Yeah I can understand small self-hosters having maybe a handful of domains but some users were coming in with thousands. I mean if you have thousands of domains there’s obviously something else going on and maybe you should be paying someone for that.
If they find anything we fix it, update our services, and move on.
The chances of being hit by a zero-day as a random self-hoster are very small, but anyway if you keep backups and can restore a clean state (and patch your system) you should be good.
The goal is not to have perfect security, it’s to mitigate the risks and to handle fallout correctly.
I also practice domain/IP obfuscation in addition to high port:
This eliminates scanning almost completely. They can’t find an IP to go with my base domain, first of all. And even if a bot is scanning the IPv4 address space and all the ports and it finds the reverse proxy it can’t get past it without knowing a FQDN. I still get the occasional hit from such bots but it’s very rare.
Also, all my public services are secured with mTLS (preferably) or at the very least a long key in a custom HTTP header (both enforced at the proxy).
Get a .nl and call it a day?
the exploit has been out for over 10 hours
According to the PHP Foundation the OOM vulnerability was originally found by the security audit they commissioned back in 2024.
They never fixed it because there was no working exploit at the time and also because all the fixes had important downsides and they went into decision paralysis.
I do believe that two years is plenty of time for someone to figure out a working exploit, especially with AI assists.
Bottom line, the timing of this recent debacle is centered around the moment that the PHP Foundation decided to finally eat crow, not around when the exploit was actually available. The embargo was just for spectacle. PHP circles are already spinning it as “see how important PHP is, how much of the internet runs on it, how it’s critical infrastructure”.
Yeah, they still host for free. I think they’ve limited the amount of domains you can host per account though, again due to abuse because there were actors that were bringing in thousands of domains I believe. But if you just want to host one domain it’s fine.
The API makes the difference (vs DNS services at the registrar), DeSEC is well supported by most tools so you can do DDNS and DNS-01 with it without problems.
want to move away from US-based and other non-EU cloud providers
https://european-alternatives.eu/
Which operating system would you recommend? I’ve been looking into TrueNAS Community Edition and OpenMediaVault, but I’m open to other suggestions.
Unraid is a very solid choice. You need to pay a yearly fee for the upgrades but it’s very easy to use and suited for more than just storage (but also makes storage very easy).
I’d prefer a compact, reasonably power-efficient, ready-made NAS rather than building a full PC, mostly due to limited space.
This goes against your preference for open software, because all ready-made compact NAS appliances will come with proprietary software and proprietary hardware… because that’s their business model, tying you to their products.
Regarding power, you’re not saving as much as you think when you consider that the HDDs will take the lion’s share. It doesn’t really matter if the base system consumes 4W or 20W in idle if the HDDs consume 15W/drive.
If you’re an experienced PC builder this is a no-brainer. Building a PC lets you replace components separately and get away with buying used and off-the-shelf.
Choose a case with the right amount of (dampened) HDD cages (I prefer Fractal Design but there are others) and a quality power supply. The motherboard should also have an appropriate amount of SATA connectors. The CPU is not terribly important and can be a decade old. In fact you can get away with buying a used kit. You don’t need a lot of RAM, even 8 GB will do (but if you can get 16 or 32 that’s nice too). Same for the system SSD, it can be as low as 64 GB or even lower.
How much hardware performance do I actually need?
Depends if you have specialized usage. For example if you want to do AI on the CPU. Or if you want to do video transcoding. If you don’t, anything will do.
Which software stack would you recommend?
A dedicated CalDAV/CardDAV server for contacts and calendar/tasks. Radicale and Baikal are the most popular.
Immich for photo organization (albums, sharing, face recog, semantic search) and photo backup. Basically it was designed to be a great Google Photos replacement.
Personally I would avoid Nextcloud, it’s a beast. I would definitely not tie important stuff like calendars into it. Strictly for files may wanna look at alternatives like Seafile or OpenCloud.
For file sync most people use Syncthing but I don’t like their mobile (non-official) support. Personally I prefer FolderSync + SSH.
If you get into media libraries then Jellyfin can cover video, audio and books too, but there are also other specialized ones for music and books.
What should I consider regarding backups and remote access?
Not sure why you’re conflating these two.
For remote access if you’re not behind CGNAT at the ISP then VPN (Wireguard or OpenVPN) and/or SSH is the most secure.
Tailscale is a good alternative, it works behind CGNAT too, and it has a bunch of other interesting features like exit nodes. Look into it. It’s a “mesh VPN” that uses open source clients with a central server that facilitates the pairing from behind NAT. The connections themselves are always private.
