+1 for Nomad. Ive used k8s a lot and still use it, but i prefer Nomad for home purposes. You dont even need a consul cluster to run it anymore so it’s pretty simple to start.
The second isn’t a bad idea if it’s in combination with the first. Then you have an image you can restore with most of your config and you can just restore the rest from the normal backups.
Bookstack is really nice and user friendly. It’s probably one of my favorites.
Dokuwiki is simple and stores files in plaintext.
I haven’t used wiki.js much but I’ve heard good things about it too.
Another option if you don’t need to share the wiki with anyone would be a note tool like Trilium. It has built in support for stuff like mermaid or excalidraw diagrams.
Don’t forget to setup backups for whatever wiki you do go with, and make sure you can restore them when your wiki is broken ;)
That makes sense, it does sound better to keep it within nixos! I’ve mostly been using nixos to bootstrap servers that run nomad+docker, so beyond the system-level config, I haven’t done a lot with additional software yet.
Make sure your backups are solid and can’t be deleted or altered.
In addition to normal backups, something like zfs snapshots also help and make it easier to restore if needed.
I think I remember seeing a nextcloud plugin that detects mass changes to a lot of files (like ransomware would cause). Maybe something like that would help?
Also enforce good passwords.
Do you have anything exposed to the internet that also has access to either nextcloud or the server it’s running on? If so, lock that down as much as possible too.
Fail2ban or similar would help against brute force attacks.
The VM you’re running nextcloud on should be as isolated as you can comfortably make it. E.g. if you have a camera/iot vlan, don’t let the VM talk to it. Don’t let it initiate outbound connections to any of your devices, etc
You can’t entirely protect against zero day vulnerabilities, but you can do a lot to limit the risk and blast radius.
Iirc crowdsec is like fail2ban but blocks ips reported by other servers, not just ones attacking your server. Kinda like a distributed fail2ban I guess?
Self hosted nextcloud works great for me. There have been a lot of improvements over the last few years, handling conflicts doesn’t feel as clunky and I don’t really run into as many unless I’m storing git repos in my NC directory.