 ---------------------------------------------------------------------- TBT_TBT · 2023-11-23 18:06 True, I also trust 1Password to host my safe because of this. ---------------------------------------------------------------------- rad2018 · 2023-11-23 18:07 Yup. Static IPs help, but not entirely safe. Want to us DNSSEC to ensure better security. ---------------------------------------------------------------------- rad2018 · 2023-11-23 18:08 Keep internal DNS server as far away as possible from the Internet. I have 3 layers of firewalls between the second DMZ (aka DMZ-2) - 4 if you include the server's firewall. Those are useful. If you want something different, try LDAP; but again, keep that as far inside as you can. ---------------------------------------------------------------------- rad2018 · 2023-11-23 18:10 Totally agree...until you are DNS-stormed. RPis might not handle DNS brute-force attacks or "DNS storms" from other DNS servers. I've found that they choke up and seize. Using a mini PC might be a better solution if you're looking for low-powered PCs; otherwise, get a 1U racked server. Much more robust. ---------------------------------------------------------------------- rad2018 · 2023-11-23 18:11 Also, you want to make sure that your resolving between DNS 1 and DNS 2 can operate independently from each other. I have 2 primarys at home, PLUS a 3rd cache server offsite at a ping-and-power location. Helps safeguard against "DNS storms". ---------------------------------------------------------------------- iduine · 2023-11-23 18:12 Here's an upvote. Because no question is ever stupid. Learning shouldn't be downvoted. ---------------------------------------------------------------------- rad2018 · 2023-11-23 18:12 The DNS servers in of themselves will sync - usually within a 10 to 30 second time period. Some if it is how you age off your cache. ---------------------------------------------------------------------- rad2018 · 2023-11-23 18:12 That works. ---------------------------------------------------------------------- thatghostkid64 · 2023-11-23 18:14 Anyone have any opinions of tailscale for their VPN? ---------------------------------------------------------------------- idreamofjeanshorts · 2023-11-23 18:14 What if you put Authelia in front of it with 2fa? ---------------------------------------------------------------------- rad2018 · 2023-11-23 18:15 Not as difficult as you might think. Sure, it's an investment in time. if you're unwilling to invest time in safeguarding your privacy, then go with a service; otherwise, if you have issues about someone sniffing your email traffic (other than your ISP), setup one for yourself. ---------------------------------------------------------------------- rad2018 · 2023-11-23 18:15 Also, check out "ciphermail". It's end-to-end encryption mail server. ---------------------------------------------------------------------- rad2018 · 2023-11-23 18:16 Also for to mention to use a reverse-proxy email scanner. There are several out there. Mailscanner is a good one that's been around a very looooong time. Decent. Also, PROXMOX has a decent one, too. ---------------------------------------------------------------------- MRHURLEY86 · 2023-11-23 18:17 I would like more info on this if you have the time. This sounds amazing! ---------------------------------------------------------------------- rad2018 · 2023-11-23 18:19 Just so you know...the US govt activity scans for Tor exit nodes. Be careful. ---------------------------------------------------------------------- SpongederpSquarefap · 2023-11-23 18:23 If they're using WireGuard, then probably not If they're using OpenVPN, then yeah it should be faster ---------------------------------------------------------------------- AnApexBread · 2023-11-23 18:24 If you're performing research projects then use a VPS like AWS. Don't draw attention to your home network/homelab ---------------------------------------------------------------------- user3872465 · 2023-11-23 18:28 Not sure. Google? Or reccommendations of friends or this sub? But Proton for example is a sollid choise in general if its email only. But theres a lot of webhosters outthere. ---------------------------------------------------------------------- rad2018 · 2023-11-23 18:31 One problem...do a reverse-DNS and you'll see that your IP's Amazon. My work tried this once - using that very configuration. Needless to say, it didn't work. ---------------------------------------------------------------------- rad2018 · 2023-11-23 18:33 They tried using "conpot". They bollocked it all up. Offered to help since I've done honeypots and honeynets before - nope. Said that they knew what they were doing. Strange thing is - when they put the thing online a few hackers sent email and said 