If you have to expose HTTP services over the Internet you must get a domain, reverse proxy, HTTPS certificates (with auto-renewal, most reverse proxies will help with this) and mTLS is the best security option. But keep in mind very few mobile apps support mTLS (Immich, DAVx5, Ntfy do).
For backups, first of all use a proper backup tool like Borg or Restic, not sync tools like Rsync. You want your backup tool to offer integrity checks, recovery, encryption, deduplication and compression, sync tools offer almost none of these.
Secondly, look into 3-2-1 backup strategy. Affordable backup methods for home use include backup “cold” HDDs, Blu Ray optical discs, and online storage subscriptions. Borg/Restic include support for transparent online backups too.
You don’t have to backup everything. Categorize your data and figure out some priorities. Usually the truly important data is not very large.
RAID and other forms of storage redundancy are NOT backup, they’re mostly about keeping services going during drive failures. If you have to work with limited amount of drives I would prioritize backup over redundancy.
EMAIL:
You don’t have to self-host the sending and receiving of email to retain control over it. It’s in fact very hard to do that.
What you need is to choose a good domain for your @ addresses, on a long-lasting TLD (preferably an EU ccTLD, perhaps your own country’s), and an email provider (see the link at the top) that offers SMTP and IMAP without any shenanigans.
You can use IMAP to sync your online mailboxes constantly at home, and also use IMAP to check your online mailbox with any email client, and use the provider’s SMTP to send mail. Any decent provider will supply you with the DNS records that need to go into your domain setup so you can use them.
If you ever want to switch provider it’s as simple as signing up with another and changing your DNS records.
You can if you want self-host an IMAP server and a webmail client at home on top of your local email archive, so you can search through old emails, and so you can delete them from the online mailbox so you can reduce your online mailbox size (and perhaps pay less). Just as long as you don’t try to self-host the ability to send and receive.
Other things you might want to look for at a provider is alias capability, or at least a catch-all. Helps a lot if you give each different online account its own different email address, and never give out your real address (the one you use to login to the email server).
Most email providers will tax you per mailbox and for things like aliases. IMO that’s bullcrap. Personally I prefer a provider that allows for unlimited mailboxes and aliases and taxes for tiers of storage space and emails sent/received. Migadu is one such European example. For two people YMMV, either model might be ok. When you have more than two accounts the unlimited model can become much cheaper very fast.
Things you may not have considered:
Look into a reverse proxy and getting a domain + HTTPS certificates for it, and putting your services behind it at addresses such as https://cal.example.com/. It will make your service consumption 100x better.
Also consider your home router. Is it a capable one? Most people overlook this completely, but a good router can help immensely with self-hosting for things like DNS, VLANs, port forwarding, having stable IPs for servers etc. You can flash a cheap router with OpenWRT and get excellent features out of it.
If you need notifications, or sending messages+attachments across devices, or action buttons, Ntfy can either be self-hosted or used through their public service.
They took a lot longer than that on some past vulnerabilities, some of them sat unpatched for weeks or months. But it depends on the severity. A remote exploit of severity 9 will probably get expedited.
But you can buy a ton of online AI access for that kind of money.
I know, I know, privacy and offline availability and all that, but sometimes you gotta weigh the pros and cons.
Yeah use the “Registry” link on their sidebar and sort by age. The oldest domains on there are not going anywhere.
*.dedyn.io registrations are discontinued indefinitely right now unfortunately, following a wave of abusive registrations.
It’s a good idea to validate your config before reloading it (whether it’s by running caddy reload or restarting/reprovisioning the container):
[docker exec -it caddy-container] caddy validate --config /etc/caddy/Caddyfile
Why do we do this?
RAID comes down to reducing the risk of any single disk failure making you lose data. But you can also approach that with backups.
There’s also the secondary benefit of avoiding downtime but that’s questionable in a self-hosted setup, unless you’ve come to depend on services that can’t continue when the server is offline. In my case that’s not true because email is not self-hosted, things like calendar and contacts can function offline on the phone, just don’t have server sync for the duration, and things like photo archive aren’t essential (important yes, but not “can’t function daily without them”-essential).
Speaking of which, I think the first thing you should do is categorize your data by degrees of gravity along these two criteria: (1) how over would my life be if I lost this data and (2) how essential it is to my daily function.
It’s important to realize that these two criteria overlap but aren’t the same, first of all. Secondly, I think you’ll find that data criticality in regard to your life is maybe not what you expected. Truly essential things will probably end up being smaller than you think, and that makes them easy to back-up, making RAID maybe not such a must-have.
IMO it’s more important to set up a 3-2-1 backup strategy and consider your methods for achieving that than to have a RAID setup. Some cheap and effective methods are: backups to “cold” HDDs (which you keep in the closet, bring out once a month for a backup, and put back); backups to optical disc (Blu Ray); backups to online storage.
