Oh neat. I was scared off by OIC going to a data “blob” backend store. I want my files still accessible directly if the database blows up. Looks like opencloud gives you the choice: https://nexus.opencloud.community/docs/app-development/storage-backends/
This absolutely. Anyone who actually wants open registration will be configuring their own SSO or whatever backend. The default should be safe for testing and/or hobbyists.
To anyone afraid of the above conclusion, a dedicated $5 VPS with automatic snapshots get you a long way.
Any time you have a server willing to process random data uploaded from randos, just expect it to be compromised eventually and prepare for the eventuality by isolating it, backing it up religiously, and setting up good monitoring of some sort. Doesnt matter if its a forge, a wiki, or like nextcloud or whatever. It will happen.
We also have COW filesystems now. If you need large datasets in different places, used by different projects, etc, just copy them and use BTRFS or ZFS or whatever. It wont take any space and be safer. Git also has multiple ways of connecting external data artifacts. Git should by default reject symlinks.
Theres a HUGE difference between hosting it essentially read-only to the world, vs allowing account creation, uploading, and processing unknown files by the server.
I have thought of blocking access to the commit history pages at the reverse proxy to cut off 99% of the traffic from bots. If anyone wants to look at the history, its just a git clone away.
You can git pull a repo to your machine, make your changes and then use git to submit a patch via email. Its not pretty, but it works. Hopefully federation is built soon and you will be able to submit a pull request from your own forge.
While good, network security isnt the issue. Its running a web service with open registration allowing randos to upload content that gets processed by the server.
Throw this up on a dedicated $5 VPS and you still have a problem. The default should be manual registration by admins.
Probably better to use them for their screen, firewalled off from everything except whatever is providing a dashboard or info display (e.g., homeassistant).
Your perspective aligns with a lot of self-hoisters who run things on rpi’s and such, but not the “home labbers”. Also, see the pubnix, tildeverse, smol web, indie web, and to some extent the retro computing communities. You are definitely not alone!
Restic is great, and the de-duplication between snapshots is amazingly good. Same content in different files (e.g. tar files of linux systems) take very little space like magic). Backrest is a nice web frontend for it.
Note that you should use some retention features of your provider to manage the risk of ransomware deleting your backups.
This comment prompted me to look for a picture of it. Nothing I can find, except in the background behind a baby picture of my now-in-university baby when I was apparently debugging the network connection:
There was a time when I had an old desktop packed full of spinning hard drives in my living room under a CRT television! Yes that works, but a NAS in the furnace room that is accessible from “smart TVs” and everyone’s mobile devices is pretty nice. No more fan noise either.
While true, neither backups nor checksums are exclusive to hosting anything.
Mainly just multi-device access.
I see that cosmos advertises running your apps on a vpn built-in. That might be worth looking into. When I switched to self-hosting everything on my “tailnet” and closed incoming ports, a lot of the nice features of Yunohost for maintaining DNS and certs for the various apps stopped being that useful. In this day and age, I think being able to self-host and experiment within a safe VPN environment instead of on the open internet is the way to go.
Hot take: For personal use, I see no value at all in “availability,” only data preservation. If a drive fails catastrophically and I lose a day waiting for a restore from backups, no one is going to fire me. No one is going to be held up in their job. It’s not enterprise.
However, redundancy doesn’t save you when a file is deleted, corrupted, ransom-wared or whatever. Your raid mirror will just copy the problem instantly. Snapshots and 3,2,1 backups are what are important to me because when personal data is lost, it’s lost forever.
I really do think a lot of hobbyists need to focus less on highly available redundancy and more on real backups. Both time and money are better spent on that.
Absolutely! I should have said both the dns and certificate are subdomain wildcards. Thanks for clarifying.
I wish more people were like us on this matter, but they don’t appear to be. People are using video for everything, regardless of how bad it is. One of the most popular genre of short form video is some well manicured person pointing up at some text that appears in the top of a video, set to terrible music. 20-100 words at most.