ZeldaFreak

My first advice is: it’s always too small. You always realize that you need more, as you can get bigger. As an example from me. I started with 3TB of storage for data hoarding. I quickly upgraded to 21TB and it’s still not enough. You may start with something small, but there is so much. Technically you could go up to AI selfhosting. Especially when you go the route with image and video generation, this takes up resources. I heard the Mac Mini is getting used for local AI.

As for what to host, you should ask yourself what do you need. Lemmy and Peertube I count towards not useful for private usage. A cloud storage like Nextcloud is something very useful. Jellyfin is useful. I would start with cutting out 3rd party cloud services from your personal usage. Instead using dropbox/google drive/iCloud and so on, use Nextcloud. Same for images. Make your local media like movies, music, audio books, books and so on accessible to all devices, with the neat features we love from other services like Netflix, Audible, Kindle and so on. You could also just starting hosting your own game servers, than renting or making it only available when you also play.

But be aware of the risks. Something like a Minecraft Server can be made accessible via VPN. If its open to the internet, the damage is rather small, if you don’t value your minecraft world that high. I rather have my Minecraft World deleted, than my personal pictures stolen. When you can open your service only to LAN, you have a lower risk to get it compromised (the risk isn’t zero! It’s never zero. Air gaped systems make it near zero, but not zero.)

When you do open your stuff to the internet, you need to update your software well and configure it well. Stuff like email is a pain to configure. I looked long for a managing software package, which made it easier for me but to leave me freedom. Next important thing is updates. YOU NEED TO UPDATE YOUR STUFF! I do prefer everything with auto updates. I use watchtower for my docker containers, even though it’s not recommended with some containers. What’s currently a big deal breaker for me is PostgreSQL. I threw out containers and avoided containers requiring it, as it needs manual interaction. For work I actually need to migrate from MariaDB to PostgreSQL for our chat system. At least they do use the LTS version, so you aren’t constantly needing to manually update.

As for the hardware, it highly depends on what do you need. A rented server (a VPS or a dedicated Server) does have the advantage to be easily in the internet and on the same note, this is a disadvantage. For email and websites this is good but you need to be very careful. You can start with a Raspberry Pi. Home Assistant does run on it and they do offer some apps, like AdGuard Home, Bookstack and Vaultwarden. You can also start with a NAS. I run my stuff on my Synology NAS, a DS920+. It has Docker. But you may want to look into a different company, as Synology did some bad stuff, that makes me them not recommending it anymore. I did heard Ugreen should be good. Obviously you could always go bigger and build your own NAS and using truenas or something else. You can also start with a MiniPC and use Proxmox.

For the operating system, I think the best thing is what floats your boat. I do use Ubuntu. Why? Because I like it. Using Containers is a big recommendation from me. With Proxmox you have VMs and LXC containers, which allows you to experiment within a container and separate stuff. You can throw it away easier, without disturbing other stuff, that is working.

I really would recommend to start small and keeping an eye on risk. Start in your local network and with stuff that isn’t big risk. If you stark taking more risks, don’t go full in in the beginning. If for example you hosts your own file cloud or email, don’t abandon your previous provider and start small, with unimportant stuff.

Now to myself: I have running a rented server, a Pi, a Synology NAS and a mini PC.

I did start with a VPS. Very hard and I made quite a few mistakes. the authorities twice called me out for stupid mistakes. It was the fun days, where I actually thought running a Windows Server in the Internet was a smart idea. I did run a webserver and email from them for quite some time. I even had a Skype Music Bot running without issues. What the authorities didn’t like where my attempts with the DNS Server and my MSSQL Server. Now my rented server is running my mail and webserver (with Nextcloud) and if I feel fancy, a game server. I don’t utilize it as I could and in the near future, I do want to switch things up but I need to keep my mail running.

My Synology NAS is the big stuff. It has my data on it and runs most my docker stuff. There I run audiobookshelf, calibre-web, gitea, jellyfin and paperless-ngx for my main stuff.

My Raspberry Pi 5 is running HomeAssistant to control my smart home stuff and a new addition is Music Assistant.

My mini PC is running Proxmox with Frigate. Frigate is a NVR for your cctv. Not that I have a big cctv system.

Technically I did start earlier with a Minecraft Server and a Teamspeak server, running from my own PC but that has the big downside, that you need to keep your PC running.

Private I use Nextcloud + Betterbird (Thunderbird Softfork (stays compatible with the matching esr version)) + DAVx5 for Android.