Please be aware that backups tools and copy/sync tools are different beasts. Rsync or rclone for example is not backup tools, they’re fancy copy tools. A true backup tool (borg, restic) will give you integrity checks (independent on the supposedly-still-pristine-source), deduplication, incremental backups, encryption (essential for online storage), recovery, adaptive compression etc. They also work transparently on top of regular filesystems and/or SSH, which lets you use generic online storage for backup. For example you can sync a local borg repo to a free Dropbox account, or use borg over ssh with a Hetzner storage box.
Personally I stay away from complicated array setups. I use pairs of HDDs in RAID1 and that’s all the RAID I need. RAID5 is a data loss waiting to happen because the long and intensive rebuild puts too much stress on the rest of the array members in case of one disk loss, so basically RAID6 is a must, but that makes things even longer and more complicated. ZFS is a very complex beast, it needs a lot of RAM to function efficiently, and the misconfiguration scenarios and subtle failure scenarios are terrifying. It’s also not going to solve any problem that you can solve with backups, which you should prioritize anyway.
Another thing that you must realize and commit to, with any approach that uses disks, is that any disk can fail at any time. Any of the backup drives, any of the live drives. You MUST always have at least one known good spare on hand. And I mean literally in hand, because if you have to go shopping in today’s day and age that means weeks away. Always have the spare local.
Also, don’t think this doesn’t include SSD’s, particularly system disks. Losing the M.2 that the server runs off can hurt like a bitch. Losing any of the fancy SSD’s in your desktop/gaming computer/laptop, even more so. But people often overlook those and hope for the best, when same logic applies: backup, and have a spare in hand.
Please note that the Tailscale binaries for OpenWRT are pretty large (even if you cross-compile them with compact and strip). Your router might not have enough storage for it.
If that’s the case, you might work around it by only storing the tailscaled binary on persistent storage, because that’s the daemon which runs the actual connectivity. The tailscale binary is only used for making configuration changes, you can copy that to RAM disk, use it to set config params, then delete it.
Here are my basic criteria:
If you want the domain to be used long-term and tie your whole online identity around it, then stay away from all novelty domains. Only use top TLDs and ccTLDs.
Novelty domains can suffer unexpected price hikes across the registry or even be discontinued because they’re basically commercial ventures.
Particularly avoid premium TLDs, because the registry can choose to hike up the price of specific domains separately from the base domain cost, just because they look “premium”. You can have the domain priced up right from under you and come renewal time you have to match the new price or lose it.
The ccTLDs of the EU member countries are a very good idea if you’re an EU citizen because they have built-in privacy for individuals (they don’t publish their info in WHOIS) and are also subject to GDPR.
Your own country’s ccTLD would be an obvious fit but price may be a consideration, some are more expensive than others. As long as you’re an EU citizen you can shop around and get a domain from any other EU member afaik, as well as .eu.
I think .de, .nl, '.frand.ro` are the cheapest, or at least they were last time I checked this a few years ago.
Please note that .de technically requires a local German address for correspondence. You can choose to skip that but if the registry ever has reason to get in touch with you and you don’t have such an address it’s grounds for suspension. Some registrars (INWX for example) will supply their own German address for you for a small extra fee, but that brings the cost of the domain in line with the others so you might as well get a .nl to begin with.
What’s a good smart plug to use?
I assume it’s a thing you place between the machine’s power cable and the wall and can be queried over WiFi?
RRD
That’s a name I haven’t heard in a minute!
I see the rrdtool gallery is still up and my graph is still in there 🤭. (No it’s not the Christmas graph, that one’s insane.)
I’m using Influx nowadays but maybe I should revisit good old rrdtool for old times’ sake.
Need to edit the proxy host for Jellyfin in NPM (advanced tab) and send the X-Forwaded-For header to it.
proxy_set_header X-Forwarded-For $remote_addr;
And also in Jellyfin settings you have to set the IP that it sees the reverse proxy coming from as a “known proxy”, so it knows it can trust that header when it comes from that IP.
https://jellyfin.org/docs/general/post-install/networking/reverse-proxy/#forwarded-for-headers
In my case I have defined a fallback in Caddy so any request that doesn’t match one of the explicitly handled domains will be an error.
I use a
route {}block withhandle {}blocks inside it, and the last handle has anerrordirective in it.https://*.example.com { route { @foo host "foo.example.com" handle @foo { reverse_proxy http://whatever:12334/ } ... more proxy hosts ... handle { error 400 } } }The
routeblock is essential here because handlers inside a route block are processed strictly in the order they are defined. Outside route blocks that is not true, caddy will try to optimize and can execute directives in any order it sees fit.