• 1 Post
  • 18 Comments
Joined 2 years ago
Cake day: June 14th, 2023
  • a_fancy_kiwi@lemmy.worldOPtoSelfhosted@lemmy.world•How do you handle SSL certs and internet access in your setup?English
    2·
    7 hours ago

    A few reasons

    1. My partner has plenty of hobbies but sys-admin isn’t one of them. I know I’ll show them how to turn off wireguard to troubleshoot why “the internet isn’t working” but eventually they would forget. Shit happens, sometimes servers go down and sometimes turning off wireguard would allow the internet to work lol
    2. I’m a worrier. If there was an emergency, my partner needed to access the internet but couldn’t because my DNS server went down, my wireguard server went down, my ISP shit the bed, our home power went out, etc., and they forgot about the VPN, I’d feel terrible.
    3. I was a little too ambitious when I first got into self hosting. I set up services and shared them before I was ready and ended up resetting them constantly for various reasons. For example, my Plex server is on it’s 12th iteration. My partner is understandably weary to try stuff I’ve set up. I’m at a point where I don’t introduce them to a service I set up unless accessing it is no different than using an app (like the Homeassistant app) or visiting a website. That intermediary step of ensuring the VPN is on and functional before accessing the service is more than I’d prefer to ask of them

    Telling my partner to visit a website seems easy, they visit websites every day, but they don’t use a VPN everyday and they don’t care to.

  • a_fancy_kiwi@lemmy.worldOPtoSelfhosted@lemmy.world•How do you handle SSL certs and internet access in your setup?English
    2·
    1 day ago

    That’ll be my impetus to learn how to write a script.

    This part caught my eye. You were able to do all that other stuff without ever attempting to write a script? That’s surprising and awesome. Assuming you are running everything on a linux server, I feel like a bash script that is run via a cronjob would be your best bet, no need to ssh into the server, just let it do it on it’s own. I haven’t tested any of this but I do have scripts I wrote that do automatic ZFS backups and scrubs; the order should go something like:

    open the terminal on the server and type

    mkdir scripts

    cd scripts

    nano docker-updates.sh

    type something along the lines of this (I’m still learning docker so adjust the commands to your needs)

    #!/bin/bash

cd /path/to/scripts/docker-compose.yml
docker compose pull && docker compose up -d
docker image prune -f

    save the file and then type sudo chmod +x ./docker-updates.sh to make it executable

    and finally set up a cronjob to run the script at specific intervals. type

    crontab -e

    or

    sudo crontab -e (this is if you want to run the script as root but ideally, you just add your user to the docker group so this shouldn’t be needed)

    and at the bottom of the file type this and save, that’s it:

    # runs script at 1am on the first of every month
0 1 1 * * /path/to/scripts/docker-updates.sh

    this website will help you choose a different interval

    For OS updates you basically do the same thing except the script would look something like: (I forget if you need to type “sudo” or not; it’s running as root so I don’t think you need it but maybe try it with sudo in front of both "apt"s if it’s not working. Also use whatever package manager you have if you aren’t using apt)

    while in the scripts folder you created earlier

    nano os-updates.sh

    #!/bin/bash

apt update -y && apt upgrade -y
reboot now

    save and don’t forget to make it exectuable

    then use

    sudo crontab -e (because you’ll need root privileges to update. this will run the script as root without requiring you to input your password)

    # runs script at 12am on the first of every month
0 0 1 * * /path/to/scripts/os-updates.sh
  • a_fancy_kiwi@lemmy.worldOPtoSelfhosted@lemmy.world•How do you handle SSL certs and internet access in your setup?English
    2·
    1 day ago

    I’ve run into a weird issue where on my phone, tailscale will disconnect and refuse to reconnect for a seemingly random amount of time but usually less than hour. It doesn’t happen often but it is often enough that I’ve started to notice. I’m not sure if it’s a network issue or app issue but during that time, I can’t connect to my services. All that to say, my tolerance for that is higher than my partner’s; the first time something didn’t work, they would stop using it lol

  • a_fancy_kiwi@lemmy.worldOPtoSelfhosted@lemmy.world•How do you handle SSL certs and internet access in your setup?English
    1·
    1 day ago

    You don’t even have to worry about setting up SSL on every individual service

    I probably need to look into it more but since traefik is the reverse proxy, doesn’t it just get one ssl cert for a domain that all the other services use? I think that’s how my current nginx proxy is set up; one cert configured to work with the main domain and a couple subdomains. If I want to add a subdomain, if I remember correctly, I just add it to the config, restart the containers, and certbot gets a new cert for all the domains

  • a_fancy_kiwi@lemmy.worldOPtoSelfhosted@lemmy.world•How do you handle SSL certs and internet access in your setup?English
    2·
    2 days ago

    wildcard let’s encrypt cert

    I know what “wildcard” and “let’s encrypt cert” are separately but not together. What’s going on with that?

    How do you have your tailscale stuff working with ssl? And why did you set up ssl if you were accessing via tailscale anyway? I’m not grilling you here, just interested.

    I know enough about security to know that I don’t know enough to secure against much anything

    I feel that. I keep meaning to set up something like nagios for monitoring and just haven’t gotten around to it yet.

  • a_fancy_kiwi@lemmy.worldOPtoSelfhosted@lemmy.world•How do you handle SSL certs and internet access in your setup?English
    2·
    2 days ago

    So far, I’ve played around with reverse proxies and ssl certs and the easiest method I’ve found so far was docker. Just haven’t put anything in production yet. If you don’t know how to use docker, learn, it’s so worth it.

    Here is the tutorial I used and the note I left for myself. You’ll need a domain to play around with. Once you figure out how to get NGINX and certbot set up, replacing the helloworld container with a different one is relatively straight forward.

    DO NOT FORGET, you must give certbot read write permissions in the docker-compose.yml file which isn't shown in this tutorial
-----EXAMPLE, NOT PRODUCTION CODE----

    nginx:
        container_name: nginx
        restart: unless-stopped
        image: nginx
        depends_on:
            - helloworld
        ports:
            - 80:80
            - 443:443
        volumes:
            - ./nginx/nginx.conf:/etc/nginx/nginx.conf
            - ./certbot/conf:/etc/letsencrypt:ro
            - ./certbot/www:/var/www/certbot:ro

    certbot:
      image: certbot/certbot
      container_name: certbot
      volumes: 
        - ./certbot/conf:/etc/letsencrypt:rw
        - ./certbot/www:/var/www/certbot:rw
      command: certonly --webroot -w /var/www/certbot --keep-until-expiring --email *email* -d *domain1* -d *domain2* --agree-tos