'nice try', and then shutdown the honeypots. Doesn't work. ---------------------------------------------------------------------- eduuoliver · 2023-11-23 18:41 Local Wordpress Development Site - Ever, EVERRR DO THAT ---------------------------------------------------------------------- Accomplished-Lack721 · 2023-11-23 18:50 Still a bad idea. 2fa and other measures can make it more secure. But nothing is more secure than not exposing it to the Internet in the first place. And there's no good reason for a NAS login page to be available on the Internet. In general, when there's a service only you and a limited number of people need access to, the safest solution for remote access would be to connect to your home network via a VPN. Tailscale makes this easy. I personally just run a Wireguard server on my router. Things should only be exposed to the Internet when there's a good reason. You might want to expose a photo library service so that you can send share links to other people. You might want a NextCloud instance available so you can use it on a work computer where you can't install a VPN client. If so, go ahead, but secure them with 2FA, monitoring and other reasonable precautions. Use limited-privledges accounts and restrict how much access those apps have to the rest of your server or network, giving them only what they need. Consider tools like fail2ban or Crowdsec. When you expose a service to the Internet, you take reasonable steps to lock it down, you accept that it might get compromised anyway, you keep good backups and you limit the potential exposure where you can. Making NAS login accessible on the Internet means a TON of potential exposure for little or no practical purpose when better options exist. That's exactly what you want to avoid. ---------------------------------------------------------------------- FabianN · 2023-11-23 18:51 Even Microsoft recommends against opening rdp to the web and to use a VPN instead. You're playing with fire here. ---------------------------------------------------------------------- Zip95014 · 2023-11-23 18:53 Not entirely true. All new OSX's have [content cache](https://support.apple.com/guide/deployment/intro-to-content- caching-depde72e125f/web). Basically a home CDN for apple stuff. ---------------------------------------------------------------------- usernamefindingsucks · 2023-11-23 18:55 Not sure I understand why you need the third server, if you locally set up 2 servers you could have one as forwarding, and one as recursive. Then you don't need anything offsite. ---------------------------------------------------------------------- usernamefindingsucks · 2023-11-23 19:02 I think we're apples and oranges on this one, is it an authoritative server you are running? ---------------------------------------------------------------------- dlbpeon · 2023-11-23 19:03 Until it is not. ---------------------------------------------------------------------- AnApexBread · 2023-11-23 19:06 That's a good point, I think it really just means you need to adjust what your honeypot looks like. You wouldn't run a Windows Server in AWS but you probably would run a MySQL database or an Apache web server. ---------------------------------------------------------------------- vtKSF · 2023-11-23 19:11 Ok. ---------------------------------------------------------------------- Phrenzy · 2023-11-23 19:16 Many of the services I host are not accessible from the outside. FreeNAS, VMware, Radarr, Sonarr, etc. cannot be accessed from outside. If I want to download a new TV show I can do that when I get home. ---------------------------------------------------------------------- Catsrules · 2023-11-23 19:17 > Well, host some backups but also outsource them to at least one other vendor. Didn't consider my parents to be a vendor but I guess here we are. ---------------------------------------------------------------------- FlockSystem · 2023-11-23 19:23 >Microsoft recommends against opening rdp to the web As far as a few google searches got me: No, they don't. ---------------------------------------------------------------------- pyromaster114 · 2023-11-23 19:30 Yea, Email is a big one... it'd be kind of pointless, because the person on the other end is NOT using a self-hosted solution, odds are, and it would be a ton of work to maintain, etc., and likely less reliable. I wouldn't self-host my voicemail server, most likely, either. :P Just no point. ---------------------------------------------------------------------- CG_Kilo · 2023-11-23 20:03 My issue with hosting mail isn't securing it, it is the headache of trying to keep a good reputation. I'd rather just pay for 365 or workspace and call it a day ---------------------------------------------------------------------- rad2018 · 2023-11-23 20:12 Yes, DNS-1 