I've been doing HomeLab and HomeLab-adjacent things for over 10 years at this point. My first experience in the space was a Raspberry Pi 2 that I used for a few years to run various services such as Pi-Hole, CUPS, and numerous other software. Since then, my lab has had
A slightly less technical post - these are some things I’ve learned from having a HomeLab for over a decade.
Just getting started in my first year of having a homelab running, I really appreciate little insights like these as I am still fairly without direction in the field.
I’d love to hear your thoughts on activitypub and how that may affect personal networking and connectivity in the future, as I see you have your blog tied to your instance, maybe a general guide for some footsteps to follow. Cheers!
Glad I could provide some insight! It’s not something I see talked about too much even on Reddit. Let me know if you have any questions or things I could flesh out more in the article!
I’m still relatively new to ActivityPub and Federated systems in general, though I’ve had my Lemmy and Mastodon instances for 8+ months now I don’t use them as much as I was expecting, sadly. Running your own instance can be very isolating and any content you put directly on your instance probably won’t gain much traction (at least on Mastodon, Lemmy seems to fair a bit better).
It’s one of a handful of blogs that I’ve run over the last couple of years, the other one that’s still online is HomeLab.Blog. I actually meant to run a federated blog platform like WriteFreely, but they don’t have a production docket image, and I saw that Ghost is planning on adding ActivityPub support.
This article might be more appropriate on that blog and an article about my experience with Federated systems might be more on-topic on this one. Oops.
Appreciate the further reading! It’s been a fun rabbit hole and as I see it just keeps going.
Being newer to all this, I’m very hesitant to fully open to the public, especially security wise, as I don’t think too cautious is a thing. What are maybe a few things you had wished you’d known from the start? And pardon me if you have a good read I haven’t gotten to yet 😅
Edit: just read your importance of security post, that’s quite a fright! Thank you for posting of such an incident, it’s invaluable to have mistakes to learn from
Yeah for sure! I like to post about both the positive and negative experiences. I find things like that to be a valuable learning tool.
From a security perspective, it’s important to understand the systems you’ve implemented and test that they are working as expected. I think in that example if I had tested user sign-up sooner I could have caught the configuration issue.
It’s also important to have good observability into your system, both metrics and logs. Metrics to help detect if something weird is happening (increased resource usage could point to ransomware or crypto mining) and logging to track down what happened and see what systems are impacted.
From a technical controls standpoint, it’s good practice to segregate your applications from other systems and control planes like IPMI and switching/routing admin interfaces. It’s also good to try to limit holes in your firewall. In this cluster, I have Cloudflare Tunnels setup so that I don’t have to open ports to access web servers, and I get access to their WAF tooling. You could do something similar with a VPS running WireGuard, CrowdSec, and a reverse proxy.
Just getting started in my first year of having a homelab running, I really appreciate little insights like these as I am still fairly without direction in the field.
I’d love to hear your thoughts on activitypub and how that may affect personal networking and connectivity in the future, as I see you have your blog tied to your instance, maybe a general guide for some footsteps to follow. Cheers!
Glad I could provide some insight! It’s not something I see talked about too much even on Reddit. Let me know if you have any questions or things I could flesh out more in the article!
I’m still relatively new to ActivityPub and Federated systems in general, though I’ve had my Lemmy and Mastodon instances for 8+ months now I don’t use them as much as I was expecting, sadly. Running your own instance can be very isolating and any content you put directly on your instance probably won’t gain much traction (at least on Mastodon, Lemmy seems to fair a bit better).
It’s one of a handful of blogs that I’ve run over the last couple of years, the other one that’s still online is HomeLab.Blog. I actually meant to run a federated blog platform like WriteFreely, but they don’t have a production docket image, and I saw that Ghost is planning on adding ActivityPub support.
This article might be more appropriate on that blog and an article about my experience with Federated systems might be more on-topic on this one. Oops.
Appreciate the further reading! It’s been a fun rabbit hole and as I see it just keeps going.
Being newer to all this, I’m very hesitant to fully open to the public, especially security wise, as I don’t think too cautious is a thing. What are maybe a few things you had wished you’d known from the start? And pardon me if you have a good read I haven’t gotten to yet 😅
Edit: just read your importance of security post, that’s quite a fright! Thank you for posting of such an incident, it’s invaluable to have mistakes to learn from
Yeah for sure! I like to post about both the positive and negative experiences. I find things like that to be a valuable learning tool.
From a security perspective, it’s important to understand the systems you’ve implemented and test that they are working as expected. I think in that example if I had tested user sign-up sooner I could have caught the configuration issue.
It’s also important to have good observability into your system, both metrics and logs. Metrics to help detect if something weird is happening (increased resource usage could point to ransomware or crypto mining) and logging to track down what happened and see what systems are impacted.
From a technical controls standpoint, it’s good practice to segregate your applications from other systems and control planes like IPMI and switching/routing admin interfaces. It’s also good to try to limit holes in your firewall. In this cluster, I have Cloudflare Tunnels setup so that I don’t have to open ports to access web servers, and I get access to their WAF tooling. You could do something similar with a VPS running WireGuard, CrowdSec, and a reverse proxy.