Who all grouphosts? reddit / selfhosted ---------------------------------------------------------------------- Loren-DB · 2023-12-26 23:36 In case you're not familiar with [grouphosting](https://lorendb.dev/posts/grouphosting/), well, it's a term I invented to refer to selfhosting with a group of people. I'm currently grouphosting with 3 people, and there's 2 more awaiting onboarding. So my question is, how many people here are grouphosting? Did you just give a few friends administrator access to your server or have you gone all-out with a redundant VM cluster that can fail over to multiple locations? ---------------------------------------------------------------------- dercavendar · 2023-12-26 23:43 Does it count that my friend and I that self host serve as each others non local backups? I have a system at his house that I mirror my data to and he has a system at my house that he mirrors to. We both use use the extra system for compute resources on occasion. ---------------------------------------------------------------------- Loren-DB · 2023-12-26 23:52 That absolutely counts! ---------------------------------------------------------------------- khraglan · 2023-12-27 00:36 I'm grouphosting with two other friends. Our approach is to have all the same privileges. So admin access to firewall, servers, vms etc. Creds are shared over our 1Password family plan. But that might not be the norm because all three of us are in IT. ---------------------------------------------------------------------- Frozen_Gecko · 2023-12-27 00:56 That just sounds like a datacenter with less steps ---------------------------------------------------------------------- Lopoetve · 2023-12-27 01:54 Yes. Combine license access, hardware, backups and archives - and DR capabilities. And spread the power bill. Plus if something has to be worked on, you’re not down all your services and the family doesn’t get pissed. 5 site IPSEC mesh. No comment on the amount of hardware. ---------------------------------------------------------------------- Nintenuendo_ · 2023-12-27 01:57 I just kind of [do my own thing](https://nintenuendo.tv) and bring on friends and family. It's nice to have one place that I can go for myself to get back to everything I'm currently hosting, it's literally my homepage heh. It keeps it really simple for family or the rare friend to use without any guess work or text messages. I havn't hosted with multiple people before, sounds fun! Like having a gym buddy who keeps you engaged. Tho what are you guys hosting if you don't mind me asking? Is resource sharing an issue? Can you guys all just fire up whatever? ---------------------------------------------------------------------- adamshand · 2023-12-27 02:08 I don't any more, but I used to do this. Back before Google Apps I had lots of sysadmin friends. We would all have our own server (some at home, some at work, some at friends houses). We'd provide backup SMTP and DNS for each other. Give shell access for testing, etc. Over time, it consolidated to just a few of us doing it and managing a small cluster of servers to provide mail, web etc for everyone else. I actually kinda miss it. It was a nice way to be useful and hang out with friends. ---------------------------------------------------------------------- Loren-DB · 2023-12-27 02:16 No, I don't mind sharing details :) We're running a bunch of stuff already: - Homarr for the dashboard - Nextcloud - Vaultwarden - Synapse + Element (currently mostly unused) - Otterwiki for server documentation - Opengist - Dashdot - A personal blog (linked above) - A Terraria server - Caddy to proxy it all - Watchtower to keep it all updated Given that the server has only been up for a few weeks, there's still plenty of stuff that will get installed eventually (I need to figure out SMTP proxying, somebody wants Minecraft as well, etc.). Resource sharing is definitely not an issue as the server has 2x 10-core Xeons, 192 GB RAM, and 21 TB storage. We're also probably going to install a GPU (Tesla P40) to enable random stuff like LLMs. ---------------------------------------------------------------------- UnfetteredThoughts · 2023-12-27 03:01 Why ipsec instead of something more modern? ---------------------------------------------------------------------- Lopoetve · 2023-12-27 03:07 Easiest way to run complex BGP cross-site from what I knew how to do - and supported on everything from pfsense (our standard) to most hardware options. All we had to do was set the BGP peers to the tunnel addresses and it all clicks together. What would you run? Happy to look at alternatives - but the IPSEC mesh is working and is pretty reliable. And it’s what I understood since my world doesn’t tend to cross to WAN edge networking much - and the one thing we don’t have licenses for is SDWAN. ---------------------------------------------------------------------- moarmagic · 2023-12-27 03:44 It is a bit different with everyone in it but... I still don't know if I'd be comfortable giving admin access to my firewall to an external party. Servers, vms, i can see. But I need to maintain it in a dmz, and be sure that I know exactly what traffic is allowed in and out of my internal network. ---------------------------------------------------------------------- moarmagic · 2023-12-27 03:46 Honestly, I wish I had someone to do something like this. I have some pretty bad add, and my homelab tweaking and updates go in cycles. It'd be nice to have someone to help keep me focused, and go over projects with. Many of my friends appreciate my services, but no one wants to actually poke anything. ---------------------------------------------------------------------- _RouteThe_Switch · 2023-12-27 03:47 This sounds like the same thing I was thinking might help me get into a Colo easier, they want like half or quarter racks.. but I honestly only need 2u. But my use case is POC for a business so I wonder how I could set up a group host with other like minded people.... ---------------------------------------------------------------------- phein4242 · 2023-12-27 11:57 Ive been doing this for over 20yrs. DNS and SMTP secondaries, mailinglists, and multiple hosting and vpn-based routing platforms. In one of the groups we even published our own RFC’s ---------------------------------------------------------------------- travellingtechie · 2023-12-27 13:56 This is one of my projects for this year. My family is getting kind of spread out so Im setting up each site with a NUC (or similar) and external storage. My oldest kid and I will each have a Synology for the primary data sources. We'll use it for sharing media and possibly some other apps. Initially Ill use tailscale, but eventually I want to set it up with more direct VPNs. ---------------------------------------------------------------------- khraglan · 2023-12-28 00:44 Oh I shoul've clarified that we own our hardware and colocate it in a nearby datacenter. If it would be my internal network I'm fully on your side. ---------------------------------------------------------------------- UnfetteredThoughts · 2023-12-28 19:08 At my previous job we joined sites together with OpenSSH. We were using static routing, not BGP though. Personally, I plan on looking into joining remote sites together with [headscale](https://headscale.net/) but have used Wireguard site to site with OpnSense in the past. There's nothing inherently *wrong* with IPsec. It's one solution we use at my current job for site to site connections for clients. Often use IPsec site-to-site VPNs as backup connections through the Internet for if their MPLS fails. I'm more sold Wireguard for secure WAN links between sites. No support for old/insecure protocols means it's harder to configure in an insecure manner, the code is *dramatically* smaller which means it's more auditable, and in my experience, it is much faster. ---------------------------------------------------------------------- Lopoetve · 2023-12-28 19:59 So the trick with wireguard, from my understanding (which may be wrong) is that to do BGP on it you have to actually know the peer external IP. You have to have this for the tunnel next hop address - in our case, as this is a home lab and we’re dealing with NAT, we don’t - we use dynamic DNS via cloudflare and a few other tricks and use external DNS. IPSEC just needs the internal tunnel IP (we have a /24 subnetted into /31 for this) for both ends and you can set up anything you want on BGP. Also handles a link dropping and having to double hop, since rationalization of the routing table takes about 30 seconds and then off you go. Now granted I haven’t dug a ton into wireguard, but by design I believed it had more “you need to have X to make this work” while basic IPSEC tunnels tended to be “give me a key and point me at something, whatever that something might be, and I’ll give you a tunnel”. And yes - our available subnets and gateways change enough that we really use BGP - I can fail over an entire site and all its networking in a handful of mouse clicks, and nothing cares where it used to be - only where it now is. Yay virtualized networks! Our management networks are the only thing static.