r/SelfHosted

Caddyfile for Bookstack to use SSL I'm trying to setup Bookstack to use automatically use SSL. I believe Caddy is able to do this for me, but I'm having trouble figuring out what I need in my caddyfile. I've setup a brand new Bookstack, with a brand new Caddy install, and I'm using an example.duckdns.org subdomain to point to. The Bookstack works when I use HTTP (but no auto-redirect to SSL), but when I try HTTPS, it fails to load. I've tried the file server, reverse proxy, and php caddyfile examples found on Caddy's docs, but none of them seem to be working. Everything I'm finding seems to imply this should be a simple process, and I've tried other examples found via Google, but nothing seems to be working for me. I also saw one comment mention the .env file in Bookstack needs to be modified to allow HTTPS, but I'm not sure what exactly needs to be modified there. This is all very new to me and I am just basically trying to follow guides. What am I doing wrong? EDIT: I'm using Ubuntu 20.04 on a VPS. https://redd.it/nhwopw @r_SelfHosted

Who do you talk to? People self-hosting Element /Matrix /XMPP /other foss social media, who do you talk to? I'm already having a hard time convincing friends to switch to Signal. https://redd.it/nhvyd3 @r_SelfHosted

Found this gem today! I got it as a gift 10 years ago. Back when I was 9, I didn’t know what self hosting was; I was just having fun :) https://www.reddit.com/gallery/nhu06j https://redd.it/nhu06j @r_SelfHosted

Does anyone here use the NGINX Proxy Manager? I was using Linuxserver's SWAG container for my reverse proxy server. I recently switched to NPM. There are couple things that I could not do with NPM * Set the DH bit to 4096 * Redirection * Hardening I could not find the option to set the DH bit to 4096. With SWAG, I can do this using the DHLEVEL option. I could not figure out the redirection. I want to redirect the 80 to 443, if the user typed in domain.tdl it should redirect to [www.domain.t](http://www.domain.tdl)ld Also, I have another domain ([www.domain2.t](http://www.domain2.tdl)ld) and I want that domain to [www.domain.tld/location](http://www.domain.tdl/location). Is there a way to harden the NPM? I am looking for updating the cipher by removing the weaker ones, etc. Do you know how I can accomplish these with NPM? I checked the documentation and I could not find the information that can fix my issues. EDIT: I updated the post. Right after I posted this, I fixed my redirection issue. https://redd.it/nhr1c0 @r_SelfHosted

(Noob question) Is there such a thing as a VPN for your selfhosted website? I'm planning on hosting my own chat server for me and my family/friends, but I'm not sure what the best way to go about hosting it is. I don't trust my ISP, and I don't want them knowing I'm hosting something/I don't want them near my data, but I also want full control of my hardware, so I would prefer not to use a VPS. (though I'm not against using a VPS, the ability for them to clone my data and have constant access to it is a bit creepy) Here's the possibly stupid question; is there a way to host a server through something like a VPN, so that my ISP is in the dark about what I'm doing? I would be using something like a Raspberry Pi to host it. Thank you to anyone who replies! https://redd.it/nhrcwg @r_SelfHosted

Can anyone recommend a way to make API requests for updating Airtable as my own setup? The service DataFetcher for Airtable is great but their pricing is a bit steep for me right now. Hey all, not sure if this is the best place to ask, but here goes! https://redd.it/nhq9zz @r_SelfHosted

Optimal setup - Nginx vs Apache, behind Nginx Proxy Manager I am running a medium traffic website using WP, and it currently uses apache (a la default docker image) and sits behind Nginx Proxy Manager. Assuming everything else to be equal, will there be an improvement in performance by switching the apache into nginx and the WP to be using FPM? Nginx Proxy Manager doesn't currently support FPM, for many reasons described on github, so using that won't be possible. https://redd.it/nhp858 @r_SelfHosted

Snipe-IT alternative (serverless, gcp) Hi, what are alternatives for Snipe-IT which can run serverless. Issues I found with Snipe-IT are like: \- running on cloud run is not an option as it's storing images on disk which is not possible with serverless \- it have storage connector but for S3 bucket, no GCS option \- no gsuite/workspace integration, only ldap(?) \- when behind reverse proxy (Pomerium) it's returning its address instead of work properly (for now I have no idea what's going on, it's the only one solution which behave like that). Overall it's looking good but because of complicated hosting probably I need to find something else. https://redd.it/nhojq6 @r_SelfHosted

