Self-Hosted Users Wrestle with Complexity

First of all: many thanks for such a great design! I also bought the enclosure files, great! One of my ESPTimecast clocks sometime shows Wifi xx.xx etc many time every hour. I…

“I know this has been covered many times but I couldn't find an exact match for my situation so here goes. My setup: UniFi network with VLANs: Trusted, IoT, Server, Management, CCTV and Guest Home Assistant running on …”

“Agreed 100%. I do the same thing. All my containers are only accessible internally and if I need to access them externally then I just turn on my Wiregaurd VPN on my phone or MacBook hosted on my UDMP. It’s been working great. Anything that is external facing which is less than a handful is behind a Cloudflare tunnel with 2FA.”

“tailscale's derp relay is a known bottleneck when you're forced onto it, had the same issue trying to stream from my home server over a congested mobile link maybe try wrapping wireguard inside a websocket tunnel, something like wstunnel or udp2raw can make the traffic look like regular https to deep packet inspection, it's what a lot of folks in restrictive countries lean on if you're already comfortable with mullvad's shadowsocks setup you could self-host a shadowsocks-rust”

“Hey everyone! Like many of you here, I host my own VPN infrastructure using Remnawave and VLESS Reality. The hardest part was never the server setup — it was onboarding friends, family, and non-tech users who constantly struggled with copying JSON configs, subscription URLs, and navigating complex open-source clients like v2rayNG or Nekobox. So over the past few months, I built an automated cloud engine that turns a self-hosted panel into a dedicated, custom-branded Android client: - Automated C”

Isn't pangolin also have RDP functionality ? Also could you explain more on relay servers? Thanks

“If the Wifi needs to be up the entire time when office people are there and you need to support QoS for VoIP, video calls and roaming, Unifi as a management plane is not a good choice unless your DR plan is bulletproof. And if this is a WiFi-only facility with 300-450 client station devices all transmitting at once? You'll want a wireless survey done. Even if it's just a personal phone in a pocket and a personal tablet in the backback not on the wifi, it still adds to wireless contention”

“Lotta the time theres assumption if you're using other tooling for running oci containers (k8s, podman, nspawn, etc) you can do what's needed to customize it to your needs, or even just might want to be building your own containers, even if still mostly based off their dockerfile/containerfile. Almost all the homework is already done.”

“Depends, I ensure all things use MFA for start and by default all unsolicited traffic has to come from CF which ensures it has gone through CF firewall, bot protection, IPS. My UniFi firewall drops all non CF sources traffic. Then I have IPS on my UniFi (suricata). Also for websites that have no or poor auth I don’t expose them when on NPM but wil hand rolled nginx or traefik I do Entra auth.”

“makes sense then. if it's living on the ups anyway, nut (network ups tools) can watch the ups over usb and shut the laptop down cleanly before it runs dry, so the containers don't die mid-write”

“Hello Lads and Ladies. I'm fairly new to networking, but I believe I've learned enough of the basics now to feel confident enough to host fulltime. - grabbed micro PC - have it vlan'd from my home network - learned docker engine My current plans are to host private valheim/minecraft servers for people I know (6 players max). However, at some point I want to add teamspeak and other services to people I may trust less. My question: what methods are preferred for best security practices”

“Thanks for the input! To answer your first point: Yes, absolutely. All of the Deco nodes are hardwired to a gigabit switch (Ethernet backhaul). I would never dare to run a wireless mesh in this density, lol. Regarding the 2.4GHz, instead of completely killing it, I actually tried splitting the bands into separate SSIDs to force capable devices onto the 5GHz one. But strangely, even when trying to connect specifically to the 5GHz SSID, some devices still struggled to connect or randomly got kicke”

Yeah i agree. don't know what i was thinking. updated the post.

Yeah i guess I'll update the post

“For everyone who is concerned about security: UnrealIRCd has strict anti-flood settings configured to protect against JOIN, KNOCK, nick changes, connection flood, etc. On the other hand, the only port I expose on my router is TCP 6697, using a Let's Encrypt certificate. The bots connect to the server through the local IP using the services port, just like Anope, which is not exposed to the Internet. For the radio and webchat, I expose ports 80 and 443 through Caddy. I use unprivileged user a”

“the "diode" Depending on why you want/need an airgapped environment, this feels like quite a risky thing to pull off. How does this work, is it a hardened bastion host that only accepts incoming connections and only on certain ports from certain hosts? Or is there more to it than that”

“I have a lot of experience in this very thing. How air-gapped is your network? We have a solution that allows some traffic in a very specific way to get where it needs to go. In a truly air gapped env, what you can do is use WSUS still. You will manually need to copy new patch data over to your air gapped space. So that might be a hard drive or a USB drive. You need to copy the patch data to a folder and point your WSUS to that folder. You also need to do an wsusutil.exe export metadata.xml.gz a”

