Hey there!
I’m thinking about starting a blog about privacy guides, security, self-hosting, and other shenanigans, just for my own pleasure. I have my own server running Unraid and have been looking at self-hosting Ghost as the blog platform. However, I am wondering how “safe” it is to use one’s own homelab for this. If you have any experience regarding this topic, I would gladly appreciate some tips.
I understand that it’s relatively cheap to get a VPS, and that is always an option, but it is always more fun to self-host on one’s own bare metal! :)
You must log in or register to comment.
I self host a Grav site among other things on a 15 Euro VPS.
Also, I started with Ghost but the fact that they locked up the newsletter side of business to a single provider and were unwilling to rework things at the time made me walk away. Yes, I know you could go code side, and add others, but that was a complicated setup in itself. Grav works perfectly for me.
Static site hosted by someone else for free is the way to go. I wouldn’t invite that sort of pain upon my network.
Fair point
I host mine just like you want to do. Ghost running in a docker container on my homelab, with reverse proxy and domain pointing to it.
Haven’t had any issues so far.
I self host a Wordpress site that mostly acts as my design portfolio.
It’s hosted in a Debian VM on a restricted VLAN with caddy handling SSL certificates. Uptime isn’t a huge concern for me since it’s nothing mission critical. It all sits behind a free Cloudflare proxy which allows for my home IP to be hidden.
I think as far as safety goes, I’m comfortable with this setup.
I self host my own website, blog, and a dozen privacy-friendly alternatives and front-ends to various web sites. I use a dedicated remote server for this, so nothing is on my own bare metal. netcup.de has a variety of VPS options that give you good hardware resources for your money. You can get a VPS with 8 GB of RAM, 4 core CPU, 256 GB disk, and 2.5Gbps network throughput for $6.33 a month (not including initial setup cost). Compared to what Vultr and Akamai offer for the same price, this is a steal. The company is based in Germany, so you have to convert the euro prices to US dollars if you’re in the US. The only thing about netcup.de is that your options for the location of your server are limited. They have one US location and the rest are in Europe. This is not a dealbreaker for me, though. And they guarantee 99% uptime. I’m pleased with their service. If you just want to host your personal services on a more long term basis and don’t care about scaling and deployment turnover, then netcup is great. Akamai, Digital Ocean, and Vultr are more for short term disposable, scalable VPSes or web apps and they have excellent data center availability.
I have hosted a wordpress site on my unraid box before, but ended up moving it to a VPS instead. I ended up moving it primarily because a VPS is just going to have more uptime since I end up tinkering around with my homelab too often. So, any service that I expect other people to use, I often end up moving it to a VPS (mostly wikis for different things). The one exception to that is anything related to media delivery (plex, jellyfin, *arr stack), because I don’t want to make that as publicly accessible and it needs close integration with the storage array in unraid.
Good points here, uptime is a factor I had not taken into consideration. Probably better to get a vps as you say.
No, with these reasons:
- Bandwidth isn’t plenty
- My “uptime” at home isn’t great
- No redundant hardware, even a simple mainboard defect would take a while to replace
I have a VPS for these tasks, and I host a few sites for friends amd family.
Weeeell, there’s a school of though leaning towards the opinion that using VPS is still self-hosting ;)
And it’s a school of thought I happen to agree with. :) But OP specifically called out homelab vs VPS.
I agree, but I understood this question in the context of a homelab.
And for me, a homelab is not the right place for a public website, for the reasons I mentioned.
yes, i have a few Rust framework based sites for mostly personal use
I wonder sometimes if the advice against pointing DNS records to your own residential IP amounts to a big scare. Like you say, if it’s just a static page served on an up to date and minimal web server, there’s less leverage for an attacker to abuse.
I’ve found that ISPs too often block port 80 and 443. Did you luck out with a decent one?
I wonder sometimes if the advice against pointing DNS records to your own residential IP amounts to a big scare. Like you say, if it’s just a static page served on an up to date and minimal web server, there’s less leverage for an attacker to abuse.
That advice is a bit old-fashioned in my opinion. There are many tools nowadays that will get you a very secure setup without much effort:
- Using a reverse proxy with automatic SSL certs like Caddy.
- Sandboxing services with Podman.
- Mitigating DoS attacks by using a WAF such as Bunkerweb.
And of course, besides all these tools, the simplest way of securing public services is to keep them updated.
I’ve found that ISPs too often block port 80 and 443. Did you luck out with a decent one?
Rogers has been my ISP for several years and have no issue receiving HTTP/S traffic. The only issue, like with most providers, is that they block port 25 (SMTP). It’s the only thing keeping me from self-hosting my own email server and have to rely on a VPS.
Yea depends on your website bandwidth/uptime requirements. I use a VPS running nginx and wireguard, and tunnel into that from a VM in my homelab, so no ports are open on my home firewall. nginx drops all random traffic at the VPS that isn’t destined to a preconfigured service, expected traffic is forwarded through the wireguard tunnel to the right VM’s, segregated from the rest of my home network by VLANs. I host a bit of web content where I’m not concerned with bandwidth or uptime really, as well as home assistant, file browser, a few dedicated game servers, etc.
yes: sntx.space, check out the spurce button in the bottom right corner.
I’m building/running it the homebrewed-unconventional route. That is I have just a bit of html/css and other files I want to serve, then I use nix to build that into a usable website and serve it on one of my homelab machines via nginx. That is made available through a VPS running HA-Proxy and its public IP. The Nebula overlay network (VPN) connects the two machines.
Have some stuff on a VPS, some stuff hosted as static pages at Cloudflare, some stuff hosted at home too.
Depends on if 100% uptime is required, if they’re just serving static content, or if they’re in some way related to another service I’m running (I have a couple of BBSes, and the web pages that host the clients and VMs that host the clients run locally).
Though, at this point, anything I’m NOT hosting at home is kinda a “legacy” deployment, and probably will be brought in-house at some point in the future or converted to static-only and put on Cloudflare if there’s some reason I can’t/don’t want to host it at home.
I self host.
I use nginx as a reverse proxy with crowdsec. The backends are nginx and mariadb. Everything is running on Debian VMs or LXCs with apparmor profiles and it’s all isolated to an “untrusted” VLAN.
It’s obviously still “safer” to have someone else host your stuff, like a VPS or Github Pages, etc, but I enjoy selfhosting and I feel like I’ve mitigated most of the risk.
Biggest problem will be BW and latency to your lab from the Internet. I would use dedicated hardware and subnet for it. Security wise, if you can make your site 100% static it will help a lot with security. I’m personally set on AWS S3 + CloudFlare combo with static site generator running in my lab. Yes it is not really “self hosted” but worries free solution for me.
I have a Hugo site hosted on GitHub and I use CloudFlare Pages to put it on my custom domain. You don’t have to use GitHub to host the repo. Except for the cost of the domain, it’s free.
You can do the same with GitLab as another option, it supports custom domains too.
You don’t really need Cloudflare to have your own domain, you can do everything directly with GitHub.
I didn’t know this. Thanks for the info.
I use a VPS and generate static sites using Hugo. Works fine.
I could host it in my network, but I don’t see a point, and I’d really rather not have a power outage or loss of internet break my site (much more likely at home than at a datacenter). I host pretty much everything else within my network though.
