My 2023 Self Hosting Setup reddit / selfhosted ---------------------------------------------------------------------- HydroPhobeFireMan · 2023-12-21 14:52 https://blog.hpfm.dev/2023-self-hosting-setup Hey r/selfhosted ! Since it's almost 2024, I decided to recap what I set up over the course of the year. The goal is to help out anyone who is just getting started as well as find recommendations from other's on what to improve. What does your setup look like? Feel free to share ---------------------------------------------------------------------- ElEd0 · 2023-12-21 15:15 Never heard about a docker over Unix socket setup like what you describe there. Is that easy to do? Would like to know more about it ---------------------------------------------------------------------- rwilso03 · 2023-12-21 15:59 My favorite line: "I self hosted it because, why not?" ---------------------------------------------------------------------- HydroPhobeFireMan · 2023-12-21 16:10 It's generally easy to do with single container setups, wrote a super quick post based on one image I converted recently https://blog.hpfm.dev/running-docker-apps-over-unix-sockets For more extensive setups with multiple containers, it's just about first converting it to a single image and then doing the same process again. ---------------------------------------------------------------------- zkhcohen · 2023-12-21 16:17 > Jellyfin: Browsing my Linux ISO collection. ...heh ---------------------------------------------------------------------- HydroPhobeFireMan · 2023-12-21 16:19 I am on season 5 of Arch Linux ---------------------------------------------------------------------- alainlehoof · 2023-12-21 16:52 Very nice setup ;) Thanks for sharing ---------------------------------------------------------------------- mundane_motto · 2023-12-21 17:30 > [Friends don't let friends use Duplicati.](https://old.reddit.com/r/ selfhosted/comments/ylzyx1/a_dummies_guide_to_duplicati/iv1t57t/) > [Do not use Duplicati if you have some respect for yourself.](https: //old.reddit.com/r/selfhosted/comments/101lgga/duplicati_has_crossed_m e_for_the_last_time/j2oavmc/) ---------------------------------------------------------------------- HydroPhobeFireMan · 2023-12-21 17:35 Damn. This is exactly what I was hoping for with this post, someone to check for holes or any obvious improvements. Thank you! ---------------------------------------------------------------------- 836624 · 2023-12-21 17:39 I highly recommend borg. The lack of a UI sucks at first, but I don't miss it now. Already restored a few times, always consistent. ---------------------------------------------------------------------- LeftBus3319 · 2023-12-21 17:49 [Here's my setup!](https://chse.dev/hs) ---------------------------------------------------------------------- st8ic88 · 2023-12-21 17:54 I watch Arch btw ---------------------------------------------------------------------- XxNerdAtHeartxX · 2023-12-21 17:56 Check out Kopia - Its what I moved to, and love it ---------------------------------------------------------------------- HydroPhobeFireMan · 2023-12-21 17:57 Here's the feed! https://blog.hpfm.dev/index.xml The permalink idea is super neat btw ---------------------------------------------------------------------- MohamedBassem · 2023-12-21 18:12 What I ended up doing to solve this problem of docker listening on all interfaces is that I don’t expose any ports from any of my containers. I instead let caddy join all the networks of the services I’m hosting and let it proxy to them using their dns name (the container name basically). People usually let services be the one that join caddy’s network, but this lets those containers talk to each other. In my setup, caddy is the one that joins the other networks so they can only see caddy in their network. ---------------------------------------------------------------------- HydroPhobeFireMan · 2023-12-21 18:19 Ah so you're running caddy as a container as well. This is also a good alternative if someone is comfortable with docker networks. I'll link this comment to the post :) ---------------------------------------------------------------------- TuringTestTwister · 2023-12-21 18:21 I'm using restic, any problem with that? ---------------------------------------------------------------------- Fuzzdump · 2023-12-21 18:28 >Piped: A private YouTube front-end. Another great community project. I built a custom image for it to use a single container. (I don’t really care for scalability for 2 - 3 users as this instance is private to my tailnet) I run a personal instance of Piped too, but I ran into a problem after I made it private where my subscription feed page would stop working (see [this issue](https://github.com/TeamPiped/Piped/issues/707)). Did you run into this issue as well and find a workaround? ---------------------------------------------------------------------- Initial-Repeat9146 · 2023-12-21 18:31 >I'm using restic, any problem with that? Restic is great, no need to change unless you have problems with it. ---------------------------------------------------------------------- Initial-Repeat9146 · 2023-12-21 18:33 > It's generally easy to do with single container setups, wrote a super quick post based on one image I converted recently https://blog.hpfm.dev/running-docker-apps-over-unix-sockets I actually appreciate someone using unix sockets, you don't see it as often as regular TCP/IP. I also bake my own images for many reasons, but primarily to slim down the image and add any hardening