from AngryishHumanoid@lemmy.world to selfhosted@lemmy.world on 11 Aug 17:50
https://lemmy.world/post/50549835
Of the many useful things I could do with my spare time instead I’m setting up a Lemmy instance because why not. The scope of this is definitely greater than any self-hosting I’ve ever attempted, so please feel free to tell me just how much trouble I’m in. I’m just giving the broad strokes to see if I’ve made any crucial errors (other than deciding to do this at all).
And if this is a completely wrong place for a post like this or I’m missing data I’m supposed to include I apologize, I probably need a sanity check, in more ways than one.
First limitation, I’ll be hosting it on an existing Linux Mint box acting as a file share mostly and occasional gaming PC/movie streaming box. Its hardware is overkill for this, I do not anticipate issues when it is in use. It receives regular updates and weekly reboots, instance will be set to automatically restart. NVMe with loads of space for local storage, RAID SSDs for data offload/backup.
Second limitation, I hate Cloudfare and Oracle. I do not want to use either of them.
Third limitation, money. Cheaper is better. I have a URL picked out and a registrar which will give me the cheapest long term option, in case I actually keep this thing going.
Last limitation, I’m already in over my head so I’ll be relying on a lot of googling and probably some chat bots to figure things out as I go through the actual deployment process. What could go wrong?
So, Lemmy hosted on Linux Mint box using Docker containers. ISP is a good one for this I’m told, no CGNAT, largely stable public IP but I’ll have a script running in case it does change. Confirmed ports 80/443 are open. Using Caddy for the HTTPS. Closed registration to start, if by some miracle I make it to actually wanting to allow additional users it will not be fully open, and I’ll use Brevo for the email SMTP. Security wise I know I’m making it harder for myself by exposing my IP, I’m going to have UFW running and Crowdsec to help keep incoming bad traffic out.
Down the line I’ll get Lemmy updates, backups, retention rules in place/automated, and make decisions on federation, etc. Thoughts?
threaded - newest
Why not host a PieFed instance instead? Similar but more features and easier to maintain. Does have some scraper countermeasures built in, so maybe you don’t even need Cloudflare. Also as a next project after that, you could learn Python and contribute to the project.
Good question, mostly just cause I use Lemmy so wanted to stick with what I know more of at this point.
Yeah, being conservative isn’t how awesome new hobbies start. You need to leave your comfort zone 😂
Piefed had its own recent controversy lately. Leave yours? 🙃
Yeah, Some people here really love drama and to fight other people online, preferably on a personal level. PieFed has become target of that. I don’t think it necessarily means a lot, other than we’re some high drama online place. There wasn’t any one software vs another one involved.
But everyone is allowed to pick their favorite software. They’re both fine from a technical perspective. You’ll get some different perks, but it’s all the same Threadiverse. I myself like PieFed better, including which side of drama they end up on. But YMMV. If OP wants to start on a new journey, they’re entitled to do whatever they like. Main thing with side quests is to do something in the first place. That’s more important than the exact details.
(Btw, I’ve also been using Lemmy for quite a while… It’s not like I’m in my comfort zone all the time.)
You’ll regret that.
Thought about doing something very similar, I’ll be curious to hear the feedback and your experience
If at some point in the near future you step outside and hear a weird screaming sound echoing around the globe, that’s me.
Best of luck on your new hobby!
I didn’t see anything in your post that set off alarm bells
If you’re looking to save some cash and your ISP gives you a stable public address you could utilize a Dynamic DNS provider (ala duckdns) instead of registering a domain
Good point, that was purely a vanity issue: I have a specific name I want for my instance, and I wanted it to be as short a URL as possible so I was willing to spring for the domain. I’m not saying I’m doing all this just for the pun I have in mind, but I did spend far too long on that step of my deployment plan.
Best of luck to you!!! I just went through this last week and wow it was a challenge. I went the docker route not using ansible…and yah by far the worst install I ever went through of all the self-hosting projects I have setup…but my setup was largely complicated by the fact I had an Apache reverse proxy setup in front of the nginx proxy that has an example config provided…finally figured it all out, but yah fun times 😂 happy to help if you get stuck.
One of my earlier deployment plans had me using Ansible, then a bot aided revision had me remove it since I’m doing a single machine install and a fairly straightforward process. From my understanding I’ll get a better learning experience not using it so I figured that was better.
Yah i had never used it either, alot of the tutorials I found suggested it, and what threw me for a loop and was the ultimate Aha! moment for me was there is an ansible version and a non ansible version for the docker configs with different options in each, and the ultimate key thing I overlooked is on github, I kept using the “main” development branch which had changes that didn’t work with the stable .19 version. Switching to the .19 branch on GitHub and referencing those configs made it all click
Not sure what your solution was, but I eliminated the reverse proxy from the official compose stack and configured my existing reverse proxy to point directly at the lemmy containers. It works well for me.
