Re:A story on home server security
by coder543 on Sunday January 05, 2025 @09:29AM
(#42601947)
Your original solution of binding to 127.0.0.1 generally seems fine. Also, if you're spinning up a web app and its supporting services all in Docker, and you're really just running this on a single $3/mo instance... my unpopular opinion is that docker compose might actually be a fine choice here. Docker compose makes it easy for these services to talk to each other without exposing any of them to the outside network unless you intentionally set up a port binding for those services in the compose file.
[ Parent
| on HN ]
Re:A story on home server security
by evantbyrne on Sunday January 05, 2025 @09:40AM
(#42602035)
You should try swarm. It solves a lot of challenges that you would otherwise have while running production services with compose. I built rove.dev to trivialize setup and deployments over SSH.
What does swarm actually do better for a single-node, single-instance deployment? (I have no experience with swarm, but on googling it, it looks like it is targeted at cluster deployments. Compose seems like the simpler choice here.)
Re:A story on home server security
by evantbyrne on Sunday January 05, 2025 @09:53AM
(#42602125)
Swarm works just as well in a single host environment. It is very similar to compose in semantics, but also does basic orchestration that you would have to hack into compose, like multiple instances of a service and blue/green deployments. And then if you need to grow later, it can of course run services on multiple hosts. The main footgun is that the Swarm management port does not have any security on it, so that needs to be locked down either with rove or manual ufw config.
Interesting, in my mind Swarm was more or less dead and the next step after docker+compose or podman+quadlet was k3s. I will check out Rove, thanks!
Re:A story on home server security
by evantbyrne on Tuesday January 07, 2025 @09:51AM
(#42622946)
That was rumored for a while, but Swarm is still maintained! I wouldn't count on it getting the latest and greatest compose format support though.