I have been looking into a way to copy files from our servers to our S3 backup-storage, without having the access-keys stored on the server. (as I think we can assume that will be one of the first thing the ransomware toolkits will be looking for).
Perhaps a script on a remote machine that initiate a ssh to the server and does a “s3cmd cp” with the keys entered from stdin ? Sofar, I have not found how to do this.
I’m more worried about what’s going to happen to all the self-hosters out there whenever Cloudflare changes their policy on DNS or their beloved free tunnels. People trust those companies too much. I also did at some point, until I got burned by DynDNS.
We start paying for static IPs. If cloudflare shuts down overnight, a lot of stuff stops working but no data is lost so we can get it back up with some work.
They’re just creating a situation where people forget how to do thing without a magic tunnel or whatever. We’ve seen this with other things, and a proof of this is the fact that you’re suggesting you’ll require a static IP while in fact you won’t.
Where I live, many ISPs tie public IPs to static IPs if they are using CG-NAT. But of course there are other options as well. My point was that the other options don’t disappear.
Though I do get the point that Cloudflare aren’t giving away something for nothing. The main reason to me is to get hobbiest using it so they start using it (on paid plans) in their work, or otherwise get people to upgrade to paid plans. However, the “give something away for free until they can’t live without it then force them to pay” model is pretty classic in tech by now.
However, the “give something away for free until they can’t live without it then force them to pay” model is pretty classic in tech by now.
Yes, this is a problem and a growing one, like a cancer. This new self-hosting and software development trends are essentially someone reconfiguring and mangling the development and sysadmin learning, tools and experience to the point people are required to spend more than ever for no absolute reason other than profits.
A data cloud backup loss should be fine, because it’s a backup. Just re-up your local backup to a new cloud/second physical location, that’s the whole point of two.
I don’t see a need to run two conccurent cloud backups.
In this case, it is not you -as a customer- that gets hacked, but it was the cloud-company itself. The randomware-gang encrypted the disks on server level, which impacted all the customers on every server of the cloud-provider.
Yeah absolutely, but tonyou as an individual , it’s the same net effect of your cloud backup is lost. Just re-up your local backup to a different cloud provider.
The issue is not cloud vs self-hosted. The question is “who has technical control over all the servers involved”. If you would home-host a server and have a backup of that a network of your friend, if your username / password pops up on a infostealer-website, you will be equaly in problem!
Well, the issue here is that your backup may be physically in a different location (which you can ask to host your S3 backup storage in a different datacenter then the VMs), if the servers themselfs on which the service (VMs or S3) is hosted is managed by the same technical entity, then a ransomware attack on that company can affect both services.
So, get S3 storage for your backups from a completely different company?
I just wonder to what degree this will impact the bandwidth-usage of your VM if -say- you do a complete backup of your every day to a host that will be comsidered as “of-premises”
if you backup your vm data to the same provider as you run your vm on you don’t have an ‘off-site’-backup, which is one criteria of the 3-2-1 backup rule.
First of all, thanks to all who replied! I didn’t think there would have been that many people who self-host a SSO-server, so I am happy to see these replies.
As a side-note, I have also been looking into making the setup more robust, i.e. add redundancy. For a “light redundant” senario (not fully automatic, but -say- where I have a 2nd instance ready to run, so I just need to adapt the DNS-record if it is needed), can I conclude from the “makeing a backup” question, that I just need to run a 2nd instance of postgres and do streaming-replication from the main instance to the backup-instance ?
Or are there other caviats I haven’t thought about?
Start small. Find good used hardware first before thinking what services to run. I would start with an old desktop.
Self-hosting is a journey, not a destination. No matter what you buy you'll probably need to buy new hard drives. Used hard drives are a bit of a gamble.
Where do people buy used systems in Denmark? Show us a few things you're interested in and people can give you recommendations.
Also, instead of Photoprism, I would suggest Immich. I was a huge supported of Photoprism for years (even donated money) but their development is too slow. Immich is way faster and has an android app. Anyways, give it a look.
I think 8 GB of RAM is sufficient for all those services. I run them all with Yunohost and I rarely get over 4 GB RAM used.
dba.dk is a pretty popular site for buying used stuff in Denmark, but for electronics I usually go on eBay and sort by EU only (IIRC they removed that option so now the results are tainted with lots of UK gear that’ll be hit with import taxes).
Both deals sound amazing to me, but get 8GB or prepare for RAM upgrade. 4GB could be enough for what you listed there, but you might find more services to run in the near future 🤪
I think those tiny PCs are perfect if you dont need more SATA ports. Its hard to beat them with that low price
I used to have old ThinkStation as a home server. Even older ones like S20 I have couple of laying around is still pretty capable system (I’m typing this on one) and as they’ve been CAD workstations and things like that when they were new many have 12+GB of RAM already. I got mine for free troguh a work contact, but they should be available via ebay or (preferably) your local version of it for pretty cheap.
Then you just need new drives and their prices have dropped too. 100€ is a bit of a stretch, but if you can get a whole computer from someone in the industry it should be possible. I have a few systems laying around I could get rid of for a case of beer or something, but shipping alone from here would eat up majority of your budget (if anyone is interested in x3550 m3 throw me a message, located in Finland, I might remember the model wrong but that’s roughly in the ballpark).
Other than thinkstations I’d say you’ll want a xeon CPU with at least 4 hyperthread cores, 16GB RAM and all the drives your budget has left. SSD for a boot drive(s) is nice to have, but spinning rust will get you there eventually.
Many rack mounted servers only accept SAS-drives which are a bit more expensive. Tower mounts generally use SATA so you can just throw in whatever you have laying around. The main concern is amount of RAM available. For older systems it might be a bit difficult to find suitable components, so more you have already in place the better. For VM server I think 16GB or above is fine for learning and it might be possible to shoehorn most of the stuff in even with 8GB. Performance will definetly take a hit with less RAM, but with that budget some compromises are necessary.
So, in short, with that budget it might be possible if you have a friend who has access to discarded workstations or happen to stumble in a good deal with local companies. It’ll require some compromises and/or actively hunting for parts and with old hardware there’s always possibility of failure so plan accordingly.
You could repurpose an old workstation, bought dirt cheap on eBay if you are lucky, but even then you’ll have to get yourself an HDD, maybe multiple of them if you want to have data redundancy.
For anything new your best bet is a 2 bay ready made NAS, but you’ll have to invest around 300€ for the cheapest one.
It is entirely possible to start with a 2-bay drive rack (not a caddy, we want something without the connections) and then run the SATA out the back of the computer to the drives. It’s a compromise for this low a budget, but it’s not a major sacrifice.
The Raspberry Pi 5 might be good enough for your needs. The 8GB costs a bit less than 100€ without any accessories at the danish reseller, so it fits in your budget. I don’t know if it’s good enough for all your services.
selfhosted
Hot
This magazine is from a federated server and may be incomplete. Browse more on the original instance.