“Hi everyone! A little while ago, I decided to set up my own IRC server using a mini PC I had lying around at home (i7, 16 GB RAM). What started as a small project has grown quite a bit. The IRC server is running on UnrealIRCd, and since I thought that wasn’t quite enough, I also programmed my own moderation bot to deal with offensive nicknames and words in channels. I also created a TriviaBot with more than 1,000 trivia questions, a streaming radio station, and an IRC webchat using The Lounge. E”

I use it with openrouter and it's great

“I've got like 4 flying saucers, a Unifi 24 PoE switch and Unifi cloud gateway ultra. After setting up my wifis, vlans etc it's been set and forget. I also run Unifi for some family member sites as easier to remote manage in the rare instance I need to do something. One includes their LoCo wireless bridge to bring network to horse stables 700m away.”

“Funny, a lot of people seem to run Unifi networks with a third-party gateway. I don't have any experience with Unifi, but it's the exact same thing with Omada (the poor man's Unifi from TP-Link). Their gateways also suck hard, so I run Omada networks with Mikrotik, OPNsense or OpenWRT gateways.”

“I can't speak to the security issues but I really like the new Unifi firewall config now that it has changed to a zone based firewall. Much easier to grasp and configure compared to what I think you are referring to in its recent past. I had multiple zones for my home, guests, homelab & Aribnb guests locked down pretty tight in no time. I wanted to use Opensense but I needed a 'ready to go' gateway/firewall right away for our new home and I've been happy with my Unifi DR7. I”

“For me its mostly an ethical thing, unifi strongly pushes their echosystem/walled garden which is something disgusting for me, so i opted for opnsense.”

“unifi is nice for internal network, but I like opnsense more for the router/firewall part.”

“Same here for the most part, I still have switched that are old Aruba because they work and show no signs of dying.”

“Unifi is what I have now. Documentation is not great. I had to test and retest settings to validate that the rules work the way I expect. I loved pfsense management. Things made sense documentation was accurate. There was a reverse proxy, Radius service, SIEM export was easy, IPS/IDS built in with no extra costs for accurate SPIN for geofencing and app marking. Shit even the logs just made sense. I guess what I get from the unifi gateway is a single pane of glass.”

“I’m looking at replacing and expanding some of my network gear, router being the first one. I feel like it’s a Linux vs Apple type thing, do I go with the “open, do what you want, but be prepared to figure it out the hard way” option or the “it just works” option? Obviously the former is more aligned with self hosting, but there’s a threshold for critical infrastructure where I’d rather just trust someone else to have done it right. submitted by /u/chazwhiz [link] [comments]”

“Is this what you run at home strictly for private or are you also using this for business. Looks good but a bit overkill.”

“I run OPNsense bare metal but lots of people have no issues virtualizing it.”

“I have a router already from my ISP, however I was looking for a new one for a separate set of devices. I was considering the UCG fibre however, if I wanted more granular control UnifiOS could be a limiting factor in the future. It’s also just expensive. Is it fine to just run an OPNense in a VM on my proxmox server for my routing instead? Has anyone been running this setup reliably enough? I’ll probably get a better NIC later on, I have 2 Ethernet ports on the server already. The router from my”

“exactly, if you already live in chat all day the MCP route just removes a whole server from your life. one less thing to babysit at 2am.”

“As I said, there are pros and cons to all of these approaches. For me, I need to provide access to clients that won't install tailscale, or any other VPN client. The tech hurdle is too high for some users or the client doesn't support it. There are multiple ways to solve this with different tradeoffs. OP should be aware of what those options are, and then choose based on their needs.”

“Single server WireGuard setup is as easy as cake. It is possible to do multi-hop between ones own boxes, but the routing config and key management gets tedious rather quickly”

“You don't need tagged VLANs unless you want a device with a single Ethernet network interface and a single Ethernet cable to be able to join 2+ different subnets VLANs do so much more than that, plus what you describe is more a routing problem .”

“Great timing, I finally got everything setup on my systems with Portainer. I'm bleeding edge apparently.”

“Haven't decided anything yet, so hoping for some actual opinions and real world usage here. Quick context on the setup first: BV01 - this is the main site and does most of the actual work: servers/VMs, a couple of production segments, cameras, internal ops stuff, guest wifi, the works. This is also the one that needs real 10Gbps, since that's where traffic to my servers actually lives. This one also hosts public facing servers, both for my personal usage (*arr stuff etc) and actual busin”

I wouldn't want to expose any ports to the internet; I currently access everything via Tailscale or a tunnel. It really seems to be the case; I'll look into how to implement…

“I wouldn't want to expose any ports to the internet; I currently access everything via Tailscale or a tunnel.”

