For example, something that is too complex for your comfort level, a security concern, or maybe your hardware can’t keep up with the service’s needs?
IRC server or ZNC bouncer.
Aegis. Never use a local-only 2FA app on your phone.
What’s the problem with it being local-only? Just backup the secrets, and you’re good? Or is backing it up the “online” element?
Like a password manager, I can’t trust myself for the seeds to get misplaced.
First, that’s what recovery codes are.
Second, that’s what backups are for.
Frankly, given what we’ve seen with LastPass this past year alone, there is absolutely no one I would trust to host any of my credentials.
My TOTP seeds go in a Keepass database that has a very long passphrase. That database is then sync’d across devices with syncthing and included in encrypted backups.
Any recommendations for 2FA?
deleted by creator
Authy, having paid bitwarden and 2FA in one app is a disaster waiting to be happen in case of a security breach.
Can Authy really be trusted?
Out of all hosted options available that I lasted tested 2-3 years back, Authy is the only one that reliably syncs and backups seeds across devices. I would switch in an instant if something like Bitwarden comes up but for 2FA only.
Why not just use Aegis with a remote backup?
Minecraft. When I started out it was fine but when I began to get regular visitors I got DDOSed for days on end and people poking me for ssh access. Never again.
Been using mine using docker behind an extra vpn container…works beutifully…
Sadly my server predated Docker or I would have done this. After I left the community I think they migrated to Docker.
Why were people asking for SSH access?
They weren’t asking, I was getting spammed with attempts. I changed the ports and locked down my server. In the end I switched to VPS’s.
You get spammed with ssh attempts no matter what. Just set up fail2ban with harsh firewall rules, key-only auth, and live happy!
I feel like I’m having a change of heart on NextCloud… Every time some little thing breaks I have to figure out how to fix it
Really? Nextcloud has been pretty set-and-forget for me.
It largely is, but yesterday the Recognize app broke and I have no idea how to fix it. I think the environment got messed up from an apt-get upgrade? Its little things like that I have to figure out how to fix
Nextcloud AIO has officially hit the 1 year mark for me without any issues. The truck has been to use it as a real Dropbox replacement not a Google Drive with word and all these other integrations. I had it break 3 times due to weird updates because of that the prior year. Using it to mirror/backup files is pretty nice.
deleted by creator
Ouch, that’s awful. Yeah tbh I wouldn’t quite trust it to do encryption well. I haven’t had any actual problems with Nextcloud but it does feel like it’s held together by duck tape.
deleted by creator
Okay, but do you run it in containers or on bare metal?
Bare metal (using the NixOS module, so the manual stuff like database upgrades after an update and such is automated). Only containers that go on my servers are Pterodactyl because it requires it ;)
For updates yeah. I used to run it with docker and just about every other major update would break it. Then I went to bare metal…still broke. Now I have it on yunohost and its…better. Its only broken once last year. But heavy backups is how I deal with it.
deleted by creator
That, and the fact that Spam abatement is a terrible chore. Whackamole at its worst.
rspamd seems to do a fair job of it.
I’ve managed to do it for my personal email and find it very rewarding. Sadly, I could never use it for my business. It’s just too risky and there may always be a few delivery problems here and there.
VPS hosting, BTW, not home.
I have setup a mail server for my employer, and doing it manually yourself is difficult. I didn’t want to do it for myself as well.
However I looked into mailcow, and tried that privately and it works great so far! However, i would dedicate a separate VPS for just that.
Been having a wonderful experience with mailcow on a small vps…
Email. Way too complicated and lots of maintenance. Not to mention it you mess it up, there are huge downsides.
I find it funny that a bunch of the simple basics are nowadays considered complicated. I’ve been doing my own mail and DNS for over two decades now, and don’t see a reason for stopping. It is pretty low maintenance, and generally less headache than having someone else do it.
Standing up email might not be that hard… but it’s much harder to ensure that your mail will actually be delivered successfully. Plus it’s not a service you can typically afford to go down. Any emails you miss during that downtime are gone forever, whereas even if my Vaultwarden credential vault goes down I can access passwords from a device that has things cached at least while I fix things.
Plus the big providers just treat small mail servers with a lot more skepticism than they did 20 years ago.
Plus it’s not a service you can typically afford to go down. Any emails you miss during that downtime are gone forever
The sending server will retry a few times, so you have at least a few days to bring it back. And if you prefer an additional fail-safe - adding a secondary MX somewhere else which will just store mails until the primary comes back is trivial.
Backups. Cloud services like Backblaze B2 are so cheap for the durability they offer, it just doesn’t make sense for me to roll my own offsite solution with a Raspberry Pi at my parents’ house or something. Restic encrypts everything before it leaves my machine.