strategy or custom code forks I use. ---------------------------------------------------------------------- Iced__t · 2023-12-21 18:34 I might have to revisit this. I had tried to set Caddy up as a container at one point and couldn't get it to properly reverse-proxy. Ended up just setting it up on the machine that hosts my containers. ---------------------------------------------------------------------- HydroPhobeFireMan · 2023-12-21 18:42 I did, unfortunately i had to resort to the bash script in the issue comments that periodically refreshed the script ---------------------------------------------------------------------- rafipiccolo · 2023-12-21 18:46 Maybe I miss something but when you don't set port mapping (-p in docker run or "port" in dockercompose) The port is not bind to the host. And containers can still talk to each other if they are in the same docker network. But the host can't reach the containers ---------------------------------------------------------------------- HydroPhobeFireMan · 2023-12-21 18:50 In my case, I ran caddy on the host and not through a docker container. So if i forgot to bind the service to localhost, it would be available over the Internet as well (assuming router allows it) Because of that I need my containers available on the host, i chose to go the unix socket route primarily because I hadn't seen this tried anywhere else and wanted to see if my idea worked. It also lets me not touch the network property of containers so if I can fiddle with it if I wanted to ---------------------------------------------------------------------- neotux__ · 2023-12-21 19:05 Oh, are you already at Episode 11? Theres a big plot twist that involves GRUB, dont want to spoil anything though... ---------------------------------------------------------------------- rafipiccolo · 2023-12-21 19:08 Ok I see thx. Any reason why caddy is not in a container ? ---------------------------------------------------------------------- HydroPhobeFireMan · 2023-12-21 19:17 no reason in particular, just the advice I was given when I was setting things up. I'll be moving to docker once I get the time ---------------------------------------------------------------------- AliasJackBauer · 2023-12-21 19:21 Can you give some details on your use of NTOP? ---------------------------------------------------------------------- HydroPhobeFireMan · 2023-12-21 19:26 I mostly just use it to check what IPs are connected to my machines. As I am fully on tailscale with nothing exposed, anything out of the expected IPs and I make sure my firewall actually works ---------------------------------------------------------------------- blind_guardian23 · 2023-12-21 19:46 Its not bacula 😉 ---------------------------------------------------------------------- MiguelNdeCarvalho · 2023-12-21 19:55 Hey, nice post. Out of my curiosity for how long have you been using the Oracle free tier instance? Thanks! ---------------------------------------------------------------------- HydroPhobeFireMan · 2023-12-21 19:57 I'd say it's been almost a year now? I know people who have been happily using the free tier for way longer than that. ---------------------------------------------------------------------- valiantiam · 2023-12-21 20:49 Do you use authentik with your bookstack? If so, did you find a fix for the fact that authentik does not revoke/end your auth session with bookstack when you "logout" ? ---------------------------------------------------------------------- fideli_ · 2023-12-21 21:15 Did you watch the behind the scenes featurette about Manjaro vs the AUR? ---------------------------------------------------------------------- splynta · 2023-12-21 21:38 just make sure you upgrade to the pay as you go plan (it will put a 100$ charge on your card then remove it after a few days) once you do that then they won't trouble your stuff. 99% of the stories you read are because someone did not do that or they were doing things against the ToS. ---------------------------------------------------------------------- splynta · 2023-12-21 21:39 nice clean website btw. just learned about Quartz 4. seems really cool. thanks. ---------------------------------------------------------------------- splynta · 2023-12-21 21:42 I tried to like Kopia but it just kept throwing errors after a day of getting it set up in docker. was reading that it was a bug between that and mega.nz and rclone integration so I gave up and just went with rclone and wrote a .sh script. got the job done and i can troubleshoot it a lot easier. ---------------------------------------------------------------------- redsh3ll · 2023-12-21 21:42 I also use openvpn-transmission for downloading Linux ISOs, routing all my downloaders and trackers through it for secure tunneling. However, I recently discovered gluetun, which could be a viable alternative if I decide to move away from transmission. Just thought I'd share in case you wanted more fun in the future. ---------------------------------------------------------------------- ssddanbrown · 2023-12-21 21:43 Are you using OIDC? If so, OIDC RP-initiated logout support in BookStack was added in the current release cycle to be part of the next feature release (which I'm targeting to get out at the end of this month). ---------------------------------------------------------------------- Windows_XP2 · 2023-12-21 21:48 > What does your setup look like? Feel free to share The last time I've actually documented my setup was a good while ago, well before it was at the state it is currently. It