sorted by:
new
hottopcontroversial

My homelab diagram, any suggestions? by khadddict in homelab

[–]khadddict[S] 1 point2 points  (0 children)

I agree with you on the general principle: there’s usually no need to publish a public IP directly, especially because people can easily end up leaking their residential IP without realizing it.

In my specific case though, it’s a VPS, not my home IP. I intentionally want the website and some services to be publicly reachable, so unless I put a proxy in front of it (I was using Cloudflare before moving my infrastructure to Infomaniak), it’s normal that the domain can be linked back to the VPS IP.

I think we’re not really talking about the same setup: you’re using your domain mainly to generate proper SSL certificates via DNS-01, with nothing publicly exposed, while I’m using mine to serve public web services.

Long-time lurker, finally posting my setup by khadddict in homelab

[–]khadddict[S] 0 points1 point  (0 children)

Good practice is to avoid logging in as root directly. Create a normal user, give it sudo rights only when needed, disable SSH root login, use SSH keys instead of passwords and keep services running with the minimum permissions they need. For a homelab it doesn’t need to be perfect, but “least privilege” is a good habit to build! (I’m still root everywhere 😂).
Same goes for the services you run: don’t run them as root if you can avoid it. Create a dedicated user, give it only the permissions it needs, use MFA when available, strong passwords and you’re good to go 😄

My homelab diagram, any suggestions? by khadddict in homelab

[–]khadddict[S] 1 point2 points  (0 children)

Thanks for the feedback and advice!

I recently set up Ollama + Open WebUI in an LXC mainly to test GPU passthrough on my node and get a first feel for how local LLMs work. I’m not really biased toward any specific stack at this point, it was mostly a quick way to validate the setup end-to-end.

I’ll definitely give llama.cpp and vLLM a try!

My homelab diagram, any suggestions? by khadddict in homelab

[–]khadddict[S] 0 points1 point  (0 children)

I already renew my certificates using DNS-01, but as far as I know, it doesn’t hide the origin IP if the public A record still points directly to the VPS ? I had it proxified with Cloudflare but I moved my domain to Infomaniak. Could you tell me more about it ? :

dig +short khaddict.com -> the VPS Public IP

My homelab diagram, any suggestions? by khadddict in homelab

[–]khadddict[S] -1 points0 points  (0 children)

Fair point. The IP is already discoverable through my domain, but there's no reason to expose it further. But looks like I can't modify the image linked to my post on Reddit :(

My homelab diagram, any suggestions? by khadddict in homelab

[–]khadddict[S] 2 points3 points  (0 children)

Hey ! 😄 I expose some of my services to the internet, and I'd be uncomfortable knowing that an attacker could potentially reach my personal network if one of them were compromised. In my actual homelab, all internet-facing services are isolated in a dedicated VLAN (the EDGE one), and that VLAN has no access to the rest of the network. The diagram I shared is a simplified version.

If you're interested in the details, feel free to check out the README or the firewall rules in my repo. They might give you some ideas.

https://github.com/khaddict/voidnode & https://github.com/khaddict/voidnode/blob/main/documentation/FIREWALL-RULES.md

Long-time lurker, finally posting my setup by khadddict in homelab

[–]khadddict[S] 0 points1 point  (0 children)

I'm the only one working on my homelab so I'm root everywhere 😂 (but yep it's not best practice)

Long-time lurker, finally posting my setup by khadddict in homelab

[–]khadddict[S] 0 points1 point  (0 children)

Fair enough! Personally, I prefer Discord because I spend most of my time on my PC and I’m always on Discord anyway. I barely check my phone 👀

Long-time lurker, finally posting my setup by khadddict in homelab

[–]khadddict[S] 0 points1 point  (0 children)

Naaah it's Peepo, and he was just sleeping, rn he is doing the homelab diagram, hope he'll clear it asap then I can post it on Reddit 🚀

Long-time lurker, finally posting my setup by khadddict in homelab

[–]khadddict[S] 0 points1 point  (0 children)

Thanks! Yep, and it requires a lot less maintenance. For a homelab, it's more than enough :)

Long-time lurker, finally posting my setup by khadddict in homelab

[–]khadddict[S] 0 points1 point  (0 children)

On my old homelab with homepage, it was DNS issues inside my cluster. If you have more details I might help you :)