Also at @me@social.k3can.us on Mastodon.
It’s been a long time since Pi’s were competitive on price.
You can get a used Lenovo Thinkcentre for $50 on eBay. A modern pi is going to cost you that much for just the board, then you still need to buy a case, power supply, SD card, and then figure out some solution for storage…
No reason to bother with a Pi unless you need the GPIO for something. You can do more with a Lenovo Tiny or SFF Dell.
Host? As in running services?
Wireguard and the Proxmox Backup Server software itself. Redundancy/failover comes from the server cluster itself, not my backup server.
As far as the backup content, it “hosts” backup images of my VMs and LXCs, plus /home from my laptop in case it ever gets lost or damaged.
I tried a bunch, zoneminder, motioneye, frigate, etc., before finally settling in AgentDVR. It offers a fair bit of flexibility via MQTT and “just worked” with my PTZ camera.
You’re not a “target” as much as you are “a thing that exists.” These aren’t targeted attacks.
That said, you can look into adding some additional measures to your webserver if you haven’t already, like dropping connections if a client requests a location they shouldn’t, like trying to access /admin, /…/…, /.env, and so on.
On nginx, it could be something like:
location ^/\.|)/admin|/login {
return 444;
}
Self hosted from my homelab on an nginx server. I also self host my blog, which has some info on my whole set up. My blog uses some basic bloging software, though, rather than being hand-made.
The “side menu thingy” is achieved through HTML “frames”. It’s an element of HTML that’s pretty much extinct nowadays, but was all the rage when I built my very first page back in the day.
Nice. I wrote mine “by hand”, too. No CSS, just raw HTML. I think it’s a more personal experience than just using whatever random template some all-in-one web hosting company offers.
A lot of how you set up your system is just going to depend on how you want to set it up.
I run podman (like an improved version of docker) in a single LXC container for applications that are primarily packaged as docker apps. I think I have 4 or 5 applications running on that LXC.
For things that are distributed via apt, git repo, etc, I’ll either create a new LXC or use an existing LXC if it’s related to other services I’m running. For example, crowdsec is run in the same machine as nginx since those two work together and I’ll always want them both running at the same time, so there’s no reason to separate them.
I have mariadb running in its own LXC so that it can follow a different (more frequent) backup schedule than the mostly static applications that interact with it.
Anything that needs to interact directly with hardware, like Home Assistant, or I want kernel separation for, will get a full fledge VM instead of a container.
It’s all about how you want to use it.
I use podman almost exclusively at this point. I like having the rootless containers and secrets management. If you’re on Debian, though, I strongly suggest pulling podman from Trixie. The version in Bookworm is very out of date and there’s been a lot of fixes since then.
I’ve also been running nginx in an unprivileged LXC container. I haven’t used fail2ban, specifically, but crowdsec has been working without issue.
You can mostly just treat an LXC like a normal VM.
I do occasional smaller “takeouts” and haven’t had any issues.
I have an “automatic album” (or whatever they call it) where all the photos of friends and family (even pets) get automatically added to it. Then I can just request a “takeout” for that one album, since those are the photos I actually care about. It’s a much smaller download than the entirety of my Photos account.
I have a couple Libre Office files where I document the non-technical stuff for my own quick reference, like network layout in Draw, or IP and port assignments in Calc. I use a git repo to store and organize podman scripts, systemd unit files, configs, etc. Probably not the most elegant solution, but it’s simple and FOSS.
Reverse proxy is Nginx Proxy Manager.
This might be a good start: https://github.com/ecdye/zram-config
Another option would be to redirect logs to a ramdisk. That’s what I’m doing on a RPI to try to minimize writes on the sd card. The biggest downside is that you lose your logs when you power off the device, but if the alternative is not having logs at all, I think it’s still a better option.
Of course, installing a proper drive is still the best solution.
There are some tools to help, but things are sort of specific to particular aspects. Lynis for general systems, ntopng for networks, and such.
For 90% of stuff, though, you can just stick to stable repos and upgrade on a schedule and you’ll be alright.