Password manager- it’s too important and it’s the thing that has to work for me to recover when I break something else. I’m happy to support Bitwarden with a few bucks a year.
Email- again, it’s mission critical and I have a habit of tinkering with things and breaking them. And it’s just no fun. The less I need to think about email, the happier I am.
Re backups, to be clear it sounds like you’re specific referring to offsite backups.
I run my own local backup server using syncthing for replication and restic for snapshotting, but I also send offsites to cloud storage (in my case gdrive).
That’s what “1” in the “3-2-1” backup strategy stands for, a true offsite backup (preferably continent where you do not reside) For “2” I would still deploy a local offsite at someone’s house for quick disaster recovery.
Downloading your 10TB data from B2 (or even requesting a tarball HDD from them) is costlier than recovering from an offsite backup facility within an hour’s reach.
I self-host all those things.
I just have two portable drives, and I bring one home from work at a time to run an rsync backup job.
deleted by creator
Because the assumption is there’s very little throughput. Storage isn’t really that expensive, but bandwidth is and Backblaze is only cheap if you aren’t trying to get at your data regularly. That’s fine for backups because hopefully you never need them.
EDIT: I should say that for an individual user, getting data out of Backblaze isn’t that expensive, but it’s more expensive than cold storage. I think they charge $.01 per GB transfered, so a 10GB movie would cost you about ten cents to stream. It would cost you $100 to recover a 10TB backup from Backblaze (though for a fee than can mail you some of that on a hard drive, I think).
Tor exit node, public Lemmy instance.
Lemmy instance for me as well. I have a specific community I miss from reddit that I want to replicate, I even have a domain sitting around that’d be good…I just don’t want to store data coming from complete strangers. I also have zero interest in any sort of admin/moderating. So I’ll just go without it and get over it lol
Weirdly for extremely similar reasons
Yes these. Essentially anything that an unidentified user could push data to that would land me in regulatory trouble. I would want to host these things, but I don’t want to become a distributor of anything that would get me a search warrant.
I tried getting a music setup to work, but I couldn’t find a good solution for generated playlists with new song recommendations. The self-hosted music service just can’t add songs it doesn’t have yet, so it’s not really feasible. Plus I still have a very cheap YouTube Music subscription from the GPM days.
You can use Lidarr to subscribe to artists’ new album/singles. But you’d still need to have a workflow to add new artists every now and then to incorporate them into your library.
I want to be able to pick a song and say “give me a playlist of similar songs I don’t know yet”, and have that play immediately. That’s just not something a self-hosted setup can do. :/
Yeah I think the closest thing I’m aware of is Plex and album/track mood on smart playlist, and even then that’s kind of janky (ie: cannot shout into smart assistants to creat one on the fly). Music is so cheap now, even the free Amazon Music I get from Prime serves my needs, so I don’t even bother with it.
A public Matrix server. Its just a never ending black-hole of ever increasing storage requirements and the software is too buggy to not become a maintenance hassle.
I do run a Synapse server for bridging purposes, so I am not just talking in theory.
XMPP is safer and lighter anyway
And so damn easy to self-host in general. Ejabberd is batteries included down to offering stun/turn for audio/video calls, Erlang is just unrivaled when it comes to hot reloading so updates are effectively zero-downtime (unsurprising considering all the business critical environments it’s deployed).
At first (and especially because I went with Matrix originally) I wouldn’t think of self hosting all my instant messaging, but in retrospect, ejabberd is one of the easiest services I’ve got to maintain. I highly recommend everyone to give it a shot, especially to all the matrix refugees to whom it was a surprise/disappointment.
Password manager like Bitwarden. I’d rather they take care of it for me. The consequences would be too great if I messed it up.
I still don’t get why people want to have cloud-based password managers. Keepass works in all major platforms, it’s just one file, which it is super easy to sync and/or merge. It can integrate with your browser/Os if you want, but otherwise the surface attack is basically zero.
Oh man, that’s actually really good advice! I recently switched to Vaultwarden, but you’re right: If my server goes down, I can’t even restart it, because the password for my account is in there! Damn! Close call!
Well with bitwarden/vaultwarden you can have a copy of your entire vault on your phone or computer or both… so even if your server was totally dead, you’d have access to your passwords. Solid backups is a must, I follow the 3-2-1 rule on super critical systems (like vaultwarden) and test that you can actually recover. Something as simple as spinning up a VPS, testing a restore, testing access, see if that could work in a pinch until you get your server back online, then tear it down. Linode is very cheap for this kind of testing, it’d only cost you a few pennies to run a “dr” test of your critical systems. Of course you still want to secure it, I’d recommend wireguard or tailscale instead of opening access to your DR node to the internet, but as a temporary test it’s probably fine if your running patched up to date versions of docker, vaultwarden, and I’d always recommend putting a reverse proxy in front like nginx.