was back when the only thing that was in it was a Synology NAS with some Docker containers. Kinda crazy how much it has evolved since 2020 when I got my Synology. I'll share a list of my hardware and stuff. Feel free to ask me any questions about what I'm running. **Hardware** * Synology DS420+ with 10GB of RAM and 10.5TB of storage. * Alienware Alpha R2 with 32GB of RAM and a Core i7-6700T. * Cheap Chinese mini PC off of Amazon with 8GB of RAM and a Celeron J4125. * Ubiquiti AP's for Wi-Fi and a Ubiquiti switch, MikroTik for my routers. * Synology DS120j that serves as a backup for my main Synology. I keep it offline partially for security. **Synology** Currently runs DSM 6.2 because I haven't bothered to upgrade to DSM 7 (Although I plan on it this upcomming summer because DSM 6.2 is basically dead despite the EoL date getting pushed back). It's really the only piece of hardware that hasn't been replaced/changed throughout the past few years, and it has hosted various services. Here's what I'm running in Docker: * apt-cacher-ng: A caching server for apt. * Jellyfin: Y'all already know what this is. * LibreSpeed: Open source network speed test program. It has come in handy quite a few times, especially when messing around with my Wi-Fi network. * My second Pi-hole * py-kms: A Microsoft KMS server emulator that allows me to activate any Windows machines on my network. * Vaultwarden: Most of y'all probably know what this is, but it's basically a self-hosted server for Bitwarden. * Instaloader and yt-dlp piped through a Gluetun container to work around rate limits for the most part. * Backblaze Personal Backup in a Docker container. Not an ideal solution whatsoever, but it's also cheap and I have other backups, so whatever. * A few Docker containers for ArchiveTeam. Outside of Docker: * Synology Calendar, Contacts, Surveillance Station, Moments, and probably others I'm forgetting. * Second Tailscale subnet router running in a VM. I also have a Debian VM on it with a separate internet connection just in case I manage to lock myself out of my network remotely. **Alienware Alpha/Chinese Mini PC** Both of these machines run Proxmox and are apart of their own cluster. * I run an LXC with Docker that hosts Flaresolverr, UptimeKuma (Monitors if services are up or not), a local copy of Generatedata.com (Basically a website that generates BS data, I have a fun story about trying to get it up and running), and a MariaDB/phpymadmin container just for shits and giggles basically. * Kasm: A neat thing that uses Docker to create disposable desktops and apps. * GNS3: A virtual network builder * A Debian VM for streaming 24/7 live streams to my Owncast instance (Basically a self hosted Twitch, it runs in another LXC). * An LXC with some more ArchiveTeam warriors * The rest of the stuff is my main Pi-hole, Unifi controller, Invidious instance behind a VPN, qBittorrent with a VPN, Grafana, and my *arr stuff. I would also like to mention a PowerEdge 1950 that I got for free, and I'm currently using it as a space heater. Used it as a Proxmox machine for a little bit, but it wasn't fun sometimes. Legitimately works well as a space heater though. ---------------------------------------------------------------------- beje_ro · 2023-12-21 21:59 You are lying: everybody knows that arch is live-rolling-no-episodes distro. Ubuntu has Episodes: 22.04, 22.10, 23.04, 23.10... ---------------------------------------------------------------------- Efko-94 · 2023-12-21 22:17 Out of curiosity, do you also put Authentik in front of services that are not open to the outside but only accessible via wireguard? ---------------------------------------------------------------------- valiantiam · 2023-12-21 22:22 I'm actually using SAML2.0. Though I'm not married to that and would be happy to swap to OIDC. PS - always glad to see you responding to posts about your project :) ---------------------------------------------------------------------- HydroPhobeFireMan · 2023-12-21 22:42 this is great stuff, gluetun sounds interesting ---------------------------------------------------------------------- Windows_XP2 · 2023-12-21 22:45 Thanks, Gluetun is really nice. It has support for a lot of providers out of the box, and I haven't had any problems with using it with ProtonVPN. ---------------------------------------------------------------------- Haliphone · 2023-12-21 23:00 This is beautiful, thanks everyone. ---------------------------------------------------------------------- betahost · 2023-12-21 23:24 I went with a ZimaBoard running CasaOS for my docker container services - pretty cheap and easy to configure ---------------------------------------------------------------------- xardoniak · 2023-12-21 23:29 When I rebuilt my infrastructure (moved from multiple bare metal to 1 hypervisor) I started documenting as much as I can. It's still WIP, but it's all here: https://docs.xfgn.dev ---------------------------------------------------------------------- Frozen_Gecko · 2023-12-22 00:07 Ah yes. Did you also switch from plex to jellyfin because your friends got an email that you were enjoying a bit too much UwUntu? ---------------------------------------------------------------------- HydroPhobeFireMan · 2023-12-22 01:03 very clean docs! ---------------------------------------------------------------------- LeftBus3319 · 2023-12-22 03:05 Logging out of Bookstack directly works (iirc) however I have not tested logging out of Authentik then seeing if you are still logged into