Hey everyone. This is probably a super noob question, but I’m very much just an amateur when it comes to self-hosting.
I host several services that I access locally through 192.whatever:####, and when I occasionally need remote access, I use Tailscale and access through 100.whatever: ####. The duplicate bookmarks is mildly annoying though.
Can I just buy a personal domain, and have all my services be coolname.com:#### for both local and Tailscale access? Is that as simple a process as I want it to be?
Edit: I appreciate all the comments and I’ll probably just use Tailacale’s MagicDNS for simplicity, but one or my (unwritten, my bad) goals was to have one URL that works locally and remotely, regardless of Tailscale. I don’t leave Tailscale constantly connected because it overheats my phone (which already has terrible battery life).
Tl:dr:
Of the services I run I only have a few things exposed directly to the WAN, one comes from my LAN but redirects it to my VPS which hosts my blog (blog.reannlegge.ca). Fairly sure that is the only service that ordinary people can access from the VPS, and I personally do not remember if anything other than my domain name goes out from my homelab that is not connected to a VPN other than regular internet stuff which uses DoT.
I have a Flint2 with a vanilla install of openWRT and a poop load of vLANs, and a a few VPNs. Before I really got into the lifestyle of homelabing I made the booboo of trusting my ISPs firewall for stuff, fast forward several years when I decided to jump right into the deep end, instead of tip toeing deeper and deeper into homelabbing the first thing I should have done was get the Flint2 but instead I decided to get my first 2 static IP address (from my ISP). I was planning on hosting my own email but I found that this was not the best idea; if I wanted to keep my hair so I only use 1 of the 2 static IPs that my ISP provides at this time, the third static IP is my VPS.
The booboo I made tip toeing into homelabbing was opening my network up on port 22, so now the first thing I do when I connect anything to the internet is change its ssh port turn password authentication off and only use keys, the only things on my network that have port 22 open is my firewall so it can forward bots to my honey pot on its own separate vLAN (10.13.37.0) that I keep separated from everything else, but still you cannot ssh into the firewall without the key and the bot is logged with crowdsec, I am sure if someone join’s one of guest networks they could have port 22 open on there device but it is blocked on the firewall for that vLAN. Everything on my IoT vLAN (10.66.6.0) does not have access out to the WAN, but I can look at it all from anywhere via HomeAssistant on my home lab vLAN (10.0.69.0), feeling real mature setting that one up! Then my personal vLAN (10.42.0.0) and my personal VPN (10.42.69.0) can see everything in my home lab vLAN and the traffic to the LAN uses DoT. The guest vLAN (10.4.20.0 I think) and the kiddo vLAN (10.6.7.0) can only see out, and not see into my other vLANs, through whatever port DoT goes out through I wanna say 863? I think it is either that or just 443. Than I have 1 or 2 other VPNs, I plan to add another soon so I can leave a pi at my fathers place for an off site back up of some things on my LAN encrypted differently than my other off site back up. I have rules set up for web browsing to come in only on 443 rather than 80 if it is not coming in via DoT and it all goes through my pihole set up first. I choose the 10.0.0.0 range rather than the 196.0.0.0 or 172.0.0.0 range for security, it is far more unlikely that I will run across the 10.0.0.0 when on public wifi than the other two making it far easier for me to connect to my wireguard VPN. Security through obscurity and a fair bit of paranoia, and previous experience (do not leave port 22 open kids).
The Flint 2 can do a bunch of wifi and fire wall stuff that my old Apple Airport extreme could do, so now it sits in a closet plugged in with two APs that connect to nothing one quoting yoda “do or do not” and one quoting Obi-won “use the force” my active SSIDs are; NRC Appliance Devision, for my IoT stuff. Canadian Coast Guard Outpost, for my guest SSID (I live in Saskatchewan a landlocked province of Canada). Service Canada Youth Allowance, the kiddo guest wifi. CBSA Amnesty Bin 407, for my personal wifi. I have QR codes on my fridge for the two guest wifi APs. Just for fun my phones hot spot is CSA Orbital Debris Tracker, but it wireguards into my vLAN at home. I have a QR code somewhere in my phone for the other two guest VPNs, if I need them I guess OpenWRT also shares QR codes for the VPNs so I could log into it to share out guest VPN access.