Thanks. Yah that was what I tried to accomplish using Apache but couldn’t get the correct proxypass statements in Apache that would do the correct passing depending on the header received. Tried asking an LLM for help but never got it to work, so ended up doing a basic/straight pass through apache to a local VM running nginx as an outer proxy which proxy’s to the nginx internal proxy…its messy as all hell but it works 🤷
I don’t know enough about Apache to say one way or the other, but based on what you described, you SHOULD be able to get rid of the internal proxy. Since both the inner and outer are both NGINX, getting the settings right shouldn’t be a problem.
But, on the other hand, if it works it works!
Good call. Perhaps on a rainy day I’ll take another crack at it…but yah the ports are exposed through docker so yah, makes sense. Thanks and have a great day!
Probably, yes, but I still love you
You sound like my wife.
Plot twist. You are not married…
Sure I am, but depending on how much of my free time goes into this we’ll see if it stays that way…
Cool man… I did the same last year, best decision ever.
Pretty easy too
Not lemmy, but piefed. The easy way, try yunohost.
You should not host anything that’s going to be public facing on your home network in 2026, period. Get a cheap German VPS and go nuts with it. There’s simply too much at stake opening up your home router/firewall for such little gain. Plus, being a residential IP behind NAT might just make it straight up impossible.
I host my own email and a matrix server. I would never think of exposing my home network to the internet. I use tailscale to get into the homelab, anything exposed to the net lives somewhere far, far away.
I use netcup for my email and matrix. It’s extremely reasonable.
I don’t get this perspective. A reverse proxy pointing at containerized applications gives you plenty of buffer between the scary internet and your personal files. Don’t bind mount your entire host file system to the container, and only open/forward the ports you need.
There are things you have to get right, but there’s no reason to discard the idea altogether.
I’m somewhere in the middle, because comments like yours actually reinforce my concerns. A reverse proxy isn’t really doing anything to make you more secure, unless you’re using it for some sort of access control. It hides which ports you’re using, and allows you to encrypt your traffic with TLS… But it doesn’t add any additional security to the services you are exposing.
Maybe if you use it for access control, to add a secondary username/password to the services. But that breaks most legitimate things (apps, mostly) that try to reach the double-password-protected service. Because a user on a web browser may be able to type in two passwords, (one for the reverse proxy, and then one for the service itself) but an app will try to pass that info automatically using headers.
Any vulnerabilities in the services will still become potential attack vectors. Anyone who remembers the Huntarr debacle will know exactly what I’m talking about, because a single service being vulnerable can do a lot of damage. Yes, containerization does a lot to help mitigate damage by excluding access to everything except what you give it. But it won’t completely stop things from going wrong.
The point of the reverse proxy is that it simplifies your firewall configuration… you open one port (443) to one endpoint (your reverse proxy), and that’s it. The more complex your firewall configuration, the more likely you are to get something wrong and accidentally expose what you might not want to expose.
I do not use my reverse proxy for access control.
If you’re using containerized applications, then the worst-case scenario is somebody gets root permissions inside the container. Under those circumstances, they can destroy that instance of your application and access any data stored within the container. The thing is, they can ALSO do that if you’re on a VPS.
If there happens to be a Docker vulnerability that allows file system access to the host AND AT THE SAME TIME an application vulnerability, then you might be in trouble. The confluence of those two events, especially if you keep things updated, is unlikely enough that I have no reservations about hosting public services on my home network.
But that said… we all have our own level of risk tolerance. If it’s not right for you, then you shouldn’t do it.
edit: just reading up on huntarr and ooooh boy. Vibe coded app that asked you to provide API keys so it could talk to and control other services. No wonder it caused problems. It’s probably worth saying out loud: if the container you want to install is used to talk to and control other containers, you need to be EXTRA SURE that it’s reputable.
Those devices should most certainly be on two separate networks. Internet facing devices should be on a DMZ and not be allowed to talk to your internal network. You can then allow your internal network reach your DMZ devices, but only allow return traffic from the DMZ.
I use mTLS and vlans whenever I expose things to the internet.
In the words of that one guy from Casino: Why take a chance? A VPS is peace of mind for a cup of coffee a month. I like to be sure the things I need to keep safe have as many opportunities to remain that way as possible.
I get it, but the whole point of this is for me to utilize hardware I already have. If I get to a point where it’s not working out I can always go that route but I want to learn on my local machine and I can always switch later.
I don’t feel like I’m risking anything… I feel like I have an understanding of the attack vectors and I’ve mitigated those to a level that’s acceptable to me.
Risk tolerance is something we all have to judge for ourselves.
I also don’t get this fear. Assuming you aren’t blindly exposing your entire filesystem or opening tons of ports what is the risk?
How much RAM do you have available? Do you have an unlimited internet connection?
32gb, not unlimited but good enough that I am willing to proceed, then limit bandwidth usage through restrictive federation.
Great, that should be plenty! Smart to restrict, federation indeed results in a ton of traffic :D
I would not do that without first looking into applicable laws regarding legal liability for content and requirements to remove things. Depending on where in the world you are, this can be a minefield.
Yeah that’s a future line item if I make it far enough, heh. It’s under the “who to federate with” bullet point.