At work we use an old web calendar in php5, as this is the only calendar we found that has a side by side view. Each coworker has his own calendar and in the 4 week view, each is displayed side by side. We didn’t found any replacement with that kind of view. Also we use the categories very strict. Each entry need a category, the admin defines the categories and it shows icons for it. Nextcloud even introduced categories a few years ago and still doesn’t have the option to define ones and delete default ones. You can add own categories on the fly, but this is so bad in design, as everyone needs discipline, which doesn’t happen.

Also they aren’t rated to get screamed at: https://www.youtube.com/watch?v=tDacjrSCeq4

I once thought the same. Started with 3TB usable storage. Now my NAS has 21TB usable storage and it has less than 3TB free space available. Alone my Jellyfin Media uses 7.7TB. Another big factor is my retro game collection. Once you realize what you can do, you use more and more storage.

I don’t miss any breaches (I inform myself with other news portals) and the most recent one with 2 billion is included but no actual account. Of course some of the addresses the spammers guessed for my domain could be in a breach that I don’t know of but I don’t care. Just guessing email addresses is not hard for a catch all address.

They want money? I have 2 domains registered and I’m currently at 10 breaches (9 on one and 1 on the other (my serious domain)).

The thing is, the stuff is bloated anyways. Aliases as “webmaster80@”, “webmaster13@”, “webmaster01@”, “2webmaster@” I never used. Even the “webmaster@” I only posted as contact mail but never used myself. There are 13 breaches across 6 aliases, that I never used. With Synthient Credential Stuffing 4 got added.

Spammers do roll a ton of addresses with that one domain. I even let AI wrote a ps script, so I can easily add an alias to my spam mailbox, which rejects any mail and deletes them instantly.

They should clarify it. If these 3 points are just offering an easier way to do it, then fine. If they block these features in general when you want to manage it yourself, then screw it. I had one self hosted software, which blocked remote access even when you use your own reverse proxy. At least it was a one time payment.

Databases are not the issue but that the updater doesn’t handle it… My personal instance and our work instance never take long (a few seconds) to fix the database. I mean the instance is already in maintenance mode and adding a checkbox to do it or not to do it, should be simple. I don’t know if there are instances where it takes long and its better to do it during the night.

I do have both (VPN and Reverse Proxy) running. For VPN my router uses Wireguard and at work we use Wireguard as well. You can alter the config in such a way, that only internal traffic would get routed through your VPN. I love this, because for regular traffic, I’m not bound to the upload at my home network or with work, route my personal traffic through the company internet or lose access to my own network.

Reverse proxy isn’t bad either. I have a DNS running at home, that redirects my domain used for home stuff, directly to the reverse proxy. This way I can block certain stuff, I want a fancy domain but not be accessed from the outside, because its not needed or not set up properly.

With a VPN, you would be more secure, because its a single instance you need to keep safe. With regular updates and set up properly, this shouldn’t be an issue. But I would suggest reading tech news portals, that do cover security breaches of well known software.

With a reverse proxy setup I use, I must trust so many things. I must trust my reverse proxy with the firewall and then each server I run.

But keep one thing in mind. If you for example use stuff like Home Assistant, that you access in the background, it wouldn’t work if you connect via a VPN. With Wireguard I can be connected 24/7 to my VPN, even at home. With the previous VPN my router used (I guess it was OpenVPN), this wasn’t possible.

A coworker uses it as backup and he is happy about it. I have rented an auction server (a dedicated server) from them and on it is my Nextcloud and stuff and I backup my NAS to my Nextcloud and my Server to my NAS via WebDAV. Zero issues. I had once contact with their technical support, because a Harddrive failed. I was a low priority case but they handled my case exceptionally fast. Opened the ticket on a Friday after a holiday on 23:09 and at 23:51 the hard drive was changed.

My passiv cooled Pi5 (case as radiator) with HA is at 44°C (room is at 33°C). Idk how hot it gets on a regular basis, I just enabled the system monitor integration right now.

I mean with CPU temps, thermal throttling starts usually at 80°C, so nothing to worry.

Images are just bytes. Just encode an image via base64 and now you can send it via text. People will find ways.

To be more specific: Postgresql requires manual steps with major versions. Tutorials I found require you to dump the database in the old version first, then update and then import. You could use a tagged version of postgresql and just auto update there but the main container might require a newer version. I saw containers who try this but none looked production ready.

Yeah I expected that this would happen. They already did this with RAM. They just rebrand RAM, sell it for a way higher price and add a check. When they brought their own branded HDDs, I knew they will pull of the same scam.

