• 19 Posts
  • 26 Comments
Joined 3Y ago
cake
Cake day: Jan 03, 2022

help-circle
rss
Paid SSL vs Letsencrypt
I'm curious what the benefits are of paying for SSL certificates vs using a free provider such as letsencrypt. What exactly are you trusting a cert provider with and what are the security implications? What attack vectors do you open yourself up to when trusting a certificate authority with your websites' certificates? In what way could it benefit security and/or privacy to utilize a paid service? And finally, which paid SSL providers are considered trustworthy? I know Digicert is a big player, but their prices are insane. Comodo seems like a good affordable option, but is it a trustworthy company?
fedilink

I replaced the drives, installed the newest version of PVE, then restored all of my VMs from local USB backup. I had to reconfigure a number of things such as HDD pass through and other network settings, but in the end the migration was a success.


Server Access Log Admin Dashboard?
What do you recommend for an at-a-glance access log dashboard? Kibana and Grafana seem cool but overkill. All I want is a dashboard that can ingest and parse syslogs from various services and neatly display a list of currently connected IPs and usernames if applicable as well as a IP connection history.
fedilink

I don’t work in IT at all. My self hosting journey started when I got sick of feeling powerless in the face of big tech companies who are increasingly ripping off customers or violating their right to privacy. There’s also the general mistrust that comes from my data being repeatedly breached or leaked because share holder profits are more important than investing in basic security.


[Question] Migrating and Upgrading Proxmox to New SSDs on Poweredge Safely
With the EOL of PVEv7 and my need for more storage space, I've decided to migrate my VMs to a larger set of drives. I have PVE installed baremetal on a dell r720 RAID1 SSDs. I'm a bit nervous about the migration. I plan on swapping the SSDs, installing PVE8 from scratch, then restoring VMs from backup. Should I encounter an issue, am I able to swap the old RAID1 SSDs back in, or once I configure the new ones are the old drives done for? I'm managing RAID on a dell RAID controller. I also have my data hard drives passed directly into a TrueNAS VM which supplies other VMs via NFS. Is there anything I should be concerned about when I've migrated, such as errors re-passing the data drives to the TrueNAS VM. Or should everything just work again? Is there a master PVE config file I can download before swapping drives that I can reference when configuring the new PVE install?
fedilink



Where to buy server replacement hdd to match existing RAID configured drives?
I have a Dell Poweredge r720xd in RAID10. I've had a couple of drives fail since I've bought it and was able to buy cheap replacements on ebay. I had another drive fail recently and one of the spare ebay drives came up as "blocked". It put me out a few days while I waited for a new one to arrive; also from ebay. I'd like to avoid getting another dud drive. Are there any reputable resellers of these old drives so I can stock up on some spares?
fedilink

Is this a bad idea? Mesh/VPN
I’ve made a few posts in the past about my experimentation with connecting various devices and servers over a VPN (hub and spoke configuration) as well as my struggles adapting my setup towards a mesh network. I recently decided to give a mesh setup another go. My service of choice is Nebula. Very easy to grasp the system and get it up and running. My newest hurdle is now enabling access to the nebula network at the same time as being connected to my VPN service. At least on iOS, you cannot utilize a mesh network and a VPN simultaneously. TLDR: Is it a bad or a brilliant idea to connect my iOS device to a nebula mesh network to access for example my security camera server, as well as route all traffic/web requests through another nebula host that has a VPN such as mullvad on it so I can use my phone over a VPN connection while still having access to my mesh network servers?
fedilink

How are you handling displays and keyboard/mouse? Also what VM software?


I’m not the one making wild accusations about somebody wanting to selfhost a gpu server to edit…incest porn or whatever it is you’re on about.

No idea what lie you think I’m telling. 🤷‍♂️


That’s such a weird leap in logic to jump to. Are you okay?


I run a few servers myself with proxmox. FYI there is a script that removes that nag screen as well as configures some other useful things for proxmox self-hosters.

https://tteck.github.io/Proxmox/


I have a workstation I use for video editing/vfx as well as gaming. Because of my work, I’m fortunate to have the latest high end GPUs and a 160" projector screen. I also have a few TVs in various rooms around the house.

Traditionally, if I want to watch something or play a video game, I have to go to the room with the jellyfin/plex/roku box to watch something and am limited to the work/gaming rig to play games. I can’t run renders and game at the same time. Buying an entire new pc so I can do both is a massive waste of money. If I want to do a test screening of a video I’m working on to see how it displays on various devices, I have to transfer the file around to these devices. This is limiting and inefficient to me.