Especially because Lemmy devs don’t five a fuck about instance admins liabilities or gdpr
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:
[Thread #76 for this comm, first seen 11th Aug 2026, 19:20] [FAQ] [Full list] [Contact] [Source code]
We need more of this across all Platoforms for discovery and learning. Thank you!
Not necessarily, but why choose a project that needs interfacing with an existing ecosystem where it can mostly only be noise?
If you want to deal with a complicated mess of a system as a project, you could always grab Arch
I did a very similar setup very recently. Its not bad. I did try piefed first as some people suggested, but had some issues and it felt like it just wasn’t ready yet. I switched to self hosting lemmy and really like it. I also went with Brevo for email (I started with sendgrid, would not recommend).
Main difference for me is I am using cloudflare (they are my registrar and they allow me to deal with the CGNAT at no extra cost which you don’t have to deal with not to mention a pretty solid WAF for free tier). You may want to implement a WAF of some kind to keep the federation in check. I federate both lemmy and a matrix home server and it doesn’t eat up too much bandwidth.
I also like saving money, so a VPS is something I was trying to avoid. Personally, I don’t think the VPS does a much for securing your home network as people are trying to say here. It is another layer of security, but it’s not a panacea. Not saying I’ll never try it though.
I actually started on a VPS… I moved off because I was pegging the RAM and adding more to my plan was quite expensive. Performance is MUCH better on my home server with plenty of RAM.
Lemmy eventually plans on having an invite system, you could maybe use that when it comes out
github.com/LemmyNet/lemmy-ui/issues/4128
(You can also do this manually with the application questionnaire field and a spreadsheet)
Yes, you are, but aren’t we all?
Yes you are mad, I know as I did that over 3 years ago. Went from at home => a cheep VPS => paid for Oracle VPS.
If you go down the lemmy route (vs piefed) then I would deply with Lemmy-Easy-Deploy by @ubergeek77. this makes setting Caddy and mail simple
Good to know, I’ll take a look at those. Thanks!
up untill now I’ve not had too much bot traffic, but I’m betting hammered atm. Make sure to have some good firewall rules for when it happens: <img alt="" src="https://no.lastname.nz/pictrs/image/0f2c05c6-5dec-4171-9d3c-84e9b09048a0.png">
check this out!
<img alt="image" src="https://media.piefed.social/posts/H9/mn/H9mnw10MIym38Pd.png">
those ~2000 blocks were in the hour after turning on the full proxy, still getting a fair few from china hitting the real IP address that they must have cached.
Grep’d the logs and had 250,000 requests from china in the last 20 hours asking for full threads via the api
Huh. I hadn’t really thought too much about having to block that kind of traffic, I’ll add that to the list to think about.
Update with a link to your instance when you’ve done it so we can show some love and support
Just in general or because you’re setting up a Lemmy instance?
Well in general I know I’m an idiot, so for the moment I’ll just stick with Lemmy instance feedback cause that’s at least easier for me to address without expensive therapy.
Just for trusted friends or randos? If randos, have you ever been a mod? Never set up a Lemmy instance, but I have been a mod of quite a few Reddit subs. It’s a headache I will never engage in again.
Not complete randos, but yeah it’ll likely be a very minimal group of people if at all. And I’m not looking forward to modding so I doubt I’ll go the route if having a lot of comms in my instance, but we’ll see what happens.
Maybe. Do it anyway?
My instance has been online for about a month, the supplied docker-compose.yaml was quite straightforward, had a little headache with Nginx but nothing overly complicated.
The long-con so to speak is federation, you have to subscribe to each community manually to begin federating with them, i have noticed timing issues with other instances such as Lemmy.world and have not been able to resolve them.
Interesting. And yeah I’m aware of the federation issue, I was gonna use that to my advantage in terms of my plans to slow roll who to federate to to keep my bandwidth and storage allowances under control. I also know there is a script you can set up which will handle the initial contact to federate automatically.
I tried finding such a script but had no luck. I was able to export my subscription list from sh.itjust.works and imported it on my instance.
I had to unsubscribe and resubscribe to the communities I follow as I was experiencing the ‘Subscribe Pending’ issue but after a little while things seemed to start evening out and becoming a bit more stable.
I’ll write a script you can use to seed with top communities. I already have most the work done.
Do it. You’ll learn something new. Maybe you’ll even contribute to the code.
Yes. Do PieFed.
Also, don’t do cloudflare. If you must use something, make sure it’s self hosted.
You’re an idiot of you don’t use PieFed instead 😃
oh very interesting. i’ve been wanting to get into the details of how federation actually works, and i wanted to figure out why mastodon<->lemmy federation does often not seem to work. but i guess that’s a deep rabbit hole too!
It does work! To an extent. It’s just not popular to do this… Because of the extent. No votes, easy to find threads, etc.
I keep considering the same thing, except only letting myself register so that I can have my own stupid instance name.
You will learn a ton. Also, you will spend a lot of money hosting an activitypub instance. I run a server for fun, and it’s about $40/month to handle the absolute firehose of assets I receive 24/7.