and DNS-2 are both authoritative. DNS-3 is caching only. You place DNS-1 on your home network, and DNS-2 on a ping-n-power site. DNS-3 is the backup to the backup. ---------------------------------------------------------------------- altwyvern25 · 2023-11-23 20:13 It’s great. Incredibly easy to setup and I’ve had zero issues. Highly recommended ---------------------------------------------------------------------- Piddoxou · 2023-11-23 20:22 Can someone please explain why Overseerr is different instead of just downvoting? ---------------------------------------------------------------------- usernamefindingsucks · 2023-11-23 20:25 Yes, ok then, I see. I was not talking of authoritative servers. I also don't have a static IP, so while possible with some work, it's non-trivial to set up so I too wouldn't attempt this. ---------------------------------------------------------------------- rad2018 · 2023-11-23 20:33 Welllll...you can do this with dynamic DNS for your primary server, and use a ping-n-power elsewhere...OR, you work with a friend or sooper-dooper cheap DNS hosting provider as your secondary source. It can work. ---------------------------------------------------------------------- Large___Marge · 2023-11-23 20:39 Wow that's surprising it's not on Android! I would have thought they'd have it first. ---------------------------------------------------------------------- SpongederpSquarefap · 2023-11-23 20:46 Yeah it's a bit annoying to be honest I just got the Poco F5 and I need to wait a week before I can unlock it and flash a new ROM, but maybe that'll have a way of enabling it ---------------------------------------------------------------------- Akronae · 2023-11-23 21:43 Hetzner dude ---------------------------------------------------------------------- DIYSRE · 2023-11-23 21:49 Mind if I ask why? ---------------------------------------------------------------------- No_Judgment7474 · 2023-11-23 22:03 It helps because there's so many eyes on it. People can shit talk WP all they want. There's a LOT of businesses with WP installations that send fixes upwind. ---------------------------------------------------------------------- rad2018 · 2023-11-23 22:05 Having 3 layers of protection, or using LDAP? Personal preference, I guess for LDAP. 3 layers of firewalls because it's spooky out there - defense-in-depth and all that. ---------------------------------------------------------------------- chimpuswimpus · 2023-11-23 22:16 I run my own mail server but just forward all outgoing mail through the free tier of a relay service. I guess it means I'm not _purely_ self hosting but it removes all those issues and I'm still running my own IMAP, webmail and SMTP ---------------------------------------------------------------------- martechnician · 2023-11-23 22:17 I agree. I love learning and I love sharing my knowledge. Self-hosting is still relatively new to me at least for anything complex. I appreciate when people are willing to share their knowledge. And if you’re not willing to share your knowledge then you’re a dick. ---------------------------------------------------------------------- Fratm · 2023-11-23 22:49 You obviously do not know what a sysadmin does. It's not fancy. ---------------------------------------------------------------------- Fratm · 2023-11-23 22:49 I know how to run a proper mail server, and how to keep it secure. So not a problem. ---------------------------------------------------------------------- Fratm · 2023-11-23 22:51 Did my opinion offend you? Seriously, you sound offended. If the "I dont trust you" part offended you, don't think so highly of your self. I don't trust anyone I don't know personally. ---------------------------------------------------------------------- Drwankingstein · 2023-11-23 23:18 As someone who is wasting gigabytes upon gigabytes of data on Docker, get out of here with your stupid bullshit. docker layers across containers are not duplicated properly if the images arent setup right which is the case for a significant amount of images. The entire point of Docker is that way you can easily go and deploy these specific images that aren't set up right. One cannot just say, "Well, don't use those images, do something else, and do your own” because that completely defeats the point of Docker. I had nearly 80 gigabytes of duplicated garbage. across my home system alone after after setting up things like surveillance, my nas, nitter etc. Don't come here telling me I don't understand docker when you are the one who has no idea. ---------------------------------------------------------------------- roboticfoxdeer · 2023-11-23 23:24 Email ---------------------------------------------------------------------- bulletproofkoala · 2023-11-23 23:37 Okay I understand that email hosting is