Lychee electerious and lycheeorg Why there is two? I can't find a reason for this. Both are maintain also. You do install them in different way. But what's the difference between those two https://redd.it/nhm9s2 @r_SelfHosted

Video Streaming API (Media services can be installed on any devices) https://fastogt.stoplight.io/docs/fastocloud-api/reference/fastocloud_streams.yaml https://redd.it/nhmb4y @r_SelfHosted

My Dashboard 2021 Edition: I love Self Hosting https://redd.it/nhlzww @r_SelfHosted

OneDrive alternative Hi guys, I'm looking for a method to have a folder sync somewhere (i.e. Raspberry Pi setup, decentralised crypto) that works like OneDrive. It runs in the background and is connected to however many computers I want to connect it to. In addition, I would like it to be accessible from anywhere and just be a simple no frills omnipresent file system. What's the best method to do this? I've seen owncloud/nextcloud use a Raspberry Pi. https://redd.it/ngzvon @r_SelfHosted

Can't get matrix / synapse docker install working This has slowly been driving me insane for the last few days. Attempting to install matrix/synapse via docker but I can't get the container to launch. Steps: 1. Create docker-compose file as described in this guide (note that I'm using a reverse proxy on another server) 2. Generating base config (docker-compose run --rm synapse generate) 3. Attempting to run container I'm able to generate the container without issue and edit the config. But when I attempt to run the container, I always get the following output: https://pastebin.com/XrLsJ9JL I'm getting the output listed in the pastebin even when using all defaults on the compose file and generated config. Anyone know what I'm doing wrong? I've updated perms to 777 for the data/ folder while troubleshooting. https://redd.it/nhi8u0 @r_SelfHosted

How to handle online backups with slow internet connection? Hey, on my homeserver I have a Raid 6 with ~2 TB of data that I would like to backup to Backblaze B2. To do that I installed Duplicati and set up a backup job. Due to my slow internet connection (~1 MBps or ~10 Mbps) the initial backup process took something like 3 or 4 weeks, which isn't a problem for me. But it seems like I made the mistake to change my local data during the initial backup process, which resulted in an error in Duplicati, saying that there are files on one side that do not exist on the other side, or something like that. Since then I am unsuccessfully trying to fix the error by rebuilding and/or deleting the local Duplicati database etc. For me it seems like Duplicati has a problem with files that are being changed while the backup process is running (uploading). Due to my slow internet connection, this is a problem I will always have, since each backup job will take a lot of time. So the question is how should I handle this? Are there other tools that are better at this (e.g. Rclone)? Or is this a problem that will prevent me from being able to backup until I get a better internet connection? https://redd.it/nh6ccr @r_SelfHosted

How should I manage Identity Management/openLDAP while maintaining password encryption? I run a small business and have been undertaking a migration and restructure of our network infrastructure. Unfortunately, cloud providers are off the table for us. We currently manage all of our user identities using Atlassian Crowd. However, due to Atlassian's recent decision to sunset their server products, I have been looking at migrating away from them eventually. ​ Keycloak suits all of our business needs perfectly except for one: Email sync It seems that the only thing self-hosted email clients can really sync with is LDAP (which makes sense due to IMAP and SMTP authorization). ​ Keycloak can sync with openLDAP, and so can Crowd. The issue, however, is how these applications end up storing the password in openLDAP. Keycloak only uses pbkdf2 by default, which openLDAP does not support by default. Or at least not the docker image I was using. This means that when a user changes their password in Keycloak it gets stored in openLDAP as plaintext, which is not good. ​ There is a pbkdf2 plugin for openLDAP, but I'm having a hard time finding the documentation on how I might activate it using a docker image and it seems I may need to build my own after compiling openLDAP from its source to include the plugin. ​ Crowd, on the other hand, uses pbkdf2 by default for its internal users, but only supports DES, MD5, PLAINTEXT, SHA, and SSHA by default in its openLDAP connector, all of which have been cracked. It also only supports reading passwords from openLDAP with those encryption methods, unlike Keycloak. ​ This means that, currently, the only unifying encryption method between them by default is plaintext. ​ I'm assuming that if I install the pbkdf2 plugin for openLDAP, then Keycloak will store passwords using that method. ​ From what I can tell, my options are as follows: ​ 1. Install pbkdf2 plugin in OpenLDAP, make a custom plugin for Crowd (I would have to learn a bit of Java). 2. Write/Install a plugin for one of the other encryption algorithms in Keycloak (or don't allow the user to change their password), and settle for using a potentially crackable algorithm. 3. Switch all of our other Atlassian apps to use Keycloak for SSO, which may require a decent bit of work and database modification to ensure that the user ID's transfer over with the right permissions. Install pbkdf2 plugin for openLDAP. 4. I saw that freeIPA was suggested as a more powerful alternative to OpenLDAP, and it is theoretically capable of syncing with both Keycloak and Crowd, but changing passwords from Crowd using it has not been tested. The Docker image for freeIPA is also not really considered production-ready, and I'd much prefer to stick to Docker if possible. 5. Just let the passwords be stored in plaintext and pray to the hacker gods that our LDAP data doesn't get leaked. (Sounds like a terrible idea) ​ All of these solutions (except the last one) seem like they will take time to explore, so I am unsure which would be the most worth pursuing. Or if there are any other options I am not seeing here. I know this is a bit complex, but does anyone here have any advice? https://redd.it/nhg7j4 @r_SelfHosted