Building an own server isn’t that more expensive and you don’t have to deal with the whole lockout with Synology. For example I had quite the issue to access hardware. I wasn’t able to get Home Assistant running on my NAS. The issue was my Zigbee USB Stick. I got it running to the point where I was able to send commands (e.g. turn on or off lights) but the status didn’t came back. I threw it on my Pi3 (now Pi5) and zero issues.

The next NAS is self build. Probably Proxmox as base, with truenas or so as main server and the rest depends on what I might need.

Auto updates can cause problems. Some recommend it, some tell you to not do it. My standpoint is, when a container can’t work with auto updates, they suck. Sure there are containers who require some additional attention after an update, like gitea with some config changes but I use it in an environment where it can be offline of some time.

If a container uses Postgresql, you can’t auto update. So far I didn’t found a well maintained container, that can do this. You also should keep an eye on your containers. As I mentioned, Gitea had some config changes, breaking the default theme (nothing major). They even screwed up their tags and I had 3 times an RC in a tag where no RC should get published. With Jellyfin I was on a tag that didn’t got any updates anymore and I needed to use a different one.

I don’t think there are people attempting to log into HA, because it has zero value to them. HA would log failed login attempts but not bots trying other stuff. When I look into my web statistics for my rented server for march with 404 errors, I got over 750 and they try to access wordpress, find old (and probably not updated) stuff and some config files, like .env files. This kinda makes sense and probably would find everybody in their access logs. Its just automated stuff and they probably run auto exploits. Wordpress sites are interesting and its worth just getting access to a kinda serious email sender or just other stuff. My ssh blocklist currently has 14000 banned IPs. Might not sure how I set it up, but it looks I picked 1 year ban time.

If you know where to look, you would see bots trying to enter your system but you would see they aim big, not small. HA is small. Sure if HA has a serious hole, you would get attacks from pranksters. Still is always a good idea to have proper security procedures for all of your accounts and servers. Most interesting are targets where they could find value within these services or using the hardware but there are always people who just want to mess with someone. There are for example people who search the internet for Minecraft servers, that they can grieve the shit out of it. Doesn’t matter if its a big professional server or just a server from 2 kiddos, that play together after school.

Auto update. Works like a charm, except PostgreSQL. For me it’s good enough and even though works with containers, where they don’t recommend it. I do have backups and for my private time, I don’t get paid, so it should be as maintenance as possible from my side.

I do check from time to time if something is broken and I noticed a container where they removed a version tag, I was using. The “biggest” thing that was broken, was my gitea server where they changed the config for the default Theme.

Also that’s why I hate PostgreSQL. It requires manual labor for updating. Had a recipe Docker and they cut support for previous major version quickly. Not good. That stuff could break, ist an option with every update. This is why backups exist. As a single user, it’s not a problem. For a big system, I wouldn’t do auto updates, so I can check if everything works.

Not Nextcloud. livesync is better. Requires CouchDB (Docker available) but with that, its a powerful sync option. Even Settings can be synced

Docker is amazing but not needed. You can compare it to a simpler VM. You can take a docker and run it on any machine. You have an environment that is separate from your host and you and the container can only access it via defined points (volumes and ports).

Imagine you need to run a 2nd Mumble Server. I never set on up but its often that a 2nd instance is not that easy. With docker its easy. The only difference is that you need to use different ports, when you have only one network access or you use a reverse proxy. You can create a 2nd instance to test stuff, without interrupting your productive system. Its a security benefit, because its isolated to some degree and you can remove one easily.

I started using it with MSSQL Server, because I hated how invasive it is on a windows machine, especially I just needed it temporarily to do stuff with it. I’m not a microsoft admin and I know that Servers from Microsoft are a different level. Docker allowed me to start and stop it and remove it very easily. After that I started using it for a lot of and brought my NAS on the next level.

Also one thing worth mentioning are Linux Containerx (LXC). They are in Proxmox but I have less knowledge. It feels more like a full VM than docker but uses less resources. This is the reason why containers in general are more popular. They are less resource hungry than a full VM but have some benefits than running everything on one machine. LXC feels more like a full system, than docker. With docker you rarely get into the system. You may execute some commands, like a create user command or a one time job but don’t access it via a shell from the inside (its possible). LXC on the other hand, you use the shell.

Then use a dummy public repo. You don’t get the nice integration. We used Mantis Bugtracker at work for quite some time but switched to Gitea (a selfhosted Github clone) and are trying to get our testers to use it more.

Also you should keep one thing in mind: needing an additional account, might stop people to use it. With Github I contribute for even smaller ideas. When I need to make an account first, I wont do it. Or when they want to use Discord. I do have Discord but come on…