Thank you!
EDIT: OK, a web app, not a website, the service is not critical (it's my side project, 5yearsback.com), I'm 100% technical, the app is in Clojure, but I plan to deploy Zig services as well
EDIT2: I've a static IP.
Regarding security: you might want to have a look at cloudflared. This is a (free for small projects) service by Cloudflare where your server (Raspberry Pi) connects to cloudflare, and all HTTP traffic is proxied through Cloudflare. This has multiple advantages:
- you don't need to open a port on your router that forwards to your Pi, which is good for security and simplicity (some routers don't even have this option)
- you get all the cloudflare protection with the click of a button, including HTTPS with automatic Cloudflare certificates, DDoS protection, etc
- you don't need DynDNS to point to your dynamically changing IP
One thing you really need is an SSD, though. I use a cheap Kingston, it works great but you must pay attention to the right USB->SATA adapter, picking one that's fully compatible with UAS drivers. For booting directly from the SSD with Ubuntu there is this useful guide:
https://jamesachambers.com/raspberry-pi-4-ubuntu-20-04-usb-m...
Performance wise, this little computer runs mostly like a common VPS, I think on par with a droplet from Digital Ocean, for example. Here some benchmarks:
https://pibenchmarks.com/benchmark/62022/
If you don't want to share your IP, a Cloudflare tunnel is a great alternative:
https://developers.cloudflare.com/cloudflare-one/connections...
Also, another essential tool is Tailscale, with it I can access my home server from basically everywhere just like a LAN connected device: https://tailscale.com/
PS: You can also do your own tunnelling with OSS alternatives, if you have enough patience/time.
Anyway, feel free to ask anything.
- Jellyfin - Media Server for all my tv, music, and movies
- Nextcloud
- Photoprism - Picture Manager
- Yacy - Private Search. I run this in 'robinson mode' and basically use it to replace all my bookmarks
- Homeassisant
- Frigate - Monitors my cameras and does object recognition. I use Coral USB to move detection to hardware
- Snapdrop - AirDrop replacement
- FreshRSS - RSS Server
- Bitwarden - (bitwarden_rs/vaultwarden)
- Imapfilter - Filter/tag/run external software on incoming emails
- Vikunja - Task Manager
- Dolibarr - ERP Manager for side business
- Bookstack - Wiki
- Several Static Websites
- NFS (as a NAS)
Frigate takes the most CPU, even with the Coral, but it is doing object detection on several high-res Remote Cameras. Even with that, my load is < 1.
I run all these in docker (each that needs a DB has its own DB instance too), with nginx-proxy and letsencrypt-nginx-proxy-companion in front of it.
Most of these are internal only (I use the access=internal), and have an always connected wireguard VPN on my mobile devices and laptops. A few are public, but pretty low traffic.
I have a static IP, and am running this on DSL that is 30M/7.5M. My router is a netgear with DD-WRT installed.
Already have an old pc hanging out somewhere? Good - don't buy anything new. Run the HTTP services from there and set up port forwards in your router, and DNS with your domain registrar (or set up cloudflared as other commenters noted). You're done.
Step further, you can go with a RasPi or a similar SBC, but just be aware running with ARM can have its' own challenges.
I'd recommend a cheap x86_64 machine from ebay, such as an HP t730 plus thin client. Native SSD support, higher/upgradeable ram capacity, and better IO would all come together to make a better server machine. The RasPi would win out on a few points (power draw, memory speed), but in this scale it likely wouldn't be noticeable.
Lastly - don't be afraid of cloud services. A GCE/EC2/vultr/hetzner server can get you pretty dang far for just a few bucks a month. Also, this makes it easy to get some exposure to infrastructure provisioning tooling (I prefer Terraform and Terragrunt) and server configuration management tooling (I prefer ansible).
Pick some machine in your house. Make it a wireguard client connecting to the vps. Run whatever web server/app you want. Make sure your home router is running something like fq_codel.
Done. You don't need dynamic dns as your home client will just reconnect. Your ISP won't see any ports open because there aren't any. Your SSL certs and all data live in your house, not on the vps. There is nothing to backup at the vps except for yanking some logs.
Regardless, I would host an NGINX proxy in front of some docker containers. It’s the easiest and classic way to front apps with custom domains very very easily. Traefik is also very nice and fast (Go based) reverse proxy.
If it’s purely for personal use, then check Cloudflared to tunnel into your network and access it like a VPN.
Again, if it’s Public be weary of DDOS attacks, port scans, etc. Personally I wouldn’t self-host a public web app from my house and instead would use a 4/mo VPS from Hetzner
1) internal HDD can be replaced with cheap, big SSD
2) Computer is absolutely silent
3) everything in one package, no mess of cables
4) very reliable
5) very low power usage
MacOS isn't the best OS for running a server, but I'm used to it so I don't mind setting up launch agents instead of systemd units
I have choosen to treat IPv6 as the default stack as I can point directly to the address from outside without any NAT. A reverse proxy handles all "legacy" IPv4 requests. My IPs do change once in a while, but I have made a little bash script that updates the DNS via my domain registrars API, works like a charm!
I would also put your app behind CloudFlare.
Also- if you are able to afford an intel NUC ($200?), and the app is low resources enough to be able to run on a Pi. You could also consider getting a VPS ($10/month).
[1] Something like https://www.newegg.com/dell-optiplex-7090-business-desktops-... - but older, and found on a local recycling center.
