How do you actually self-host securely?

6 points by pralkarz

I recognize that the title is rather vague, but I'm completely green when it comes to self-hosting, so I figured here would be a good place to ask for some pointers given the discussions I sometimes see happening in the comments. I tried researching first through DDG and Google, but (and I recognize this might be a skill issue) most things I found are either SEO slop or trying to sell/market some service.

For some more context and to give a concrete example as to what I'm interested in, I got my hands on a Raspberry Pi which I'd like to use to start tinkering with self-hosting. My main goal would be to host my (static) website on it, potentially adding more things in the future.

Some people I asked this question recommended solutions like Cloudflare Tunnels to make it secure, but using such a provider almost feels like it defeats the point of self-hosting, so I'm curious whether it's viable to do it using open source tooling, any gotchas one might encounter, and generally any thoughts you might have on the topic.

(Also, feel free to suggest a tag other than devops, I figured security doesn't quite apply since it's a question and not a write-up/resource regarding security.)

tuxes

It's safer to start with services that aren't public facing, e.g. install Tailscale on your phone, laptop, and Raspberry Pi, and then start setting up services you want for yourself.

Some people I asked this question recommended solutions like Cloudflare Tunnels to make it secure, but using such a provider almost feels like it defeats the point of self-hosting

I like to do the end-to-end myself but sometimes I just can't be bothered and so use Cloudflare Tunnels to make it work, and that's a better outcome for me than giving up entirely.

Hell yea. I love this question.

It sounds like what you may want is "nobody can read my packets but me!" If that's the case I would look at the chain of things.

you need to route traffic to the pi. DNS for translating the hostname to the static ip, and then some way to route on the internal network from the static ip to your pi.
you need a valid key and certificate so the traffic you serve is recognized as secure to other browsers (keys and certs)
you want tls, and to deliberately terminate tls somewhere you control

These three are super intertwined, "self hosting" is choosing which of these you want to own.

My personal favorite setup:

rent a $5/mo box from any provider (anything works - vultr, linode, digital ocean, hetzner)
use your pi to ssh to the box you rent, port forward 443 to your pi.
run acme.sh on whatever is terminating tls (eventually your pi)

I like this setup for a few reasons.

This provides a static IP address you can point DNS records to. It also doesn't disclose where you live. You may or may not care about this. But it also means you spend more time learning about internet and less about fighting port forwarding on home networks.
If your pi can touch the internet at all, it can find your box. this means you can duct tape your pi to a mint mobile hotspot and a solar panel and have your static site served anywhere there's sunshine. I always picture it baking in the sun on the cracked back dash of a 1996 Toyota Camry flying down the highway. I don't know why, it just makes me smile.
Because you're using ssh, there's TLS over TLS. But that really doesn't matter. The point is that nothing between you and a user is visible to anyone but your pi. When you eventually move off of ssh port forwarding to something more stable nothing else changes.
When your initially setting this up and debugging, anything you do on your pi you can do on the $5 box you're renting. It's a touch more stable, and closer to what someone will actually pay you to do some day.

You may end up using nginx or haproxy somewhere to get ports to line up. But you can also use iptables. Dealer's choice.

Tailscale and Cloudflare tunnels are really cool. They take a bit of the headache away, but you're right that they give up that bit of security (and the learning!).

I'm so psyched for you :) let me know how it goes!

vincent-uden

How much you need to care about security is entirely dependent on what you host. I would for example greatly invested in security if I self-hosted a public facing file storage or an email server.

I would in general care much less if as you describe I would be hosting a static website on a Raspberry Pi. The risk just isn't that big. It can't cost you a lot of money since it's your own hardware. The worst thing that could happen is that a stranger gains complete control over your Raspberry Pi. They could possibly probe your local network (but not if you put the Rasberry Pi on a subnet), display other information on your website or put your Rasberry Pi to work on something benefitting them (as part of a botnet or crypto mining for example).

I personally wouldn't consider any of those possibilities as great risks. And as a bonus, setting up logging to detect if any of these were happening could be a fun side project.