I want to be able to go to any screen in my house: my living room TV, my large projector in my studio room, my tablet, or even my phone and switch between:

  • my workstation display running on a Window 10 VM
  • my linux VM with youtube or jellyfin player I use as a daily driver
  • a fedora or Windows VM dedicated to gaming, maybe SteamOS
  • maybe a friend comes over for a LAN party and we both can game without having to set up a 2nd rig
  • I want to host an LLM or stablediffusion server without having to buy a new GPU with enough VRAM to run SDXL

Fully Virtualized Gaming Server?
For years I’ve had a dream of building a rack mounted PC capable of splitting its resources to host multiple GPU intensive VMs: - a few gaming VMs - a VM for work that can run Davinci Resolve and Blender renders - an LLM server - a Stable Diffusion server - media server Just to name a few possibilities… Everytime I’ve looked into it, it seemed like the technology just wasn’t there yet. I remember a few years ago Linus TT took a shot at it, but in the end suggested the technology (for non-commercial entities) just wasn’t in a comfortable spot yet. So how far off are we? Obviously AI focused companies seem to make it work, but what possibilities exist for us self-hosters who might also want to run multiple displays in addition to the web gui LLM servers? And without forking out crazy money for GPU virtualization software licenses?
fedilink

Can I hijack this thread to ask if any of these recommendations have iOS apps? Vikunja looks the most enticing to me but seems they don’t have an iOS app sadly.


I’m a massive Nextcloud fan and have a server up and running for many years now.

But I understand all of the downvoted commenters. It is clunky and buggy as hell at times. Maybe it’s less noticeable when you’re running a single user instance, but once you have non tech literate users using it you begin to notice how inferior it is to the big boys like google drive in some aspects.

That said, I personally have a decent tolerance for fiddling and slight frustrations as a trade off for avoiding privacy disrespecting and arguably evil corporations.

I would recommend everybody looking for a gdrive, Dropbox, one drive alternative to at least give Nextcloud a go.


Thanks so much for the detailed reply. I have about 20TB of data on the disks otherwise I would take your advice to set up a different scheme. Luckily, as it’s a backup server I don’t need maximum speed. I set it up with mergerfs and snapraid because I’m essentially recycling old drives into this machine and that setup works pretty well for my situation.

The proxmox host is the default (ext4/lvm I believe). The drives are also all ext4. I very recently did a data drive upgrade and besides some timestamp discrepancies likely due to rsync, the SCSI semi-virtualized thing wasn’t an issue. I replaced the old drive with a larger one, hooked the old one up to a usb dongle and passed it through to OMV and I was able to transfer everything and get my new data drive hooked back into the mergerfs pool and snapraid. I’ll do a test and see if I can still access the files directly in the proxmox host just for educational purposes.

I’ll try to re-mount the NFS and see where that gets me. I’m also considering switching to a CIFS/SMB share as another commenter had posted. Unless that is susceptible to the same estale issue. I won’t be back at that location for about a week so I might not have an update for a little while.


Third time posting this reply due to the lemmy server upgrade.

Proxmox on bare metal. A VM with OMV and a VM of proxmox backup server. Multiple drives passed through to OMV and then mergerfs pools them together. That pool has two main shared folders. One is for a remote duplicati server that connects via SFTP. The other is an NfS for PBS. The PBS VM uses the NFS shared folder as storage. Everything worked until recently when I started getting estale errors. Duplicati still works fine


Looks like my reply got purged in the server update.

Running Proxmox baremetal. Two VMs: Proxmox Backup Server and OMV. Multiple HDDs passed through directly as SCSI to OMV. In OMV they’re combined into a mergerfs pool. Two shared folders on the pool: one dedicated to proxmox backups and the other for data backups. The Proxmox backup shared folder is an NFS share and the other shared folder is accessed by a remote duplicati server via SSH (sftp?). Within the proxmox backup server VM, the aforementioned NFS share is set up as a storage location.

I have no problems with the duplicati backups at all. The Proxmox Backup Server was operating fine as well initially but began throwing the estale error after about a month or two.

Is there a way to fix the estale error and also to prevent it from reoccurring?


Underlying system is running Proxmox. From there I have the relevant two VMs: OMV and Proxmox Backup Server. The hard drives are passed into OMV as SCSI drives. I had to add them from shell as the GUI doesn’t give the option. Within OMV I have the drives in a mergerfs pool, with a shared folder via NFS that is then selected as the storage from within the Proxmox Backup Server VM. OMV has another shared folder that is used by a remote duplicati server via SSH(SFTP?), but otherwise OMV has no other shared folders or services. Duplicati/OMV have no errors. PBS/OMV worked for a couple of months before the aforementioned error cropped up.

Also possibly relevant: No other processes or services are setup to access the shared folder used by PBS.


