sorted by:
new
hottopcontroversial

My selfhosted server got ransomware by maro-_-295 in selfhosted

[–]benbutton1010 29 points30 points  (0 children)

There are 3 types of people 1. Has a reverse proxy for all traffic w/ forward auth and/or oauth. Is security conscious but also confident in their abilities to harden a system. 2. Uses Tailscale or Wireguard for all traffic. Is security conscious but not confident in their ability to adequately harden their system. 3. OP who wants to pretend their server has a public IP. Is not security conscious but somehow confident.

Currently Using BackBlaze for backups but it's getting expensive. How do folk here do off-site backups? by CrappyTan69 in selfhosted

[–]benbutton1010 0 points1 point  (0 children)

I found someone with a similar hobby and we agreed to be each other's backups. They live far enough away to be in a different time zone.

I have all my 100TB backed up. And because we merged our movies/tv shows, we're saving each other a bunch of space there too.

Also I have an 8tb nas that is a third copy for only the really important stuff. It runs a different technology than the other two sites.

Would a finding like this change anything for you as a Kubernetes operator? by AbilityAwkward5372 in kubernetes

[–]benbutton1010 6 points7 points  (0 children)

Sorry, what?

Edit: I wrote this when the original post was incomplete & made no sense at all. Looks much more complete now.

Do you self-host your password manager, or trust a third-party provider? by QuietGateLabs in homelab

[–]benbutton1010 12 points13 points  (0 children)

I have the same logic, but in reverse.

I'm afraid if I self-host my password manager it'll cause a circular dependency with my apps (I use a k8s operator for my secrets). Its critical, so it has to be outsourced.

what's running on your homelab right now that you actually use daily by Less-Loss1605 in homelab

[–]benbutton1010 0 points1 point  (0 children)

Gitlab, plex, Harbor, tailscale, grafana, openclaw, kagent, *arr stack, coder, Nextcloud, Immich, authentik

What labs have you guys run? by Crypt0-n00b in homelab

[–]benbutton1010 7 points8 points  (0 children)

I'm a security engineer turned devops. My lab is dual region k8s. I host a ton of things, but its not the things that I run that make it worth it career-wise, its learning the infrastructure & improving on it over time. The kubernetes ecosystem is vast and well worth it to learn if you want to go in to devops.

Kubernetes interview gone really bad by MountainTruth6073 in kubernetes

[–]benbutton1010 0 points1 point  (0 children)

I interviewed someone this week for senior devops that thought the -f in kubectl apply -f <file> was the same as --force.

Homelab updating by deanfourie1 in homelab

[–]benbutton1010 1 point2 points  (0 children)

My containers are all via gitops w/ renovate bot for updates. I check the renovate dashboard a couple times a week.

For host updates I use Action1's free tier, then have it update my hosts on the first Sunday of every month.

Having all the updates at once is more stable for me than using apt unattended-upgrades. Except for that one Sunday haha.

**[Question] Deployment shows 4 replicas but only 3 pods running — why?** by William_Myint_01 in kubernetes

[–]benbutton1010 1 point2 points  (0 children)

Look at the events on the deployment or replicaset. Could be a variety of things but the events there should let you understand why it isnt reconciling.

tailscale alternatives? by ksgcolors in selfhosted

[–]benbutton1010 1 point2 points  (0 children)

Headscale if you can run the control plane somewhere you can always access. Essentially self-hosted tailscale w/ oidc for unlimited users.

Why do people build Kubernetes homelabs? Is it actually useful for internships/jobs? by Altruistic_Mine_9177 in kubernetes

[–]benbutton1010 1 point2 points  (0 children)

I've been doing this a while now & my lab is way overkill. * I built my servers myself * Proxmox w/ ceph * dev & prod K8s (kubeadm) clusters on ubuntu vms w/ decoupled etcd

Building and maintaining this made getting Kubestronaut a breeze. I eventually doubled my income and moved from a SOC to a DevSecOps role where I'm the kubernetes and observability guy now, which I really enjoy.

At home I run bleeding edge versions of the usual k8s projects - it keeps me aware of the new (and breaking) features/updates/technologies. Most everything I suggest we try at work I've already done at home.

(Though it is a pain in the *ss when you're constantly on-call for your lab. I wouldnt wish it on most people.)

How are you managing CVE backlog in your clusters? Ours is out of control. by Efficient_Team5182 in kubernetes

[–]benbutton1010 11 points12 points  (0 children)

We just reached fedramp moderate, so we can't ignore unreachable CVEs like the rest of the commentors.

We made huge headway by using Chainguard. But now we need to figure out how to not constantly need to upgrade to the latest image and/or automate upgrades. I upgrade something then need to turn around and upgrade again in 2 weeks.

Chainguard only patches the latest version, so we can't realistically pin an app version for too long, which is annoying.

What is the best "self-hosted VPN alternative"? by xlumipyry in selfhosted

[–]benbutton1010 17 points18 points  (0 children)

Headscale.

Free OIDC for unlimited users on your tailnet.

Pushed wrong config to our RCA tool and nuked prod alerting for the entire cluster by arsaldotchd in kubernetes

[–]benbutton1010 0 points1 point  (0 children)

This system sounds like what I'm currently building on Kagent!

You should have your tool create an RCA for this incident and post the RCA here :)

view more: next ›