That said, unless you have an ideological reason for hosting it from your own home there are many platforms out there that can comfortably fit most non-critical webapps in their free tier with even less hassle than setting up a pi.
Or the other way round, which IMO would not be so serious (ie your already compromised personal computer being used to access your public webserver...)
You could try to isolate your webserver, but would need a dedicated router with specific features to do it (best being able to do VLANs).
Even if you don't get storage with its own power supply, you can use a "Y" USB cable for extra power, provided the same power source is used for the Pi and for the storage. This can have the added benefit of backfeeding power to the Pi, which, again, is fine so long as the power sources are the same.
While my Pi 4 is colocated, it has a Flirc case so it can run all four cores at 100% without ever having thermal issues, and the two USB attached disks are mirrored (raidframe), and it has been 100% stable for many, many months of heavy use.
I serve a website for my 3D printers from a Raspberry Pi (some are 3B+, some are Zero-W). It's just for "the set of people in the house who use the 3D printers", so the Pi is fine and obviously a viable candidate.
I have an ESP32 (or it might be an ESP8266 even; I'd have to look) that serves a status page for the boiler and near-boiler temps. That's also in-house only, but even that's on the slow side. https://imgur.com/a/JmeXYnj
What is the load this site is expected to serve? To what visitors? How static/cacheable is it? For me, an RPi goes a long way for anything in-house. Out of the house traffic, I'd look at a cheap VPS pretty early in the journey.
My current setup with two hubs has been working reliably so far, but in spite of it all being USB3 it's still not that fast (about 100MB/s serially top--I'd hope that the 3.25'' disk drives (new 4 TB drives, WD Elements 2620 and Seagate Basic STJL4000400) could do more, but maybe I'm wrong). So for my next tiny servers / appliances, I want to try either of the following instead, which have SATA which should be more reliable and faster:
https://www.pcengines.ch/newshop.php?c=48881
https://www.olimex.com/Products/OLinuXino/Home-Server/LIME2-...
Also, since Pi 4's are unobtainable here (Switzerland) currently: the Tinker Board 2 seems to be a bit faster than the Pi 4, and it has its wifi board as a plug in board, and I have been wondering if that can be replaced with a SATA interface, but haven't investigated.
Edit: seeing achairapart's comment, I realize that going directly from USB to SATA and then attaching disks there might have been a better option.
https://wiki.pine64.org/wiki/ROCKPro64#Booting_from_USB_or_P...
Static IP is most difficult, if you got that, you're good to go... If your website or app is light enough, sure, go with a pi4 or similar, don't put a fan on it, maybe a nice enough heatsink (use real thermal glue, NOT adhesive tape, some of the cheaper stuff actually melts and the block falls off).. Consider a 3 way router, like an edgerouter lite, so you can have a DMZ for the "server" so that if someone decides to visit, they're isolated from your other LAN machines.
I'd say unless your web app is resource-hungry, the Pi is totally viable as an option.
If you want to go with a more traditional x68 any of the many intel n4000/n5000 series systems being sold on aliexpres and similar sizes by no name brands as firewall appliances or network something do support modern m.2/nvme storage.
Just be sure to have a decent backup system in place as consumer grade equipment like the above may fail rather abruptly with little route to recovery.
Edit: you may want to check out Jupiter Broadcasting's Self-Hosted podcast. The show is very much geared towards DIY enthusiasts/small businesses.
Security is a bigger issue IMO though.
My most bomb proof SFF servers are a fit-pc3, still running since 2014, and a lattepanda alpha, which has been running for about 2 years. Of the two, I’d choose a fit-pc3 or whatever the most up to date model from compulab currently is.
1. Having a no break with surge protection: I have my router and Rpi connected to a no-break, so even if the power goes down my site stays up.
2. Configure port forwarding in the router: I forward port 443 to some higher port, so in the Rpi I don't need root for anything.
3. If your traffic is very high consider getting another internet link.
My go to setup plan right now is 3 8 core 16 thread mini pcs because they dont use anywhere near as much power as a full setup and still allow me to run a small kubernetes cluster.
My main reason for the cluster is not because its fancy, but this way i can actually update my services without downtime and the underlying machines too.
As other have mentioned, make use of cloudflare and the different services it provides and you shall have a simple secure setup that can handle a magnitude of loads.
As for the app: the true enemy will be rate limiting for you. But if you decide to take a frontend that is chacheable by cloudflare you should be golden with a queue based setup. Pingdom does that perfectly for instance with their speed tests for websites.
There are a lot of alternative SBCs to the Raspberry that are easier to find these days.
If you plan to use the SDCard make sure you do not write logs to it or that you change it regularly. I recommend that you mount a harddrive/ssd or usb stick for the logs if you really want them.
I know it's point-and-click to run Apache on it. (I personally haven't set it up.) At some point I might try to set up NodeJS to run some blog software I wrote between jobs.
The cost of a Pi would likely also pay for a decent low-end VPS for a years or so.
btw. i recently watched a video, in which the creator compares different used smaller formfactor pcs from ebay
As far as exposing to the net, ngrok seems cool.
You have a lot of options here that don't involve hosting a site from your own living room. Try looking at these lists for ideas:
serve a lightweight static website from RAM or a well-optimized webapp and it will handle a decent amount of traffic
I'd probably never pick having some device running 24/7 when there are 3$ VPSes