My Homer dashboard Lots of others have been posting their Homer/Heimdall/Organizr/Other dashboard so I figure I'd post mine too. I cut off the header and a legend (Purple=Docker, Blue=Hardware, Green=Virtualized) to fit in the screenshot. https://preview.redd.it/r3w8bb2h2d071.png?width=1259&format=png&auto=webp&s=8f0128fd17f8a11f217cb8973b45fd7b57437e49 https://redd.it/nheoyz @r_SelfHosted

Expose your self-hosted server, and deliver traffic to your users by running a dependency Hi all! We've been working on Exogress \- a web application delivery service. It's like CDN + Load Balancer that developers can easily use. It runs as a code dependency and agnostic to the environment: you can expose a self-hosted app, and one hosted in public clouds if you want. Some handy features for self-hosted include out-of-the-box HTTPS, TLS, and authentication for your resource in seconds: just a few lines of code to add in a config file. Currently supporting GitHub and Google auth. I've made a short video tutorial on how to expose a localhost app, and we've described another use case, exposing your dockerized flask server, in a blog post, and. Give it a try! We're still early stage and working hard to build a service that developers like. Appreciate any feedback! https://redd.it/nh356t @r_SelfHosted

dhcpv6-client http https ports: 51820/udp 443/tcp My best guess is that traffic is flowing correctly from the VPS -> wireguard -> home server, but then somehow its never actually making it to the reverse proxy. I don't really understand how that can happen. I was previously trying to use HAProxy for this, but I think FirewallD port forwarding is simpler. HAProxy did work, but only for a few hours at a time, then it would stop for seemingly no reason. It wouldn't always start working again either. That's why I'm trying to make this work. Can anyone spot where I am going wrong here? This is very frustrating :( Appreciate any help you can give! Let me know if I missed anything, but I think I covered it all. https://redd.it/nhb693 @r_SelfHosted