bad for SENDING email , but what about only RECEIVING email , isn’t it a good idea to keep my stuff private ? I rarely send personal emails, and like to avoid my data being used for marketing purposes Is that bad to have smtp imap open on dynamic ip address ? Just asking your opinion ---------------------------------------------------------------------- UdPropheticCatgirl · 2023-11-24 00:09 Because you never expose it to the outer world? ---------------------------------------------------------------------- audero · 2023-11-24 00:17 I tried it on macOS. It worked fine with a cached copy offline, until I had to restart my Mac (the Bitwarden app asked me to log back into my Vaultwarden instance). If I had no internet connection, I couldn't access my vault. Granted, you're not going to restart your computer often with no access to Vaultwarden on reboot, but it can happen. Haven't tested on iOS and I don't use Android, so it might be different there. I use a KeePass app too. I feel comfortable knowing that I can open my KeePass database with any KeePass compatible app if things go wrong, and that's the main reason I'm using it. ---------------------------------------------------------------------- frogotme · 2023-11-24 00:22 I'm aware. I only called it fancy as you're on your high horse about it, you're not the only sysadmin in this sub ---------------------------------------------------------------------- Mintfresh22 · 2023-11-24 00:25 Why? ---------------------------------------------------------------------- Mintfresh22 · 2023-11-24 00:28 Cool story bro? You don't seem to have a clue what you are talking about. Trust me bro. ---------------------------------------------------------------------- mrpeenut24 · 2023-11-24 00:28 What do you use for webmail? I used to use horde, but it's reached EOL. ---------------------------------------------------------------------- Mintfresh22 · 2023-11-24 00:29 Why do I need a vendor for backups? ---------------------------------------------------------------------- teem · 2023-11-24 00:31 These days there are so many bots scanning that you have to be so careful. ---------------------------------------------------------------------- Mintfresh22 · 2023-11-24 00:31 lol ---------------------------------------------------------------------- mrpeenut24 · 2023-11-24 00:33 I've never been on any SpamHaus blocklist. The reputation of my servers has never been a problem. However, a few blocklists operate in a whitelist model, where they only allow certain servers and deny everything else. Those can be a pain, but only really exist for certain corporate mailservers. ---------------------------------------------------------------------- grobouletdu33 · 2023-11-24 00:37 Mail server, too many troubles related to domaine name blocking/ban, good for internal network/VPN use but not for anything serious ---------------------------------------------------------------------- Mintfresh22 · 2023-11-24 00:40 You don't sound like a very good sysadmin. ---------------------------------------------------------------------- Serverfrog · 2023-11-24 00:54 Then what is Lancache, if not a home CDN? ---------------------------------------------------------------------- SpongederpSquarefap · 2023-11-24 01:01 > If I had no internet connection, I couldn't access my vault. This is extremely concerning Sadly I haven't used Bitwarden enough to knowledgably comment on how you could resolve that ---------------------------------------------------------------------- skmcgowan77 · 2023-11-24 01:19 While it's smart from a certain angle, it's pretty frackin stupid from another if you look at it from that angle The angle would be: "Why have a Honeypot on your network and put it out there on your connection to basically invite hack attempts if you have no Intel being gathered other than basic initial connection and possibly initial exploit information? If the Dead Man's Switch will cause the router to power off as soon as the Honeypot internet facing security is breached,YOU lose your connection until the router is powered back on, AND you also lose the ongoing data of what the attacker would do inside the Honeypot, including what possibly previously unknown malware,bots,attack vectors etc..." Honeypot systems are not intended to "catch" hackers, they're intended to passively gather Intel on the attackers out there, their methodology, toolset, and possibly the intent or motivation based on their actions once they've breached the honeypot's defenses. Just my first thought ---------------------------------------------------------------------- HTTP_404_NotFound · 2023-11-24 01:23 Nah, I was just thinking- this is something I would have said when I started out as a Junior sysadmin, and thought I knew everything! > sysadmin in my day job, so I