Seeking Insights on App Management and Database Strategies for Self- Hosted Environments reddit / selfhosted ---------------------------------------------------------------------- nanithedata · 2023-11-26 16:35 Hello r/selfhosted community! I'm currently delving into the world of self-hosting and would love to get your insights on a couple of concepts I'm exploring. Your experiences and opinions would be incredibly valuable to me. 1. **App Management Philosophy:** I'm torn between two approaches to app management in a self-hosted setup. On one hand, there's the Unix philosophy of "doing one thing well" which would involve using multiple apps, each dedicated to a specific function (like Homebox, Ghostfolio, Mealie, Firefly, Plane, etc.). This approach, however, seems to increase the attack surface and complexity. On the other hand, there's the idea of hacking a single tool (like NocoDB combined with Metabase/Superset) to cover multiple needs, which could simplify monitoring and management. What are your thoughts on these approaches in terms of security, maintenance, and overall efficiency? 2. **Database Strategy:** Another area I'm seeking advice on is database management. I'm considering two options: * Having a separate PostgreSQL database for each service within its Docker-compose declaration. * Allocating a separate VM solely for databases (like PostgreSQL, MariaDB, etc.) and creating different users for each service. * What are the pros and cons of these strategies from your experience, especially in terms of performance, security, and ease of management? I'm really looking forward to hearing your thoughts and learning from your experiences. Thank you in advance for sharing your ideas! ---------------------------------------------------------------------- v47-io · 2023-11-26 19:23 Hello friend, allow me to be the first to welcome you to the joys of self-hosting. To answer your first question: I think having many specialized services is not a bad thing, after all, better to be a master of one than a master of none. You just need to be careful when exposing your homelab to the internet and use a single-sign-on solution (e.g. Keycloak) or at least LDAP/AD so you don't have to manage the users for your services separately. I would recommend you route all your outgoing and incoming traffic through a firewall like openSense, or at the very least use a deny- all/allow-some strategy where you only expose the HTTP/HTTPS ports (HTTP just for redirection to HTTPS). To implement HTTPS I would recommend you use a Reverse-Proxy like Traefik Proxy or Caddy which come with integrated Letsencrypt support, so you don't have to worry about certificates. You could also use something like Tailscale, which basically functions like an extremely private VPN where you don't have to open your network to the entire public for incoming connections. Don't let them call in, call out instead! However, you can rest assured that you are not a company like Google or Microsoft and most likely won't have to deal with 99.99% of the volume or variety of attacks they face. As long as all your software is up-to-date and you follow all the recommended security measures you should have a reasonable degree of safety. For your second question: What I like to do is just create a single humongous VM where I run all my services inside Docker containers and every service has it's own database. I also use an NFS share to host all the critical data for those services which is stored on ZFS. There I can simply create a snapshot at any time for backup purposes. Having each service "own" its own database allows me to keep all those databases separate and "walled-off" on the network level (of course notwithstanding any security issues with Docker). I hope I was able to give some insight or inspiration, and wish you all the best on your future self-hosting adventures! ---------------------------------------------------------------------- nanithedata · 2023-11-26 20:10 Thank you so much for the warm welcome and for such a detailed post. For now I am being as safe as I can be and using wireguard with rpi to simply tunnel back. All services are behind traefik/ngnix with authelia as I try to learn how to properly use them. Since some of these tools would contain sensitive data (ghostfolio, firefly, homebox,health tracking etc...) I was wondering if it would not be more judicious to only use large projects to mitigate any risks that are associated with smaller projects. As having more eyes on the same project, although not perfect, is a better heuristic than not doing your dd for each project. Concerning the centralization of data in one DB it seem to me that this would unlock other analytics on top that might not be available otherwise with the dedicated apps using something like superset e.g. more fine grained aggregations for homebox/firefly. Though your argument about walling off each DB does sound appealing with regards to my first concern. I am really grateful for your input it has given me a lot of food for thought and I will most likely be back with more questions once I have a few adventures under my belt!