1 of 26

Self-hosting

DIY OpenSource Cloud & SaaS

2 of 26

Othmane KINANE

CTO @ Morocco (formerly )

Passionate about Software Craft and Code quality

Maintainer of dotnet-subset

3 of 26

It all started when I discovered r/selfhosted in 2017

*arr stack

4 of 26

  • Intel NUC6 with 4-cores
  • 8GB RAM
  • 120 GB SSD (2.5")

  • Windows 10
  • *arr stack

© David “DEVO” Harry

5 of 26

Network-attached storage (NAS)

2x 2 TB in RAID1 for personal data

1x 1 TB for stuff from the internet

802.11ac wifi, 4 GbE ports

Customizable linux firmware

USB ports*

Android TV Box

6 of 26

private IP (192.168.1.2)

ISP router in bridge mode�(ADSL/fiber to ethernet)

Router

Server

Storage

WWW

public IP given by ISP

Private IPs are not reachable from the internet !

7 of 26

private IP (192.168.1.2)

ISP router in bridge mode�(ADSL/fiber to ethernet)

Router

Server

Storage

WWW

👍 VPN is considered very secure

👍 One UDP port open on the router to access the whole home network

Not convenient, requires to install a VPN client on devices 👎

CPU/Bandwidth overhead 👎

public IP given by ISP

VPN to the rescue !

private IP

192.168.10.2

private IP

192.168.10.3

Router manages:�- home network (192.168.1.x)

- VPN network (192.168.10.x)

8 of 26

VPN clients need a fixed public address to connect to.

private IP (192.168.1.2)

Router

Server

Storage

WWW

public IP given by ISP

Not so fast, public IP in Morocco changes every 24h !

private IP

192.168.10.2

private IP

192.168.10.3

?

?

9 of 26

public IP given by ISP

When the IP changes, the router update a domain to point to the new IP.

You can use your own domain or one of the free DDNS services (noip.com, …)

private IP (192.168.1.2)

Just use a domain instead of an IP

Router

Server

Storage

WWW

private IP

192.168.10.2

private IP

192.168.10.3

Dynamic DNS

manzil.ddns.net

10 of 26

manzil.ddns.net

private IP (192.168.1.2)

Router

Server

Storage

WWW

What if I can’t install a VPN client on the device?�What if my router doesn’t have a VPN server feature?

port 1234

port 5678

https://manzil.ddns.net:1234

Source port

Destination IP

Destination port

1234

192.168.1.2

5678

….

….

….

Port forwarding

11 of 26

Everything worked great

Docker?

No time 😭

February 2020 ….

Now I have 2 weeks just for myself 😁

Me

12 of 26

13 of 26

ESXi

bare metal hypervisor�(OS for VMs)

14 of 26

ESXi

Linux VM

VM2 ...

Docker

Container1

Container2

15 of 26

manzil.ddns.net

Router

Server

Storage

WWW

port 1234

port 5678

https://manzil.ddns.net:1234

16 of 26

Everything worked great

Security ?

17 of 26

Rogue/compromised container

Unrestricted network access

Single network

manzil.ddns.net

Router

Server

Storage

WWW

manzil.ddns.net resolves to my home IP

IP is a Personally Identifiable Information (PII)

18 of 26

manzil.ddns.net

Router

Server

Storage

WWW

https://pics.manzil.ma

TUNNELS

Pros:�- Easy to setup

- Free DDoS protection

- Other cloudflare goodies

Hide your IP behind another server

Con:�Free tier only support HTTP(S) tunneling

=> TLS termination at cloudflare servers

=> they can see all your traffic

always-on connection

(tunnel)

(DNS handled by cloudflare)

19 of 26

resolves to VM IP

OCI free VM

frp server�(OSS tunnel)

manzil.ddns.net

Router

Server

Storage

WWW

https://pics.manzil.ma

Pros:�- TCP tunneling

=> TLS termination at home

Hide your IP behind another server

Cons:�- Needs time to setup and maintain

- DDoS protection?

always-on connection

(tunnel)

frp client

20 of 26

Rogue/compromised container

Unrestricted network access

Single network

manzil.ddns.net

Router

Server

Storage

Solution:

  • Control all traffic in and out of the VMs.

Implementation:

  • put each VM in its owner network (VLAN)
  • create a VM to handle routing for VM traffic and firewalling

So I choose one of the popular OSS firewalls

21 of 26

network 2

network 1

network 3

home network

22 of 26

23 of 26

  • HTTPS certificate management with CSR
  • OCI VM traffic control (update Security List with changing home IP)
  • A single NGINX Reverse proxy for all exposed services
  • Google SSO with oauth2_proxy
  • Forcing daily internet reconnect at 3am

Other stuff I’ve done:

24 of 26

  • Backup strategy 😅
  • Traffic control at container level (K8S?)
  • 2-nodes cluster with Proxmox (OSS baremetal hypervisor)

Stuff I want to do:

25 of 26

Thank you !

Slides available here:

26 of 26