actually know what I am doing. Ya know- kind of like when people first learn to install arch- they gotta let everyone else know. > Did my opinion offend you? Also- you didn't give any opinion. You just told us you host email, and you wanted everyone to know that you are a sysadmin. ---------------------------------------------------------------------- audero · 2023-11-24 02:14 Yeah this is just my personal experience but I’m willing to be corrected. ---------------------------------------------------------------------- TheFluffiestRedditor · 2023-11-24 03:01 You’re paying them for a service, thus vendor. Not sure what you’d call someone who offered free backups. An idiot probably. ---------------------------------------------------------------------- chimpuswimpus · 2023-11-24 03:08 Roundcube. I don't actually like it very much but I don't really use it much anyways. ---------------------------------------------------------------------- mrpeenut24 · 2023-11-24 03:31 Cool, thanks. ---------------------------------------------------------------------- ElDubsNZ · 2023-11-24 03:36 Vaultwarden is perfect for that then, it does cache locally. ---------------------------------------------------------------------- CaptainWilder · 2023-11-24 04:10 lmao. kinda overkill but i love it. I'm imagining now someone going a step further and cutting the power to the whole building. UPS batteries start doing alert beeps. ---------------------------------------------------------------------- lvlint67 · 2023-11-24 05:40 Don't parrot things without consideration. If you don't think security through obscurity is ever valuable... Go ahead and post your password here. ---------------------------------------------------------------------- TBT_TBT · 2023-11-24 06:42 What do you even mean with „duplicated stuff“? Again, if your containers are too big, you are doing it wrong. ---------------------------------------------------------------------- BillGoats · 2023-11-24 06:55 Ok. ---------------------------------------------------------------------- Fratm · 2023-11-24 07:17 Except I have been a sysadmin for 30 years. lol ---------------------------------------------------------------------- Fratm · 2023-11-24 07:19 No horses were high, I was just trying to show that I knew what I was doing. Sorry it sounded as if I was posturing. Not what I intended. I've never been good at public communication. ---------------------------------------------------------------------- Piddoxou · 2023-11-24 07:42 But you do. You let friends and family request movies there, right? That’s the outside world? ---------------------------------------------------------------------- 0rsted · 2023-11-24 09:05 Antispam is hell, just saying ---------------------------------------------------------------------- fourstepper · 2023-11-24 09:15 Yeah, you do have to have some trust in such services. Some of the ones I use: 1. [Miniflux](https://miniflux.app/) for RSS 2. [Migadu](https://www.migadu.com/) for e-mail and calendar 3. [Signal](https://signal.org) for messaging 4. [Mastodon](https://mastodon.social) for, well, Mastodon 5. [GitHub](https://github.com) for Git hosting and CI/CD 6. [Bitwarden](https://bitwarden.com) that you've mentioned I also buy hosted [Read my reasoning here](https://robinopletal.com/posts/dont-self- host-everything), if interested ---------------------------------------------------------------------- tgkad · 2023-11-24 12:29 Better yet, put the safe in the neighbor's house so that you can still keep an eye on it (while also trusting the neighbor totally). ---------------------------------------------------------------------- Mintfresh22 · 2023-11-24 13:27 I know what a vendor is, asshole. I don't know why you think you need to pay someone to do backups for you, unless you are just a dumb. ---------------------------------------------------------------------- Diligent_Ad_9060 · 2023-11-24 15:20 I doubt that you would be able to train a model to be as performant as ChatGPT using a typical self hosting setup. It's just not within reach (yet). Something specialized with a limited dataset could probably be a great idea though. ---------------------------------------------------------------------- Diligent_Ad_9060 · 2023-11-24 15:22 I'm not telling people to avoid running a LLM at home. I'm just saying that it wouldn't be a generic purpose one close to what ChatGPT provides. The reason I would guess is primarily a lack of computational power. ---------------------------------------------------------------------- Teapeeteapoo · 2023-11-24 15:27 Yeah its not quite up to scuff, but as you said you can get some pretty decent specialised models which have their own pros in terms of reliability. Some bigger models can compete with 3.5 in certain scenarios, since it lost a lot of accuracy through overalignment. 