Usually the password are also stored locally.
I can definitely access all my passwords offline with bitwarden
Smart move, unless you really know what you’re doing and have redundancy. When I first made the switch from Lastpass to Bitwarden I had tried to host the vault myself instead of using the cloud version, which worked fine right up until the moment I had a server outage and lost access to all my passwords.
Eh, the clients all cache your vault. It shouldn’t be a huge issue for it to be down even for a few days.
But I do upload encrypted backups of the server every 6 hours to cloud storage
Same.
Plus, my instance is proxies through Clouflare and only IPs from my country are allowed.
I’ve managed to keep my KeePass database for almost 20 years going back as far as when I was a dumb teenager. Back then it was as simple as having a couple extra copies on usb drives and Google Drive, but now I keep proper backups.
My take is, I’d rather control it myself, I am responsible enough to take care of my data, and I actually wouldn’t trust someone else to do it. That’s a huge reason I selfhost in the first place, a lack of trust in others’ services. Also, online services are a bigger target because of the number of customers, and maybe even the importance of some of their customers, whereas I’m not a target at all. No one is going to go after me specifically.
I think that’s what’s kept me at KeePass rather than moving to something like Bitwarden. Since it’s file-level encryption, anything that can serve files can also serve my KeePass database. When I upgrade servers or change to different services, restoring my database is as simple as throwing the file into that new service and going on with my life.
Yeah, my recommendation is basically this:
Do you need to share passwords?
No - use KeePass
Yes - use Bitwarden
Bwoa, you can easily take json backups. It is pretty safe imo.
Nothing really. I’m comfortable hosting mail, chat, my passwords and important documents. However:
Hosting personal/important data for other people is a bit intimidating because you kind of guarantee for safety and availability.
And services that are likely to be misused for illegal stuff and would be too bothersome. Otherwise i might host an anonymous spam eating email-forwarder, maybe a tor exit-node and a forum where adults can practise free speech. But that kind of stuff just attracts the wrong kind of idiots.
not complicated or hard, just don’t care enough: music, spotify is fine, especially on the family plan.
Mail, Bitwarden and Joplin. Too important stuff for my Raspberry Pi setup.
Second. I used to self-host Bitwarden. Then I realized it’d be too devistating to lose all my passwords, even with backups. So I moved to their cloud service and paid for my families accounts too.
Joplin tho, Joplin stays on the server with no backup. I should really, really make a backup this weekend.
I’ve never heard of joplin but it looks just like what I need
Because passwords are so critical I’d never give that to a third party.
Stuff like bitwarden is needlessly complicated, though - I nowadays have a vaultwarden instance for friends and family, but everything important is done via pass - which only needs a git server, which I have anyway.
I really want to use Bitwarden and I pay for the premium as well, but it’s starting to bother me that a lot of basic stuff is missing despite years of user requests.
- An Auto-fill UI for the web interface
- Credit card auto-fill
- A way to refresh from the auto-fill menu on the Android UI
I just tried Proton Pass (I have unlimited anyway) and it’s not better, but at least they seem to be working on these.
all the features you listed are available though?
I have replied above: https://lemmy.world/comment/1988541
It has all of those though?
Okay, credit card autofill is there at least on the browser, my bad. But the other two, no. What I mean by auto-fill UI is an overlay like we see in LastPass, Proton, etc.
If you add an item on your desktop, make sure it’s synced and try to use the Android app to auto-fill it, it won’t be there yet. And if you use the basic auto-fill view (“Items for x”), there’s no way to refresh. The main app (not the “Items for” view) does have a refresh option though, so i end up closing everything, going back and refreshing from there.
Also, I like the way Aliases work in Proton. I’m still using both and really like both, and for now, both have its pros and cons.
I am hosting bitwarden myself (on a VPS) and I am not that concered about losing my passwords, because every device syncs all passwords locally regulary so that you don’t need internet to access them.
So to loose all your passwords not only do you have to loose your bitwarden server and all the backups, you also have to loose access to all your bitwarden clients synchroniously.
In the early days it was cloud and mail, since Mailcow works really good, it’s just the cloud. Because nextcloud is too much hassle, all this php stuff… I have a managed nextcloud at hetzner and I am really happy this is something I haven’t to worry about.
I check ocis from time to time, if it is usable the same way, I would selfhost my cloud again. NC on selfhost? Only if they do the same steps ocis already made. Because ocis is a simple single binary without php.