[Question] Alternative to NFS for Proxmox Backup Server
I have a backup server running Proxmox Backup and OMV in separate VMs. OMV provides the storage as an NFS to the proxmox backup server VM. I have multiple remote servers that connect to the proxmox backup server but recently I keep having issues with backups. Something about file lock estale. Is there an alternative to NFS I can use in OMV to provide the storage for the proxmox backup server? I know there are vastly different configuration options, but I have some other things set up with OMV so I’m kinda stuck on that.
fedilink

I ended up going with migadu. Seems great so far. Already up and running with 3 domains and dozens of aliases.


Forwarded mail but it may be two way in the future so it would probably be smart to just go that route from the beninging.


Custom Domain Email
I self host pretty much everything, but one of the services I find makes more sense to not self host is an email server. I’ve got a few domains I’d like to have emails for, and usually I’d go for Tutanota or protonmail. But in this instance I’m looking for something dirt cheap. These domains are for a hobby club so I’m much less concerned with privacy like I usually would be. Anybody got any recommendations? So far namecheap seems like my best option for under $8/month. They would bundle with my domain registration and I’m assuming having both on the same service would make things pretty seamless to set up. Not crazy concerned with privacy for these particular accounts. Namecheap or similar is reputable enough.
fedilink

Problem solved. The firewall was attempting to pass traffic through the default gateway. You have to create a firewall rule to allow whatever traffic you want but in the advanced settings you need to select the wireguard gateway instead.


[Help] Pfsense Routing OPT1 to Use Wireguard Interface / Gateway
Hey guys. Having a bit of a headache trying to get wireguard working properly through my pfsense router. Configuration overview: VPS wireguard server set to forward all traffic from peers (it's operating as a self-hosted VPN). I have a port on my router we'll call OPT1 that I want to traffic all connections through wireguard to the VPN. So far I have the VPS and pfsense connected successful through wireguard. They are making active handshakes and I can ping between them perfectly fine. I followed the documentation, but my windows PC connected directly to OPT1 can't access the internet. From the PC I can ping the DHCP server of OPT1 as well as the wireguard tunnel, but I can't ping anything outside of that. I'm passing all traffic from OPT1 subnet to the wireguard interface in both OPT1 firewall rules and the wireguard interface rules. I'm sure many of you have dealt with this configuration before. Does this issue sound familiar?
fedilink

You suggested just adding the ISOs to local-lvm. Do you think it would be feasible to simply delete the local storage completely and then extend the local-lvm after, storing the ISOs there? I know extending volumes is much simpler than shrinking. And I imagine deleting completely is also easier than shrinking?



[Question] Resizing Proxmox local / local-lvm?
I'm dangerously close to running out of space for my VMs on local-lvm, but noticed I have a lot of free space in my local storage where I only have a dozen ISOs stored. Can anybody help me figure out how I'd go about shrinking the local storage so I can extend my local-lvm?
fedilink

Anybody Using Nebula?
After a very enlightening discussion in a previous thread, I decided to plunge into a mesh type network to connect my various servers and devices. Nebula has been fairly straight forward to set up so far, but I’m having some trouble with the details and am curious if anybody has successfully got Nebula up and running for their network. Installation on Linux platforms has been a breeze. Windows I can’t seem to get working. I was able to install but the service refuses to start. Can’t find any documentation besides random GitHub issue threads. MacOS was easy to install but having issues due to a VPN that’s running already. I use a VPN because I travel a lot. I also use my MacBook to SSH into my servers or access remote file storage. My previous network configuration was connecting via wireguard to my network. I was able to do this while maintaining an always on VPN with the mullvad app. With Nebula that VPN seems to muck things up. I’m also curious if anybody has had experience setting up a dual config for Nextcloud. Essentially accessing a Nextcloud server from nebula with a trusted device while still allowing public access for things list public shared links.
fedilink

Ideally I would be able to split tunnel around the vpn but I don’t have the option on mac


I tried to set up a nebula network but it seems like it has trouble when your hosts are behind a VPN service. The VPN must block the port or protocol the lighthouse is connecting with and I can’t figure out a way to bypass the VPN (at least on Mac split tunneling isn’t supported). I’m assuming you’re familiar with mesh networks…do you have any good youtube videos or resources you would recommend? The nice thing about VPN is it’s crazy simple to set up and seems to work with all types of system configurations. Nebula was pretty simple but seems like a pain to troubleshoot so far.


Funny you mention that. I was about to make a post about Nebula earlier. I learned about it through YouTuber apalrd a few months back and it seems perfect. I’m still trying to understand some of the complexities when utilizing a service that requires circumventing the mesh network for public access such as Nextcloud. I’ll probably make a post about this after I’ve done some more research. I think there’s some good discussion to be had about such a setup.


So each time I get shut down is during a large extended data transfer. I have my VPS server set up as a VPN hub that connects multiple servers. So typically when my traffic gets diverted to a black hole by DO, there was a consistent roughly 35MB/s inbound/outbound vpn traffic stream for 4-5 hours going through the VPS. My server gets shut down for 3-4 hours and I get a email notice that my server was under a massive DDoS attack and they diverted traffic to a black hole. I always respond informing them that it’s not a DDoS and explain the situation. They typically respond with “Utilize a service like Cloudfare which has DdoS protection”.

