It doesn't have to be this way! Put it on a pi and have fun, if not for your sanity at the very least do it for your second most valuable resource, your time. If all a person wants to do is have a website that plays a piezo buzzer when someone visits on your RPi, just write that damned code, they shouldn't feel the need to worry about all the nitty gritty when all that they wanted to do is have fun!
I think I've heard of some services like that...
If connected on wifi to your router this of course solves the "kick a cable out" problem too, even if the battery is really old you'll almost certainly still have a few minutes.
> Then install unattended-upgrades, put admin panels (phpmyadmin, wp-admin) behind basic authentication
I'd go as far as protecting the directory to only allow access from local network, and use wireguard to reach the machine.
It's likely a server in the corner of the room will cost more than a VPS, certainly in my country. A server drawing 25 Watts cost more than the $3/month I pay. (That said I also have a pihole running on a 1B - my parasitic house load is about 100W for the fridge, router, wifi, etc)
Or, you know, only allow access from the attached hardware and reach the machine the old-fashioned way: By walking.
Regarding costs, it's useful to know the cost of a watt: For my electric rates, the equation runs:
$0.11/Watt-month = $0.162/kWh x 730 hours/month / 1000 kilowatts/watt
(The landlord had installed these sensor-activated ancient bulbs in the hallway, where I pass through to to the cellar / power meter, and I was trying to track down this mysterious 100W that seemed to be always running, without fail. Turns out, it was only running when I was checking the meter! We then did the math with a better runtime estimate and still went out to buy LED bulbs at our earliest convenience. They're brighter than before (we erred on the high side), just as warm light, and use 2.5x less power.)
And yes, in my opinion we erred on the high side, but it's not far off from what the original incandescent (which apparently was 2x50W, measured).
Very true! Battery from like 2015 still manages to keep it running for about two hours I think, which is frankly amazing. I was constantly dealing with taking the battery out of the laptop when not in use (98% of the time, it was connected to a charger, either in a classroom or at home, so I'd need only to bridge the stand-by/suspend/sleep period in the train). At the time, it didn't seem to have an effect as the battery still decreased in capacity, but I gotta say, it is certainly doing a good job since then!
Unfortunately, the external drives are not on uninterruptible power and having two of them in a btrfs mirror caused me more headaches than I like to admit. Even after I figured out which one had the more recent data after going out of sync, I misunderstood the phrasing of the man page and mixed up the arguments for the device to be recovered and the device to recover from. 2/7 would not recommend btrfs on devices without UPS, or if you don't want to shell out the money to buy three instead of two large drives so you can have a 1:1 disk image of the known good device before starting to operate on it (which is what btrfs was supposed to do in the first place, but alas).
> A server drawing 25 Watts costs more than the $3/month I pay.
With the screen and keyboard backlight and such turned off, it should draw less than 25W unless you're actively making use of it (and thus it being worth it), but yes that's ballpark correct.
I also get a lot more value out of it than what I expect to get for $3/month, though :). LAN speed transfers can be nice, no network latency (at least not beyond of your control) when you host a game server, access control is all up to you, dedicated hardware, you can choose to upgrade to 16GB RAM at will (perhaps you got a new DDR4 machine and have no use for the old DDR3 RAM that still fits in this 'server') without having to pay extra every month for those gigabytes forever, buying storage basically at cost price...
For me, that's the big challenge; all I have is home internet on a dynamic IP provided by one of the big cable monopolies in the US.
- Setup public IP updating. You server runs a daemon that updates the DNS record automatically. You can do that with NameCheap. ($)
- You can pay 5$ to have a digital ocean droplet that acts as a reverse proxy that just forwards traffic to your real server. ($$)
- You can pay for "entreprise" service and get a static IP. ($$$)
You would run a program on your system which connects to Cloudflare. The traffic goes to Cloudflare first, and then gets forwarded to your system.