Bookstack. ---------------------------------------------------------------------- LeftBus3319 · 2023-12-22 03:06 Depends on the service, but most of them are still behind Authentik just in case (yes that's overkill but oh well) ---------------------------------------------------------------------- mrln-1970 · 2023-12-22 03:35 What? I assumed Arch was just a continuous live stream of, uhm iso ---------------------------------------------------------------------- MrReds1324 · 2023-12-22 06:25 Honestly it’s not too bad to run it as a container assuming the services you’re trying to reverse proxy are also containers. You need to create a docket network to add your services and caddy to. Then you set the hostname for you service containers, or define a subnet on the docker network and dish out static IPs to each service container. Then in your Caddyfile you can do “reverse_proxy :”. Since caddy is on the same docker network as the service you don’t need to expose any ports to the outside. ---------------------------------------------------------------------- Tasty-Carbon · 2023-12-22 07:03 Man am i glad i clicked on this post. I needed help with setting up a reverse proxy with tailscale. Thanks! ---------------------------------------------------------------------- saltydecisions · 2023-12-22 10:50 Are we still doing 'phrasing'? ---------------------------------------------------------------------- ssddanbrown · 2023-12-22 12:29 Ah, then if that's specific to when logging out via BookStack (with SLO configured), then that will also be improved in the next feature release. Our flow was a little off-spec, meaning that if the auth system or user did not complete the full-flow of logout spec, they could remain logged in within BookStack. [Issue thread here](https://github.com/BookStackApp/BookStack/issues/4713). ---------------------------------------------------------------------- valiantiam · 2023-12-22 15:28 yeah when I'm in bookstack, and I tell it to log me out of bookstack, it sends be back to my auth provider (Authentik) which is great and dandy, but if I then manually browse back to bookstack, low and behold, my session is still valid and authd. ---------------------------------------------------------------------- ssddanbrown · 2023-12-22 15:42 Yeah, that's what should be addressed as of next feature release. ---------------------------------------------------------------------- neotux__ · 2023-12-22 15:56 No, it's only on ZorinTV and I don't want to pay money for something that I could get for free (and Free in the sense of freedom) ---------------------------------------------------------------------- valiantiam · 2023-12-22 18:07 Sweet thanks for following up with me! ---------------------------------------------------------------------- GreyXor · 2023-12-22 23:06 no gitops with k8s ? ---------------------------------------------------------------------- MargretTatchersParty · 2023-12-23 02:12 How do you use it? It feels like you have to setup a repo per every foldder set you want to backup. ---------------------------------------------------------------------- Fuzzdump · 2023-12-23 06:25 I ended up just making the pipedapi URL public (so the pubsub would function) while keeping the frontend and proxy private. Seems to work OK. ---------------------------------------------------------------------- Legal-Buy-2766 · 2023-12-23 11:55 I personally use nginx-proxy paired with their lets encrypt container. Works quite fine and out of the box (yes you need to give ro to the docker.socket) ---------------------------------------------------------------------- kanik-kx · 2023-12-24 22:58 The fact that you are able to run all that in 8gb is truly impressive. Do you have any monitoring data for the host, what does utilization look like? ---------------------------------------------------------------------- LeftBus3319 · 2023-12-25 02:26 [Here's what it's at right now with one remote Plex Stream (Direct Play)](https://i.chse.dev/GcFYCwT2.png) ---------------------------------------------------------------------- christfried · 2023-12-26 15:15 I am trying a GitHub alternative for my private repos. I was going to set up gitlab but gitea is part of my alternative list I went for gitlab because it is popular. Can you share the reason of your choice for gitea ? ---------------------------------------------------------------------- myusuf3 · 2023-12-28 06:23 How did you setup ghost? Did you figure out emailing? Would love links to setup in homelabs. ---------------------------------------------------------------------- LeftBus3319 · 2023-12-28 06:33 I used the [Docker Image of Ghost](https://hub.docker.com/_/ghost/) with a [MySQL Docker Server](https://hub.docker.com/_/mysql). Then, I used my own SMTP server to send the 1:1 emails (account creation links, etc) and then [you are required to use Mailgun](https://ghost.org/docs/faq/mailgun-newsletters/) to send the actual mass-email newsletters. ---------------------------------------------------------------------- myusuf3 · 2023-12-29 05:24 Fair. ---------------------------------------------------------------------- valiantiam · 2023-12-29 18:51 Just wanted to follow up and say thank you again. I did update to 23.12 and indeed, the logout issue with SAML2 is fixed without any additional changes needed on my end. I appreciate all you do. Have a good new years! ---------------------------------------------------------------------- ssddanbrown · 2023-12-29 19:46 Great to hear that sorted things for you, sorry it wasn't working right before!