Port forward problems Hello! So I recently switched to an ISP that does not allow any unsolicited inbound traffic on any port (barring this its a huge upgrade for me. It's a 5G link, not cable). I'm trying to work around this restriction so I can access my various services, but mostly so my matrix server will still work. I currently have a VPS with DigitalOcean, so I thought I would use wireguard to link the two, then just send the traffic down the tunnel. It works *in theory* but in practice its hardly usable, as in no connections happen at all. What I'm trying to accomplish: user -----> VPS<--------|wireguard|--------->home server------> caddy ------------> services This sort of works. If on my home server, I run ```curl --resolve subdomain.domain.com:443:127.0.0.1 https://subdomain.domain.com``` then I correctly get the html of the page I'm trying to access. If I monitor ```sudo tcpdump -n -v -i wg1 port 443``` on the home server, and then run ```curl --resolve subdomain.domain.com:443:192.168.3.2 https://subdomain.domain.com -vvv``` on the VPS, then I see a bunch of traffic appear in the tcpdump log. Sample tcpdump: tcpdump: listening on wg1, link-type RAW (Raw IP), snapshot length 262144 bytes 16:29:21.417670 IP (tos 0x0, ttl 64, id 11152, offset 0, flags [DF], proto TCP (6), length 60) 192.168.3.1.57880 > 192.168.3.2.https: Flags [S], cksum 0x2874 (correct), seq 641061893, win 64860, options [mss 1380,sackOK,TS val 643405507 ecr 0,nop,wscale 7], length 0 16:29:21.417733 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 60) 192.168.3.2.https > 192.168.3.1.57880: Flags [S.], cksum 0x8782 (incorrect -> 0xe088), seq 4286823502, ack 641061894, win 64296, options [mss 1380,sackOK,TS val 1334787756 ecr 643405507,nop,wscale 7], length 0 16:29:21.488287 IP (tos 0x0, ttl 64, id 11153, offset 0, flags [DF], proto TCP (6), length 52) 192.168.3.1.57880 > 192.168.3.2.https: Flags [.], cksum 0x07b4 (correct), ack 1, win 507, options [nop,nop,TS val 643405634 ecr 1334787756], length 0 16:29:21.507353 IP (tos 0x0, ttl 64, id 11154, offset 0, flags [DF], proto TCP (6), length 569) 192.168.3.1.57880 > 192.168.3.2.https: Flags [P.], cksum 0x616e (correct), seq 1:518, ack 1, win 507, options [nop,nop,TS val 643405646 ecr 1334787756], length 517 16:29:21.507415 IP (tos 0x0, ttl 64, id 61251, offset 0, flags [DF], proto TCP (6), length 52) 192.168.3.2.https > 192.168.3.1.57880: Flags [.], cksum 0x877a (incorrect -> 0x054e), ack 518, win 502, options [nop,nop,TS val 1334787846 ecr 643405646], length 0 16:29:21.507805 IP (tos 0x0, ttl 64, id 61252, offset 0, flags [DF], proto TCP (6), length 59) 192.168.3.2.https > 192.168.3.1.57880: Flags [P.], cksum 0x8781 (incorrect -> 0x9b39), seq 1:8, ack 518, win 502, options [nop,nop,TS val 1334787846 ecr 643405646], length 7 16:29:21.507861 IP (tos 0x0, ttl 64, id 61253, offset 0, flags [DF], proto TCP (6), length 52) This tells me two things. 1. The reverse proxy is setup correctly and working 2. Traffic is making it to the home server from the VPS over the wireguard bridge correctly. However, when I run ```curl --resolve subdomain.domain.com:443:192.168.3.2 https://subdomain.domain.com -vvv``` on the VPS, no HTML is ever returned. It seems to hang: * Added subdomain.domain.com:443:192.168.3.2 to DNS cache * Hostname subdomain.domain.com was found in DNS cache * Trying 192.168.3.2:443... * Connected to subdomain.domain.com (192.168.3.2) port 443 (#0) * ALPN, offering h2 * ALPN, offering http/1.1 * successfully set certificate verify locations: * CAfile: /etc/pki/tls/certs/ca-bundle.crt CApath: none * TLSv1.3 (OUT), TLS handshake, Client hello (1): There is never any output after Client hello. This is not just a curl problem either, actual browsers don't connect either. I'm using FirewallD, and port 443 is definitely open: FedoraServer (active) target: default icmp-block-inversion: no interfaces: wg1 sources: services:

Vaultwarden+Nginx (docker containers) Hi there, following this guide I started to self-host my first service (Bitwarden). Though I'm now using a duckdns domain without issues, but I was trying to get it to work with an example.cyou domain I purchased from Namecheap.com When I put the example.cyou into a "New Proxy host" form it seems to work and nginx web app shows: source: example.cyou | destination: http://192.168.x.x:8080 | SSL: no | access: public | status: online but when I click on the source (or I try from browser, it prompts me 502 error). Also let's encrypt does not work (internal error) There is a way to get these things to work together? I admit I am a total noob about domains, and I'm willing to learn and understand. Thank you all! :) p.s. I also added an image of my (edited) DNS table on Namecheap. My IP is automatically renewed via ddclient https://redd.it/nh6f2w @r_SelfHosted