I’ve been really happy with them as a provider otherwise but this is a dealbreaker for me.


Fed Up with DigitalOcean
So I selfhost a number of servers in various locations and utilize a DigitalOcean VPS as a hub/gateway to transmit data between these nodes. I have a consistent issue when running large backups or transfers in which DigitalOcean flags my server for a DDOS attack and sends traffic to a black hole for 3-4 hours. Customer support has been the absolute worst and does fuck all to help remedy the situation in any way. These events have been consistent over the past 8 months. Does anybody have recommendations for a solid VPS provider? Price isn’t too much of a factor. I was running a $8/month server but I don’t mind something more expensive if the company has a good reputation for reliability and privacy. As mentioned, I primarily use a VPS as a gateway/hub for file transfer services. I’m also hoping to spin up another VPS for static websites.
fedilink

How to Power On Dell Poweredge Server Remotely & Safely?
Some background: - have a poweredge r320 on battery backup (basic APC unit) - have unifi dream machine - poweredge powers down automatically if power goes out What's the safest way to allow myself to power on the server in the event it shuts down while I'm not home? I figure since I have remote access to my UDM, perhaps there's a command I can execute from there to power it on? My fear is using a method that provides more than just poweron commands remotely. I want to keep the server attack vectors down.
fedilink


[Question] Hosting Multiple NodeJS Websites with Docker?
I have a handful of NodeJS websites that are almost ready to be deployed publicly. All of them are very simple sites which I don't expect to get much traffic. I'm thinking I could make a docker container for each website using the NodeJS docker image, then route them using traefik or nginx. This way there's a good degree of separation between the sites and everything will be organized and easy to backup/transfer around if needed. Is it a decent plan? Got any better ideas or tips?
fedilink

[Question] Preventing DDoS
I self host all of my services but utilize a VPS as a gateway for access. Primarily to allow access to a media server and file storage for friends and family. Recently I’ve been shut down by my VPS provider on multiple occasions because they claim my server was DDoS’d at 2gigabits/s. I don’t see any evidence of this in my logs. Regardless, I set up Traefik proxy to geoblock any IPs outside of my country. Literally a few mins after doing so and confirming via VPN that it was working I got shut down and received an email that my network was severed temporarily due to a DDoS Blackhole event. The questionable nature of their detection system aside, it’s got me wondering…does ip blocking actually help mitigate DDoS attacks? The server still needs to process the incoming connection before it filters it, so I’m assuming the attack is still accomplishing it’s intent which is to overload the server. Can somebody more knowledgeable provide some insight?
fedilink

[Question] IP Block By Region
I know cloudlfare and other cloud providers often provide geoblocking features if you host with them. Does anybody know of any similar foss packages for us self-hosters? I know I don't have any need for somebody outside of my country to access my server, so geoblocking IPs would be a great security feature.
fedilink

[Question] Hosting Multiple Sites (different domains) from One VPS
Is it possible/practical to host multiple websites from the same VPS server? I have a number of domains (for example): bilbobaggins.com, rx4free.com, mypersonalblog.com I don’t get much traffic and I’m not interested in paying for separate servers for each domain. But I still want https certificates to work properly. Now I’m familiar with setting up wildcard subdomains with traefik and letsencrypt. But can I do the same or similar with completely different domains such as listed above?
fedilink

I’m curious if anybody has a more “self-hosted” solution, but I use burner numbers through the MySudo app and simply delete the number and buy a new one every few months.

If you look up Michael Bazell, he has a strategy for bulk buying voip numbers by tricking voip providers into believing you’re a large established business. You could buy dozens of numbers and just cycle through them. But that method requires a lot of work and social engineering and the providers are becoming privy to those tactics.


[Question] Is SSH secure in this scenario?
Consider a wireguard network of many clients which all interact with each other through a central hub server on a cloud VPS. One of the clients is a desktop used for SSHing into the other various clients--again, through the central hub. If the "terminal" client connects to another client through the wireguard hub using SSH public/private key authentication, what if any information within that SSH tunnel gets exposed or leaked to the "hub" server? My threat model is if the VPS was to ever get compromised. I previously SSH'd into the hub VPS server and from there I would SSH into any of the other clients with a password. Horrible security, I know. My new setup is as mentioned above. Only the single desktop client has key authentication to SSH into the various clients. But I want to be sure none of that data gets exposed to the VPS hub just in case.
fedilink

[Question] FTP vs SFTP (SSH)?
My use case is I’m transferring large already encrypted files between two servers connected via wireguard. Is there any benefit to SFTP over FTP in this case?
fedilink