Self-host on desktop reddit / selfhosted ---------------------------------------------------------------------- Sufficient-Word · 2023-12-14 05:53 I have an always-on desktop computer I use for work and everyday needs, it runs Debian, I also run a file server, a torrent seedbox and a VPN server on it. I would like to host some services like CalDAV/CardDAV, Nextcloud, Paperless, an RSS feeds aggregator, stuff like this. I have dynamic DNS set up, but I could use the VPN to access these services if exposing them to the Internet poses a security risk. Since I have an always-on computer with plenty of RAM (32GB) which mostly sits unused, I would like to use that. I'm not an expert, so a simple solution would be preferred, something that could sit in its own user home folder and survive an OS upgrade and be updated/upgraded easily (e.g. upgrading Nextcloud to a new version requires several steps and several commands and some time when installed manually, whereas it's automatic when it's installed as a Snap package). Preferably something that doesn't "dirty" the drive too much if it needs to run as the main user. I looked into Docker and Podman (which folks seem to find more secure), but I'm not sure I fully understand them, and I'm not familiar with other such projects. FreedomBox is very easy to install on top of Debian, but it's very limited and supports very few applications. Yunohost requires its own dedicated machine. I tried Syncthing in the past, but I would like to try some of these selfhosted projects I often find around, and set up a small "private cloud" for me and possibly my family. Do you have any suggestions? TIA ---------------------------------------------------------------------- thekrautboy · 2023-12-14 06:30 Add /r/CosmosServer or CasaOS to your Debian, done. ---------------------------------------------------------------------- Jonteponte71 · 2023-12-14 08:57 Just a comment. A always on desktop computer with linux on it, that does not get used much for anything else is a server :) And I also suggest CosmosServer or CasaOS to shield you from all the dreary details of running docker containers…. ---------------------------------------------------------------------- TBT_TBT · 2023-12-14 09:23 Imho, it is a very bad idea to mix your work computer with a server that is online and open to the internet via some ports and apps. This way, if or rather when only one service gets hacked, you will find your work data on the internet. If you would work for me, I would instantly fire you. ---------------------------------------------------------------------- zaphod4th · 2023-12-14 14:31 nice, so you only hire people that knows everything and doesn't asks questions? ​ best boss avar ! ---------------------------------------------------------------------- Sufficient-Word · 2023-12-14 15:02 I don't know if the issue is reading comprehension or maybe a language barrier, but I'll try to be more clear. I'm just gathering information about a toping I don't know about, so I can make an informed choice about how I want to deal with it, I can access my network via VPN, I don't need to expose anything, but if there is a secure and containerized solution that would allow me to do that all the better. I even specified I was leaning to Podman rather than the more popular Docker because it's more secure, so you should see that security is my priority. Now, do you have any suggestion? And even if you insist I should use a separate machine for this, do you have any suggestion about whcich OS or project to use? ---------------------------------------------------------------------- budius333 · 2023-12-14 17:41 Short answers: - Docker is awesome, learn a bit of it, but then use Portainer as an easy GUI to manage them. - Direct install with the system is tricky and prone to make a mess. - Don't open ports, use a VPN instead; you can even run the VPN software in Docker and only give access to the services while your PC remains purely local only. ---------------------------------------------------------------------- Sufficient-Word · 2023-12-14 18:27 This is a bit too short for me. > Docker is awesome Do you recommend Docker over Podman? > Direct install with the system is tricky and prone to make a mess What does that mean? That I should use a dedicated PC for self-hosting services? ---------------------------------------------------------------------- Sufficient-Word · 2023-12-14 18:43 > dreary details of running docker containers Could you expand on this? I found other people saying the exact opposite, that they began with CasaOS because they didn't know about Docker, but once they got their feet wet they found CasaOS limiting and embraced pure Docker. ---------------------------------------------------------------------- TBT_TBT · 2023-12-14 20:04 You obviously didn't get the message: a work computer (with files that should not get out) should not be used as server. ---------------------------------------------------------------------- budius333 · 2023-12-14 20:13 > Do you recommend Docker over Podman? I never worked really with podman, so I'm biased, but as far as I'm aware podman is a k8s tool that works similar to Docker but because it's k8s it's killing a bug with a bazooka. Docker with docker-compose is simple, just an understandable YAML file and you're set. >What does that mean? That I should use a dedicated PC for self- hosting services? Apt get or snap you're directly installing on the system and can run in dependencies issues. Docker is different , it is a virtualized container, aka a light weight virtual machine, so it's like other ppl created the images for the VMs (but they're called containers) and you're just executing it with a few base configurations (via cmd line or YAML), so by using docker (or any container technology) you're never installing anything on your real system and it's safe to run experiment, try different things and when something is not to your liking you just stop the container, purge the image and delete any config files you made and it's gone. That's what I meant ---------------------------------------------------------------------- Jonteponte71 · 2023-12-14 21:17 If you don’t want to have to spend the time to learn (and understand) at least some linux commandline and configuring/deploying and running docker before you can actually run applications on top of it. The suggestions are good ways to avoid that and go straight to running applications. Then you can learn how it actually fits together and do it manually down the line. I have worked in IT since 2001 and it still took me a while to grasp Docker and what it actually is. ---------------------------------------------------------------------- TBT_TBT · 2023-12-15 11:25 I am all for learning things but you say: "I am not an expert" and "I'm not sure I fully understand them" concerning Docker/Podman. That in combination with "desktop computer I use for work and everyday needs" is a problem because it is absolutely probable that you might accidentally open up holes through which people might attack you. My words are not meant as an insult at all, rather a thing to consider while moving forward. My point was, that by separating your work stuff and your "server stuff", you can definitely handle security a lot better than putting both on one machine, on which a person could get in and laterally attack your data. In addition to that, a desktop and a server can be optimized for different things: if you use a server also as a file server, you can make sure that it offers redundancy (raid) and schedule backups locally and externally. You then can backup the desktop to the server. You could use a separate machine based on Linux as well, or Unraid or TrueNAS or something else. There are several hardware options depending on "other use", like if it is only an application server or also a NAS. One more option would be to use a virtual machine with own MAC address and IP on your "desktop" as your playing field for your applications. That VM can easily be moved to another computer (mobility) and if it gets compromised, the attacker hopefully can't break out of the VM at least. Whatever route you go: only open up services to the internet if it is absolutely necessary. Rather use [https://tailscale.com/](https://tailscale.com/) for most internal use cases. And of course continue to learn Linux and Docker.