It's the antithesis of self hosting and it's in literally every big thread about self hosting on HN or r/selfhosted or such.
Whether it's to protect from DDoS attacks from some unknown baddies that are out to get you (never happened to me and I host all sorts of crap, including user-uploaded content), to speed up loading in remote parts of the world by 200ms (I tested my site on cloudflare in ~2015 and it didn't work at all, it just literally forwarded every request and waited for a reply), or apparently now to catch downtime somehow (the brand "Cloudflare Tunnel" instead of suggesting an open source caching service running on any old VPS from a friendly vendor near you).
But if you want to be accessible to the outside world, you need to direct your traffic outside; I don't see a substantial difference between routing your traffic through Cloudflare, Comcast, Equinix, or any other major connectivity provider.
And I would mostly agree so long as you're the only one who has access to said data. There will always be "ISPs", of sorts, that your data needs to pass through; that's simply how the internet works.
The nitpick about Cloudflare is that they are starting to act as a gateway to the internet. Maybe you can turn their fronting off if they start giving you trouble, or maybe your registrar also runs behind Cloudflare. Anyway, bit of a philosophical discussion how much power to vest in one company.
The real trouble is that their main offering involves giving them the private keys to your traffic. I don't know if that's also the case with this Tunnel product, but at least for regular websites, then they process your actual data, as with the bank example (a colleague at said bank was not happy).
I know of only one ISP in the Netherlands that uses CGNAT and there you can ask support to fix it, which takes them 24 hours. I learned that the hard way when wanting to have a gaming night, hosting a factorio server in my student room. No gaming night for me, or so the ISP thought while rubbing their hands. It took me a bit but I eventually managed to proxy the UDP traffic somehow, not sure anymore if I used hole punching or somehow encapsulated it in TCP and reverse SSH tunneled or something. (Edit: on second thought, pretty sure I asked the other participants if they had IPv6 -- they did not -- and then proxied the traffic from my server via IPv6 using iptables. /edit)
We are quite fortunate with having had an early ISP community that managed to gobble up all the IP addresses we'd need for a good long while, and our population is relatively stable compared to other parts of the world. I know not everyone is this fortunate. (Hello ipv6...)
Even in a place like Germany, it seems one needs to be a business connection to get this service, it's simply not offered for consumers at all that I could find in some town in NRW. This is why I'm so happy the Netherlands has ISPs like Freedom (successor of XS4ALL) and Tweak who not only care about being cheap. Even if you don't use Tweak or Freedom, I feel like it keeps the local competition sharp.
[0] https://openwrt.org/docs/guide-user/services/ddns/client
Try not to worry too much about what happens when your IP is reassigned before you can update the name.
I technically have a dynamic IP, as the ISP also sells an upgrade to a guaranteed static IP which I don't pay for.
However, I've been getting assigned the same IP consistently since 2013. I used to use a dynamic DNS service to keep track of it but stopped doing that since it never changes.
P.S. - I pay for a static IP from my ISP. Don't count on that never changing either. I know this from experience.
Most nameservers provide a REST API for updating records so this is very easily done.
import json
import requests
IP_API = 'https://api.ipify.org?format=json'
CF_API_KEY = # Cloudflare API Key
CF_EMAIL = # Cloudflare email address
ZONE_ID = # Zone ID
RECORD_ID = # Record ID for this DNS entry
resp = requests.get(IP_API)
ip = resp.json()['ip']
resp = requests.put(
'https://api.cloudflare.com/client/v4/zones/{}/dns_records/{}'.format(
ZONE_ID, RECORD_ID),
json={
'type': 'A',
'name': 'jellyfin',
'content': ip,
'proxied': False
},
headers={
'X-Auth-Key': CF_API_KEY,
'X-Auth-Email': CF_EMAIL
})But before that I created a service for looking up my ip address and hosted it for free at fly [1]. Then I setup a script in cron to update my dns every 5min if it had changed.
