WxFisch

There are two things in my house I don’t “play” with: internet connectivity and core home functions (lights, locks, garage doors, etc). That doesn’t mean I don’t self host anything or then, but I always start from a mindset of “must work”.

I run HA on a Yellow (functionally an RPi 5 with radios and storage interface built in). My lights are either Hue running as plain Zigbee devices, or Zigbee switches. I don’t necessarily want more customization with home automation, I want stable, extensible, and easy to use day today. HA checks all those boxes easily. I’ve not done much looking into OpenHAB, but I would caution against going with something for home automation just because it’s more customizable. Sure, it’s great to have an automation routine that turns on your lights when you get home, it’s less great to have an integration that misbehaves and now you cannot turn off a light, or lock your door, or turn down the volume on your music, etc. Be sure to know what you want to accomplish before you buy devices, build automations, and always build things with a manual backup operation option.

There is, I think, a few things that contribute here.

1. The US has a very stupid “bigger is better” mentality. So if you go out you expect a large portion because that translates to better (and more value). This is of course not true, but culturally it’s very embedded.
2. almost everyone I know takes home some portion of their meal from a restaurant. So that single portion is really two, or maybe three.
3. IME people don’t usually have giant portions at home, they sometimes do of course, but things tend to be more sane for home cooked meals for your family. They also tend to be a lot more balanced, with more veg and grain.
4. what you see on TV is often sensationalized, and not fully indicative of normal here.

Eh, it can be a lot of work but doesn’t have to be. I’ve automated backups, and if you follow current best practice guidance from industry, you should use long pass phrases and not worry about regularly rotating them. For things like SSH keys, you can rotate them if you think you’ve had a breach but in normal usage there isn’t a huge benefit security-wise since they functionally can’t be guessed and would need to be stolen. If an adversary steals your SSH keys then you’re already pretty hosed as the next step is for them to establish another backdoor to access your server without needing your key.

Honestly it’s not a ton of time. A few minutes to run patches every few weeks, and the initial investment to plan, install, and configure your services (but then that’s the fun part no?). Self hosting IMO isn’t a great way to save time and money, or even to get out of the pocket of big tech. If those are your goals you’re better off looking at hosted solutions that are Open, and likely paying for it since running IT stacks isn’t free. Self hosting is a hobby, something you do to learn and because you enjoy it. It is hard sometimes, takes time, and comes with risks, but so do most other hobbies.

It doesn’t usually matter what the service is, the basic concepts are the same. If you want to access a service you host on your internal network from another external network you either need to use a VPN to securely connect into your network, or expose the service directly. If you are exposing it directly you should put it (or a proxy like NPM) in your DMZ. The specifics of how to do this though will vary from service to service and with your specific network config.

You can run a port scan against your public IP from another network to see what is open. But if you haven’t specifically set something up for external access through port forwarding you are probably fine.

Only expose services internally then use a secure VPN to access your services, this makes your network no more vulnerable in practice than not self hosting. If you need/want to expose something to the internet, make sure you setup your network right. Use a DMZ to separate that service and leverage something like CrowdSec along with good passwords, antivirus, and keep things patched.

This was posted here yesterday by the dev. Overall the reaction seems positive.

A quick look through the repo it looks pretty legit, it’s a lot of effort to create something that works, with all the documentation (including a lot of planning docs) just to collect data on you. Traffic to various IPs, foreign or otherwise, wouldn’t really be odd for an app like this either. You could try and run it through something like virustotal though to look for malicious code (there are more than a few docker scanning tools on GitHub that use virustotal).

I use cloudflare mostly because I buy my domains through them as they offer at cost domain names for many TLDs. Internally I use PiHole and then just point what I need externally to cloudflare trough a reverse proxy and a DMZ box.

It wasn’t standard previously, and if you have TV service I think it’s still inconsistent but the past ~5 years it seems to be more common that they are setup that way from the start. If you have internet only service, and a newer ONT (like less than 10 years old) it is the standard configuration and is how the self install guide tell you to hook up the “quantum gateway” router from Verizon.

