Hey, folks. The Jellyfin and Komga media servers running on my NAS are going great locally. I invested in a firewall and some managed switches, and from preliminary VLAN tests, I’m confident that I’ve got what I need to section off the self hosted services from my primary network. I was hoping to get a recommendation for the next couple of steps.
I’ve got a mini PC running Bazzite that had been a portable console/fighting game setup that I’m ready to retire from that role so that it can serve as a server and reverse proxy. I’m not sure what OS to put on it. If I have to manage it entirely by command line, it will take 10 times longer for me to do anything I want to do, and I’d really prefer a GUI. That said, I know it also takes resources to power a GUI that I won’t be touching most hours of the day. I was curious what distro you folks might recommend for this purpose. In some of my research, I also came across Apache Guacamole, but I’m not sure if that requires a proper desktop environment to already be present in order to get that kind of remote access with a GUI. Am I overthinking this? Is this going to be just fine with a normal desktop distro installed on it? If normal desktop distros work just fine, I need something that can sit there without updating until I tell it to; since introducing snaps, this is something Ubuntu has been a pain about, so I might want something else.
The next thing I was curious about was order of operations for the reverse proxy. There are SSL/TLS certificates that are needed for HTTPS, but I need a domain for that, and a lot of tutorials just skip on past this step in the domain configuration screens where you “enter your DNS servers” as though I know why I’d need other DNS servers, where to get them, how to select them, etc. And ideally, I’d want to test that the reverse proxy is working locally with HTTPS and all before it’s exposed to the internet in the first place, so I’m not sure what order to do those steps in: DNS servers, buying a domain, getting certs, configuring reverse proxy.
As with most things, I’m sure this is far less complicated than it looks to me right now, and once it’s in the rearview, it will make a lot more sense, but I’d appreciate any advice folks here can offer.
Think of this like any specialty skill. It’s hard the first time but will quickly become second nature. But first you have some homework…
If you have a way to section off your network and understand how to expose service’s to the web you are off to a great start from the networking side.
For the ssl cert. As others have mentioned it’s time to go read up on how DNS works. You don’t need to go super technical (yet, if ever) - but getting you head around DNS delegation and registers will answer all the questions you have here. The super TLDR is you “buy” a domain and tell your register where they can tell others to find the records for that domain. Once you can prove you own the domain you can get certs. There are a bunch of options going this path, I’m most familiar with the enterprise grade choices (aka super expensive) so am not the best to recommend something for someone starting out.
Now for VMs. I’m sorry to say it’s homework time. You have three primary choices: everything in a full VM, everything in containers or a mix. If your interested in having a GUI (learn the cli when your comfortable) then I’m going to recommend you look at two different technologies: proxmox (it’s overkill but might be what you want) or virt-manager.
I plan on putting just about everything I can in Docker containers, but I don’t think what I’m doing requires VMs, unless you spotted something that’s eluding me.
dont discount the utility of running containers in an abstracted Hardware Virtual Machine (HVM) away from your physical hardware. it expands your testing surfaces and sandboxes immeasurably.
Why do I need that? From my perspective, it seems like it would be more useful if I had far more services that I intended to run than what I’m actually planning for.
It depends on your goal. If it’s to learn (to say get a different job) you want/need as much flexibility as you can get. If it’s just to have a media server then you probably want to optimize in favor of that.
Yeah, I’ve only got a handful of services I want to run. It’s possible that the bug bites me and I want to go deeper into this stuff, but for the here and now, I’m only eyeing 8-10 things I want to host, and they ought to work across a mini PC and a NAS.
I was curious what distro you folks might recommend for this purpose.
This is a bit like going to an automotive forum and asking “what’s the best car to buy”. You’re going to get a lot of “I’m running <blank>” and people telling you their preferences, which is NOT the answer to your question. The answer to your question is that literally any of them would be fine for your purposes. If you’re happy with Bazzite then stick with Bazzite. There’s no reason to switch.
If I have to manage it entirely by command line, it will take 10 times longer for me to do anything I want to do, and I’d really prefer a GUI.
Then use a GUI. The extra memory used is trivial and your system will be way over-powered for a reverse proxy to a home network anyway. In Linux land there’s really no such thing as a “server distro” and a “desktop distro” for the most part. I use Ubuntu, Debian and Fedora as servers. They can all have desktops on them too.
You may find, however, that as you manage more than one system it becomes tiresome/tedious to have to use RDP for remote administration and may start learning the CLI over time. Especially since it’s often a lot easier to give somebody a list of commands to run on a forum than to say “open your network manager, which is different on Gnome from KDE, click the button that says…”.
I need something that can sit there without updating until I tell it to
Are you going to update frequently? You want to be sure you’re keeping security patches up-to-date. Auto-patching can be very good unless you have the discipline to keep up with it.
I need a domain for that, and a lot of tutorials just skip on past this step in the domain configuration screens where you “enter your DNS servers” as though I know why I’d need other DNS servers,
You’ve got a bit of reading on how DNS works. But basically there are “root DNS servers” that everybody knows by IP address that then know about other DNS servers by IP and forward traffic to them to resolve names. When you register a domain you are asking one of those DNS providers to resolve your hostname to your IP address. You can see this a bit by running
dig +trace some.host.nameand it will show the requests made. Your DNS servers would be the ones where you register your domain.BUT your IP address may change. So you generally need a way to update it if it does. There are providers like dyndns.org and others (search for dynamic domain service or something) that will give you a sub-domain for free/cheap and tools to auto-update it. Something like “mysite.dyndns.org”.