One day I will. In the meantime, could you please drop some links to some good introductory pages ?
Thanks!
From there, any device that connects to one of those ports or wi-fi networks will use the assigned VLAN. The access points are great because you can create several wi-fi networks and then the software provisions them to how ever many access points and switches you have, so you don't have to login to each one and set them up separately.
Any links I sent would be specific to Ubiquiti, but happy to do so if you plan to use their hardware.
Hell now I want to try this with two old but decent android phones - they would sip power and have a built in UPS and would blow a RPI out of the water speed wise. Throw a USB-C to Ethernet adapter on each and setup for HA (or if you were really lazy just a simple round robin DNS setup). Put one at a friend house and have them both setup with the free Cloudflare proxy thing and you would not even need to open any ports on your firewall.
This article is likely to give you a good idea of the architecture: https://developer.hashicorp.com/nomad/tutorials/load-balanci...
The only way I see to avoid a SPOF is with anycast, which I think involves running your own ISP to be able to arrange your own BGP sessions and announce at multiple locations.
Is this worth while to do? I'm concerned about using a pi, because micro-sd cards seem to be notoriously bad for corrupting data in less than ideal power situations.
Whether it could survive a lot of pageloads, like when submitting to HN and it gets traction, 100% depends on the blog software.
It won't run Wordpress well because that software is ridiculously heavy, and I frankly don't have good examples of database-based blog software aside from something I wrote myself. Mine still does multiple mariadb queries per pageload, so it's not as though it's extremely lightweight, but page generation comes out to a few milliseconds on a laptop with a CPU from 2012 inside. This software would survive the HN homepage easily.
I would estimate that anything that can handle >10 requests per second will survive the HN homepage, but if you're on the edge of 10r/s then perhaps it might be slower during the busiest minutes. If you would use static page generation (like jekyll, though I'm personally not a fan of how jekyll works it's the most well-known example) then the pi will definitely survive serving those static pages easily.
> I would like it to at least be a little nicer looking
The looks don't make it heavier or less heavy. Having a few style rules applied to the page is a few extra bytes per pageload, but they're not going to make the difference between it working or it not working.
Thin clients are perfect for such tasks. More powerful than a Pi, fanless, uses little power, and comes with a proper network card. Second hand HP T620s are cheap.
Also default security measures such as disabling root login via SSH, disable password login via ssh, use fail2ban (also works for wp-admin and the likes!), install/use firewall and only open services which you want to access from the outside.
> [it should] be reliable if I kick a cable out of the wall
Right, if you want it to be reliable but also be able to cut its cables, then you will need a secondary host outside the home.
> or in the unlikely event that I get a bunch of traffic.
Are you serving media (music or video of more than a few seconds)? If not: DSL or mobile data (if your data cap allows) is fine for HN front page. Judging by the current page weighing 100KB, you can have 10 visitors every second at 1 MiB/s upload. (HN reaches that rate only in spikes, even at a top three position.)
> I’d also like it to be quick!
It's currently not quick at DigitalOcean (2 seconds for TLS setup, 12 seconds for HTML, 8 seconds for JavaScript, etc... 27 seconds total). It can only get better!
I can recommend something beefier than a raspberry pi, though, or at least than than the pi 1-3 speeds that I'm used to. I personally use an old laptop which is plenty fast for, well, anything you'd also ask of a daily driver, except it now doesn't need to render a GUI which speeds things up a lot. They can peak up to 100W depending on the model, but are usually very low power when nothing is being asked of them.
> Oh, and I don’t want to have my home network hacked.
Then install unattended-upgrades, put admin panels (phpmyadmin, wp-admin) behind basic authentication, don't host things you don't trust (random code written by 'someone on the internet' that has never been tested by anyone), put it in a VLAN if you want to be extra cautious, and you'll be fine. It never hurts to keep your phone and other systems on the LAN up-to-date anyhow so they should be secure as well, even if someone does get in.