• 0 Posts
  • 14 Comments
Joined 3 months ago
cake
Cake day: September 26th, 2024

help-circle




  • Like others said, self signed or internal only domains work. Really though for the minimal cost of generally less than $20/year you can make it a lot easier by just buying a domain.

    From a pure security stance it could be argued that a personally owned CA is more secure than any public one since it’s possible for others to create a trusted cert with a public entity. Cloudflare ends up doing that for any domains you register with them, but that’s really only an issue for things facing the web and using self signed certs will typically cause problems for any pre-compiled client apps you might use.


  • My two main boxes are split to be storage vs compute. The NAS box has a minimal CPU and a pile of 3.5 drives for the low cost storage and they hypervisor has all the CPU and fairly small storage.

    Basically the goal in my setup is all the working data is in one place and the handling in another with various snapshots and RAID mixed in to avoid the risk of “oh shit did I just…?” situations.

    So anything that could be called bulk data gets offloaded to the NAS directly via mounts and any cache/working data is held locally. If your lab space grows to a notable level over time eventually you need to consider disk I/O as part of the design and having the bulk data on another box let’s you effectively trade some network load in for disk load.



  • There is a convenience vs privacy/security line to things that any given individual needs to decide where that lies for themselves. Plenty of people use Facebook and similar because there are a lot of people using it and there is a low bar to entry. Many of these big tech options will let you authenticate via a single click to share creds from another service, the ‘sign into Reddit with your Google account’ simplicity.

    Then there are people like me who self host everything they can. I know exactly where my cloud files are, where my movies are, where my chat messages reside, heck where the Lemmy instance I’m posting this from is, all a few feet away from me. There is a cost to this, not only in actual hardware and electricity but in time and friction in that these systems are not going to have that ease of access that other do.

    The bigger challenge is the bleed-over privacy risk. There’s no reasonable way for to ask the rest of the world not to post pictures or similar side channel disclosures. Short of becoming an outright hermit in the woods there’s always going to be some level of privacy leakage, that’s the part harder to manage.