Then you want to know about my email hygiene to prevent bad actors getting in that way? I use a different email address for everything, (service name)_(local slang)(three random numbers)@reannlegge.ca. If something gets spammy I can either bounce the email or silently delete it, or send it to my trash so that I can still see that it came through, if I need to extend the free trial just a little longer I can also just create a new account with a new email I have only done that once or twice. Sure I could continue to use my gmail email with the +function so reannlegge+service@gmail.com to stop spam but that is only stopping one devil while still letting one of the biggest in. While I was still using my ISPs email service I had paid for a year for one of those we will delete you from data broker scam systems but that was years ago before I started using individual email addresses for everything.
Than you want to know about my internet security? I use a pihole system with unbound directed to CIRA, I thought that was plenty secure enough until yesterday when someone informed me about how that still does not stop people from looking into my web traffic so I spent several minutes researching ODoH to find out it did not work with pihole than more researching DoH which again I found out does not work with pihole but than I spent several hours researching and implementing DOT because it does work with pihole. I could have dropped pihole and gone with ODoH, as it supposidly has some ad and tracker blocking but my pihole does so much more than just ad and tracker blocking. I have my pihole tuned up fairly close to a 10 out of 10.
If it is a web service I want to use first I look for a way to self host it, or something similar. Even though I have very high security only the parnoid survive. I have not ridden the bus for well over a decade approaching 2 until yesterday, rather than using the transits app I built my own for watching for buses. Sure the transit system can still track me using the tap card but what is that linked to? An email that is only used for the transit system, so they only know what buses I get on. Yesterday I was so annoyed that I was going to get on the bus and see all the ads along the top but there were none, bus fairs are not that expensive and there is no way that the taxes are going to pay so much to take care of it. Only one thing remains they are selling info to data brokers, which I do not care about because that is how the world works today, they are just not getting much from me.
I used to be a huge Apple fan girl but I have stopped that, if I had the money I would be replacing my ipad with something I could install Debian on. I am looking at replacing my phone with a pixel 10 and installing GrapheneOS on it soon, I was considering waiting for the Motorola phone next year but cost may be a bit much. When I was getting into smart home stuff, it was well before privacy became a goal in my mind so I was fine using AppleHome kit, when there was something I wanted to use that was not compatible with Apple’s walled garden I installed homebridge on one of my pi’s. I had raspberry pis because I was starting to get into security with pihole. The damn finally broke when Trump came into office and threatened to annex Canada I started moving services away from the big US tech and coming to Canada, I was no longer going to use Apple’s services so I went to Proton, but the CEO quickly got down on his knees for Trump so that was a nope for me. I came to Canada and orginally sold an arm and a leg to host my blog and email with HostHero but that relationship soured after a few years so I moved my domain over to easyDNS and there email service offers a wildcard option so I can create random emails on the spot rather than going to the page and setting up a new address. I found an old 2014 Mac mini and installed Debian on it to host my arr stack and Jellyfin on it, it does much better than pi 5 was doing. I had a pi 4 that I installed HAOS on got ride of AppleHome Kit entirely excluding 2 homepod minis, I am looking for something good to replace them with. I am hoping to get a hand me down Mac mini in a few days so I can install Debian and have a useable media centre PC currently I have a pi 5 and it doesn’t do to good with it.
I used to “just google it” but than Trump made his threats and I switched to ecosia, which I know is just Bing with a pretty mission statement but it was hosted out of the EU somewhere. As I got more comfortable with self hosting I switched to searXNG which I have setup to pull info ftom Bing, wikiepedia, and a few other engines I know it is still Bing without the pretty mission statement, but it also comes with no tracking!
So I play it safe on the internet!
Feeling safe on the internet is the first step of beeng fried from the Internet.
So you should add a part about Backups…
Well yes I have backups I wish I could say I follow the 3-2-1 rule but I am following more of a 2-2-1 rule for things that cannot be recovered if lost. My aim is to have a 2-2-2 setup next week hopefully.
@Reannlegge @selfhosted Truly, an epic post. Lots of good ideas here! You reminded me of a few things I’ve overlooked. I’m in the process of subnetting and VLANs and all the rest. It’s making my IoT devices crazy but eventually things will settle down. One thing you didn’t mention was printers. I am super paranoid about them. A few years ago somebody zombied mine and used it to attack my other devices from the inside! I eventually won that battle. Now I just leave the printer off and disconnected from the network unless I am going to print or scan something right then. You also didn’t mention Bluetooth. Last time I did a scan for devices it found over 200, all but a handful not mine. Anyway, thanks for posting. <<Hold the door!>>