“Been doing this about 8 years and something's shifted. Used to be everyone here could explain what their nginx.conf did, or why fail2ban wasn't catching a jail. You learned iptables by breaking your own box at 2am, alone, with no one to blame. Now most threads are "which panel is easiest." Nobody wants the shell open longer than it takes to run one install command. I get why. Panels save time. I've got BeAdmin running on one box for the VPN modules. But I see people arguing”

“Is there anything better than UFW-Docker at the server level for securing container ports? submitted by /u/CandyBoyCzech [link] [comments]”

“I will admit I wasn't sure what the point of the layer4 was, but if I remember correctly it wasn't working without it. Would I just point it to the two ports for the 2 services I'm running by changing upstream localhost:6443 to upstream localhost:8096 / localhost:4533? Or do you think I even need it considering I haven't been using it thus far? Good point, I don't believe that is the case but will double check. Where would I put those headers in the Caddyfile?”

“What exactly is the problem with UniFi? I’ve always thought Ubiquiti gear is generally pretty good. At least a better option than e.g. Cisco for the home/small business customer.”

“I guess more advanced networking has a bit of a barrier of entry but it's really the basis of everything you can selfhost. Adding a firewall and vlans to your setup will do a lot for security so I'd say it is worth learning beyond "how do I open a port so that my app works".”

“New to the whole self hosting for a few months now, and got my first electric shutdown this week. Well realised that it could all come crashing down in case of a bad restart or corrupted data so thinking of adding a UPS to protect the install My issue, I don't know anything about it... So if anyone got good recommendations I'm all ears ! Thanks submitted by /u/Bisarka02 [link] [comments]”

“I think as soon as the unifi router loses connection to the internet, unifi cloud sends a message to my unifi app telling me that me router has lost connection. So yeah it's from their side. I think most more advanced models have this feature.”

“I just have DNS entries configured in my unifi router. Mostly CNAMEs to dhcp hostnames.”

“Can you host your own stuff? I work on a fully open source project called OpenZiti. It's ... more than a VPN, it's a zero trust overlay network so some people find it a bit more complex because it's a security product moreso than a quick VPN. It's got different things to learn but with modern LLMs they can walk you through the whole setup in no time. It has a UI you can use too. If you want to give that a go you could. I'd be happy to help if you end up getting stuck (but aga”

“Honestly for a regular person it's mostly overkill. I run a couple VPS boxes for other stuff and single-hop WireGuard is plenty. Multi-hop just adds latency and another thing to babysit. The annoying part nobody mentions is keeping configs in sync when you rotate keys or rebuild a box. If you're not doing anything specific, save yourself the hassle.”

“You seem to be mixing up two different use-cases. If I want to get into my network while I'm out and about, selfhosted Wireguard or similar is the best option. If I want to get out from my network and I want to try and obscure my identity or geolocate to a new locale, then I'll rent from a provider. What exactly are you trying to accomplish here?”

“Definitely am one of those in the quiet "eh" majority/minority I don't expose any ports on my router, I keep my containers up to date, and I YOLO the rest of my shit. I only run the basic-ass Jellyfin/Arr/Whatever run-of-the-mill stuff that most everyone else does, and I learn along the way and hope that the smarty pants in this subreddit can give more wisdow beyond the normie level self-hosting knowledge I have”

“That would be my first "resort". Work equipment is strictly for work use, personal equipment is strictly for personal use.”

There's no need

“You can roll your own wg as people have said. Routers support it out of the box these days like ubiquiti and mikrotik to act as the main concentrator. Tailscale is nice though”

“Don’t know enough to critique the setup… but CTRoadmap would be a good option ..selfhosted diagram / documentation tool.”

“I assumed you were already self hosting these on some computer? Unless you have a single laptop you host and work on? Not really sure what you mean by WiFi recharge? Some non-US thing? If you know you are behind CGNAT, then either pay or it would be a similar process as your VPS idea anyway to tunnel into your home network.”

“I get your point, but it's not cheap 🥀. I have a laptop. In which I host the stuff I host, I got that after collecting money for many years... I respect your point and I agree with your perspective but it's not cheap for me.”

“Yea then dont mix the networks, of you proceed setup different vlans for each domain. Not a great idea, you're adding complexity and merging all 3 branches under a single point of failure and adding latency for all AD traffic and file sharing. GPO processing will take longer so sign-ins will be delayed by a varying amount depending on how many and what you have configured. Anytime I did something similar at an MSP they always complain that the "new system is slower" . A better proj”

“I'm talking about vxlans, which is literally 3 clicks in the UI, not VLANs. And when you see the diagrams some people post here, not everyone is "just hosting nextcloud and small dockers"...”

“I’ve been experimenting a lot, 3D printing a lot, trying different speakers, trying linux vs esphome. I’d like to offer a point in time snapshot that is fairly easy to make, and works pretty well including both mic’s and…”