4's mixture of experts is much better than anything os, but even if it was it'd require so much compute. ---------------------------------------------------------------------- Unfair-Plastic-4290 · 2023-11-24 19:04 ooooooooo you got me! Intentional leaking of secrets is totally not the same as obscuring details that are easily discoverable. "security though obscurity" is a lot like placing a spare key under a fake rock in your yard rather than under the doormat. It might "feel" safe because you think its hidden, but in reality you have your front door key laying in the yard for anyone to stumble into either intentionally or unintentionally. Security would be a reinforced door, a pick proof lock, a security guard, possibly a dog, and a fence. Obscuring access to something, especially on the internet, will never work. ---------------------------------------------------------------------- homemediajunky · 2023-11-24 21:18 Overseerr is an application that uses your web browser as it's UI. There's a difference. With overseerr, you are hosting an application that you are allowing others to access. Much different than just running a basic website. ---------------------------------------------------------------------- Piddoxou · 2023-11-24 21:45 Ok thanks for the explanation! ---------------------------------------------------------------------- TheFluffiestRedditor · 2023-11-25 01:35 Please go away, before I replace you with a very short shell script. ---------------------------------------------------------------------- Mintfresh22 · 2023-11-25 13:51 Quit spewing nonsense. ---------------------------------------------------------------------- ProfessionalAd3026 · 2023-11-25 15:08 A cache. While they operate similarly, there are differences. The most notable is the user base. A cache is used by users in the same private network. Arbitrary users, ideally in the same public network (I.e., ISP) use a CDN. ---------------------------------------------------------------------- ProfessionalAd3026 · 2023-11-25 15:14 Well, isn't Apple using your hardware for their CDN? ---------------------------------------------------------------------- Zip95014 · 2023-11-25 17:51 french fry, Freedom Fry. ---------------------------------------------------------------------- nekapsule · 2023-11-26 00:50 Self hosted doesn’t mean hosted on your home connection. Even with a static IP I would recommend against hosting your mail server at home because any outage means no mail (been there, done that). I have hosted my own imap/smtp server for decades and couldn’t be happier with it, but yes, the smtp part is tricky to evade blocks, especially from MSFT who would just block entire networks without a real reason (Linode for example) ---------------------------------------------------------------------- nekapsule · 2023-11-26 00:51 Antispam is easy with a mix of greylisting and spamassassin ---------------------------------------------------------------------- 0rsted · 2023-11-26 10:48 Yes, easy, but requires constant updates ---------------------------------------------------------------------- nekapsule · 2023-11-26 10:50 The auto updates from spamassassin are pretty good, just set your max score to something very low like 3 ---------------------------------------------------------------------- Top_Beginning_4886 · 2023-11-26 11:24 Outlook uses spamhaus' zen blacklist. If you have a static IP you can request them to unblock you. If you have a dynamic IP, well, hope that the current IP class isn't blacklisted and/or try to get a new one. ---------------------------------------------------------------------- verluci · 2023-11-27 21:35 Even more hacked plugins ---------------------------------------------------------------------- WWGHIAFTC · 2023-11-27 22:46 What do you consider "access"? a web server? Ping? ---------------------------------------------------------------------- mrpeenut24 · 2023-11-30 03:30 Just saw this today, might be checking it out soon. https://www.reddit.com/r/NextCloud/comments/1872wmq/roundcube_joins_ne xtcloud/ ---------------------------------------------------------------------- Miki200__ · 2023-12-27 18:09 Security by obscurity is a very thin layer of defense, usually good enough against the usual script kiddie, but useless for anything beyond that ---------------------------------------------------------------------- Ill-Violinist-7456 · 2023-12-28 03:43 I've successfully set up self-hosted email at home, even overcoming CGNAT! Here's the breakdown: 1) I've got a VM on Proxmox running Ubuntu 22.04 with Mailinabox. 2) Dealing with CGNAT, I've implemented a 'Wireguard Bridge' on a VPS hosted by Hostinger. This allows me to utilize the public VPS IP along with an open port 25. Everything is running smoothly.