You can always call and ask to have your ONT converted to Ethernet output if it isn’t already and as long as it supports it I haven’t heard reports of much trouble there. The very early ONTs though don’t support it though IIRC but those should be being replaced at this point anyways.

I mean you can, an ONT is not a router, it’s essentially a media converter. I use my own router (and have for many years) and had no issues. The FiOS tech even ran a long Ethernet run in my basement to connect the ONT and my router in my rack when they installed service.

It depends, and without knowing your ISP I’m not sure there is a way to tell you for sure. I know for example Comcast gigabit Pro has been known to directly connect to an ISP SPF module in your firewall/router, but Verizon FiOS (and most FTTP that I know of) provide an ONT that converts the fiber to Ethernet which you would then connect directly to your hardware.

I would verify if the ISP router you refer to is not really an ONT in which case you are directly connected to the ISP functionally and there isn’t really an advantage to getting an SPF and getting the fiber directly connected if you even can.

I’m curious how everyone documents their core/critical configs to allow the non-technical in our homes work with it if needed. For instance if I’m on work travel and the Pi-hole goes down for whatever reason my wife wouldn’t be able to use pretty much anything online. I can remote in and fix it but that could be hours/a day or two later. Same then for the proxmox stack that everything runs on.

Along the same lines, how are folks documenting for EOL? It may not be a happy thought but we are all going to go someday, so what is your plan and how have you ensured loved ones can access/save important data?

Agree 100%. Most of the former Plex users turned Jellyfin users I have come across did so better Plex was broken in some way for them. For me it was the general lack of care in creating/maintaining a good Apple TV app. Over the past few years it’s just gotten buggier and buggier with a lot of complaints on the Plex forums where devs would essentially stop by to say they weren’t working on any fixes.

Jellyfin doesn’t fix 100% of the issues, but at least there is active development on Swiftfin that showed a desire to fully support all devices.

So paperless works as a service that ties into your storage. I point mine at an NFS share on my Synology and just backup that share. The documents are all stored as PDFs still so worst case I still have “dumb” copies without all the tagging available if my paperless instance goes offline for some reason.

I use Backblaze B2 through my Synology NAS to offsite my important data. Most things though I just backup locally and accept the risk of needing to rebuild certain things (like most of my movie/TV media files since I can just re-rip my physical media, and the storage costs are not worth the couple of days of time in that unlikely case).

I really think this is key when thinking about your backup strategy that is specific to self hosting compared to enterprise operations. The costs come out of our pockets with no revenue to back it up. Managing backups for self hosting IMO is just as much about understanding your risk appetite and then choosing a strategy to match that. For example I keep just single copy in B2, since the failure mode I’m looking to protect against is catastrophic failure of my NAS which holds my main backups and media. I then use Proton Drive and OneDrive to backup secrets for my 2FA setups and encryption for my B2 bucket. This isn’t how I would do it at work (we have a fair more robust, but much more expensive setup). But my costs for B2 are around $15/mo which I am fine with. When I tried keeping multiple copies it had grown to over $50/mo before I cared enough to really rethink things (the cost of the hobby I told myself).

I misunderstood what you were saying, I wasn’t sure if protect required a UniFi hardware console or could be self hosted like the network application can be. It looks like it does require at least a Cloudkey gen 2 (or the plus which is what they currently sell) or one of their integrated consoles like a UDM.

It’s supported natively in the UI to configure: https://help.ui.com/hc/en-us/articles/26301104828439-Third-Party-Cameras-in-UniFi-Protect

It was added in EA in mid September and should be GA now as far as I know.

I use UniFi Protect and record to my UDM, though you should be able to install it all on your own hardware if you’d prefer. Their cameras are pretty decent but a bit pricy in a lot of cases. Though they do support 3rd party cameras now.

I’ve also heard a lot of good things about frigate, but I’ve not really looked into it since I already have UniFi gear.

Something like LPS/TENS would fit your needs exactly, but it stopped being supported in 2021. It was essentially Tails but was built to be run from a wide verity of sources (we used to network boot onto PCs that had no hard drives at all, but had local network share access).