I’m not happy with Bazzite for this purpose. Its previous purpose was to be a game console, but I’m reassured by the recommendations for Debian.
Then use a GUI. The extra memory used is trivial and your system will be way over-powered for a reverse proxy to a home network anyway.
It will be more than just a reverse proxy, but I suspect it will still be more than powerful enough for the extras. Thanks.
Are you going to update frequently?
Yes, just so long as I’m the boss. I don’t want any downtime that I’m not in control of.
Your DNS servers would be the ones where you register your domain.
The tutorials I’d been looking at were showing them overriding the DNS servers at the domain registrar with servers from Cloudflare or elsewhere. Is that just because there may not be an automated way to update the IP dynamically with the domain registrar, but there is for Cloudflare?
The tutorials I’d been looking at were showing them overriding the DNS servers at the domain registrar with servers from Cloudflare or elsewhere. Is that just because there may not be an automated way to update the IP dynamically with the domain registrar, but there is for Cloudflare?
Probably because those tutorials are using Cloudflare for DNS services. I actually use Amazon AWS Route53 for my domain (purchased through 123cheapdomains (yes - really)) and I update it through the AWS APIs with a small script.
But why use one DNS service over another? Sorry if you’ve covered this already and it’s just not clicking yet or something.
I find that Debian is the go to for a stable OS. There are others for self hosting like casaos or Talos but I am a vanilla Debian man myself.
Portainer or Podman can be used to manage containers with a GUI compared to the cli.
As for proxies I use Traefik as a reverse proxy for all my Docker containers. It integrates with CertBot so it auto renews Let’s Encrypt certs.
You don’t need to buy a domain, you can use a self signed cert and install that cert onto your machine to not get cert warnings.
Thanks. My NAS comes with a Docker GUI that I’m fairly comfortable using at this point, but I figured I’d end up using Portainer on the mini PC. So CertBot is the software that will get me a self-signed certificate until I’m ready to expose it to the web? And I can install that via Docker container? Desktop Debian is totally cool for the mini PC OS?
@ampersandrew stock Debian and apache for the win
I’m not sure what order to do those steps in: DNS servers, buying a domain, getting certs, configuring reverse proxy.
You have a lot of avenues and approaches available to you. Caddy has been a mainstay for some users. Setting up Caddy with letsencrypt is fairly straight forward. Traefik, Pangolin, Nginx, HAproxy are good candidates. Pangolin being a self-hosted tunneled reverse proxy. You could also go with the Cloudflare Tunnel/Zero Trust route. You will have to have a domain name that you can change the nameservers on to the ones Cloudflare assigns you. Most people get a cheapo domain name from NameServers or Pork Bun. From there, you install Cloudflare Tunnel/Zero Trust on your server, and connect to your Cloudflare account. The beauty of Cloudflare Tunnel/Zero Trust is that you don’t have to fiddle with opening ports and such, other than port 22 to admin the server. Cloudflare takes care of all of that.
I’m not sure what OS to put on it.
I run Ubuntu Jammy server, but there are other options. Is it imperative you have a GUI? I realize that the CLI can be daunting, but it is quite effective. I guess you could have a desktop OS to serve up services tho I’ve never done that. I’ve always just used the minimal server install of Ubuntu, then add whatever I needed later. As far as an OS recommendation, I’m a fan of Ubuntu. Mainly because that’s what I started with so I know how to drive that bus fairly well.
I think the tunnel method you’re suggesting is different than what I’m after, and a lot of the “complexity” in learning this stuff is coming from all the different methods we have available to achieve similar results. I ought to be able to just expose 443 once I’m fully up and running, and it will route to the various services through the reverse proxy and subdomains. My “zero trust” separation for security ought to be my VLANs. So if I’m not going exactly that route, where would my DNS servers come from, and why would I need something other than what’s there by default?
I know the CLI is effective. My daily driver has been Kubuntu since 2017, and I dabbled with Ubuntu for a decade before that. But I’m so much slower on the command line, because I have to think so much harder about each command, and the outputs are often unintuitive to read and parse out what I’m looking for.
why would I need something other than what’s there by default?
Security in depth for me. I tend to be a little heavy on security: https://lemmy.world/post/43533409
But I’m so much slower on the command line
I feel that, and it’s understandable. I seriously doubt that even Linus Torvalds knows every command and sequence off the top of his head. However, it would seem to me that at some point, the GUI will not have the options you need to deploy xyz app, and you’re going to have to use the cli. I keep a ‘note pad’ on my dashboard full of commands because my brain is shit and this helps me as much as it may seem rudimentary. LOL The list goes on for quite a ways past what is visible in the screen shot.
In that vein I always encourage users to take prolific notes. You’ll never remember everything you did 6 months from now. So, write down everything during the deployment, then distill the notes into what actually worked, and include them in your 3,2,1 back up scheme.
My 2p. Best of luck. Do share your journey.
