Introduction

Important

This blog post presents my current infrastructure. An updated version will be published when major modifications are made. This article will then be categorized as obsolete.

In this article, I’m going to present the infrastructure I’ve set up to self-host my services. This overview will give you an idea of the hardware and software I use, as well as the reasons that led me to make this choice.

Why I chose self-hosting

I chose to host my services for several reasons:

• Total control: To be able to configure and adjust every aspect of my infrastructure to my needs without depending on an external provider.
• Confidentiality: My data belongs to me, and self-hosting ensures that there are fewer overly interested parties spying on my data.
• Learning: Setting up and managing this infrastructure has helped me a lot acquiring my current knowledge.
• For fun: I like experimenting with technology and finding solutions to technical problems. It’s a passion that occupies my free time in a productive way.

Constraints

I don’t have a lot of money to put into electricity bills, so it was and is important that the hardware I chose is not too energy-intensive. Additionally, low-energy equipment generally produces less heat, and I don’t like it when it’s hot in my apartment.

My infrastructure

Hardware

• A Raspberry Pi 4
  • 8 GB RAM
  • 16 GB SD card for the system
  • 128 GB USB SSD for the /var folder
  • 3 TB HDDs for volume storage

Note

I’m using an SSD for the /var folder to preserve SD cards and eMMC, while maintaining sufficient speed.

Due to budget constraints, which will soon be resolved, I’m only using a Raspberry Pi 4 and have had to remove certain elements such as monitoring.

Software

I only use Docker and a few system tools on my Raspberry Pi. But here’s my “Must-Have” list:

• vim / nano
• htop / btop / top
• git
• curl / wget
• ping
• ip
• dig
• nslookup

I dockerize many services, the main ones being:

• Traefik: for reverse proxy routing to my services
• Authentik: for SSO on compatible services and forward proxy protection of services that don’t propose login
• Portainer: to manage my containers
• Gitea: for a “home” copy of my repositories. I also use it to store my private repositories for my infrastructure configuration (config files, compose files, etc.).

As well as all the other services that aren’t useful for infrastructure management, which I’ll detail in other articles.

Security

Access

I only expose the ports required for the services I want to make accessible, i.e., 80 and 443 for HTTP and HTTPS. If a service requires me to expose another port (such as my IRC server), I expose it if I want to access it from the outside.

SSH access to the machine is via the local network or my VPN.

SSL

To have HTTPS on my services, I use a wildcard certificate as well as a standard certificate (*.millefeuille42.fr and millefeuille42.fr). My registrar (OVH) lets me obtain and renew them via their API, all free of charge.

If I can’t (Namecheap and Scaleway), I use the Let’s Encrypt resolver from Traefik to obtain and renew them automatically and dynamically.

Forward Proxy

To protect my services that aren’t intended to be public (and/or that don’t provide authentication on their own, like Homer), I use Authentik’s Forward Proxy mode with Traefik. This allows me to manage access to these services from a single location.

Deployment of key services

To lighten this article, I’ll detail the deployment of key tools (Traefik, Authentik, Portainer, Gitea) in another article. I’ll put the link here when it’s done.

Managing other infrastructures

The services presented here permit me to manage other servers, particularly for close friends and family. For Portainer, all I need to do is to add an agent to the server, and Authentik provides branding according to the domain used for access. All that is left to do is to install and configure Traefik on the desired entry point. Authentik’s user management lets me isolate users of the different servers.

Conclusion

Self-hosting is a rewarding adventure that permits you to regain control over your data and acquire many technical skills. Although it takes time and effort, the benefits in terms of privacy, control, and personal satisfaction are well worth it. If you’re passionate about technology and like a challenge, I strongly encourage you to give self-hosting a try. You won’t regret it.