Of the many useful things I could do with my spare time instead I’m setting up a Lemmy instance because why not. The scope of this is definitely greater than any self-hosting I’ve ever attempted, so please feel free to tell me just how much trouble I’m in. I’m just giving the broad strokes to see if I’ve made any crucial errors (other than deciding to do this at all).
And if this is a completely wrong place for a post like this or I’m missing data I’m supposed to include I apologize, I probably need a sanity check, in more ways than one.
First limitation, I’ll be hosting it on an existing Linux Mint box acting as a file share mostly and occasional gaming PC/movie streaming box. Its hardware is overkill for this, I do not anticipate issues when it is in use. It receives regular updates and weekly reboots, instance will be set to automatically restart. NVMe with loads of space for local storage, RAID SSDs for data offload/backup.
Second limitation, I hate Cloudfare and Oracle. I do not want to use either of them.
Third limitation, money. Cheaper is better. I have a URL picked out and a registrar which will give me the cheapest long term option, in case I actually keep this thing going.
Last limitation, I’m already in over my head so I’ll be relying on a lot of googling and probably some chat bots to figure things out as I go through the actual deployment process. What could go wrong?
So, Lemmy hosted on Linux Mint box using Docker containers. ISP is a good one for this I’m told, no CGNAT, largely stable public IP but I’ll have a script running in case it does change. Confirmed ports 80/443 are open. Using Caddy for the HTTPS. Closed registration to start, if by some miracle I make it to actually wanting to allow additional users it will not be fully open, and I’ll use Brevo for the email SMTP. Security wise I know I’m making it harder for myself by exposing my IP, I’m going to have UFW running and Crowdsec to help keep incoming bad traffic out.
Down the line I’ll get Lemmy updates, backups, retention rules in place/automated, and make decisions on federation, etc. Thoughts?
Probably, yes, but I still love you
You sound like my wife.
Plot twist. You are not married…
Sure I am, but depending on how much of my free time goes into this we’ll see if it stays that way…
Best of luck on your new hobby!
I didn’t see anything in your post that set off alarm bells
If you’re looking to save some cash and your ISP gives you a stable public address you could utilize a Dynamic DNS provider (ala duckdns) instead of registering a domain
Good point, that was purely a vanity issue: I have a specific name I want for my instance, and I wanted it to be as short a URL as possible so I was willing to spring for the domain. I’m not saying I’m doing all this just for the pun I have in mind, but I did spend far too long on that step of my deployment plan.
I would NOT host a Lemmy instance at home unless you’re going to obfuscate your IP address. If you make it public, you’re inviting any whackjob that sees your username to find your physical location. Additionally, I wouldn’t host it on a PC that you actually intend to use for day to day stuff, just in case the instance gets hacked and someone manages to escape the container it’s in. If you wanted to do this, I would put it on its own box with Cloudflare in front of it, otherwise you’re inviting trouble where there doesn’t need to be any.
I keep seeing “escape the container” mentioned like it’s a very common occurance. Is it really? I’ve looked up escape CVE’s and they seem to be few and far apart, they’re usually tricky to pull off, and when one comes out it’s a big deal and they get fixed right away (obv).
Actually my issue isn’t “do escape CVE’s exist”, it’s more like, should I really waste my time planning for it? It’s like planning for file permissions not to work, or logins to be bypassed.
I get that shit happens and why defense in depth is a thing but how do you defend from something so fundamental? If you operate under the assumption that containerization can be by bypassed, and virtualization can be bypassed, where do you draw the line and what do you do, run each app on a standalone physical box?
I would say that finding that balance is up to the individual admin and application, really, which is where the defense in depth comes in. Yeah, it’s rare, and if those exploits are being used it means you’ve got the attention of someone you probably can’t really stop, but it’s something to take into consideration. Bad configs can cause data leakage across container boundaries, too, so without knowing the admin’s skill level, I tend to recommend against sharing that hardware with something that might have something valuable on it. AI has made it easier for script kiddies to find zero-days and exploit APT-level vulnerabilities, too.
Just in general or because you’re setting up a Lemmy instance?
Well in general I know I’m an idiot, so for the moment I’ll just stick with Lemmy instance feedback cause that’s at least easier for me to address without expensive therapy.
allow additional users it will not be fully open
Just for trusted friends or randos? If randos, have you ever been a mod? Never set up a Lemmy instance, but I have been a mod of quite a few Reddit subs. It’s a headache I will never engage in again.
Not complete randos, but yeah it’ll likely be a very minimal group of people if at all. And I’m not looking forward to modding so I doubt I’ll go the route if having a lot of comms in my instance, but we’ll see what happens.
Alright man. Best of luck. Give it a go. You’ll never know how it will turn out unless you try.
Thought about doing something very similar, I’ll be curious to hear the feedback and your experience
If at some point in the near future you step outside and hear a weird screaming sound echoing around the globe, that’s me.
Yes, you are, but aren’t we all?
I keep considering the same thing, except only letting myself register so that I can have my own stupid instance name.
The problem is not the setup but the administration
So I’m discovering, heh. I got the instance up in a relatively short period of time, I’m spending far more time on email, domain, logging, backups, decisions, etc. I know I could just be a barebones “who cares about any of that” instance since it’s largely gonna be my own personal playground, but where’s the fun of that?
I would not do that without first looking into applicable laws regarding legal liability for content and requirements to remove things. Depending on where in the world you are, this can be a minefield.
Yeah that’s a future line item if I make it far enough, heh. It’s under the “who to federate with” bullet point.
You should not host anything that’s going to be public facing on your home network in 2026, period. Get a cheap German VPS and go nuts with it. There’s simply too much at stake opening up your home router/firewall for such little gain. Plus, being a residential IP behind NAT might just make it straight up impossible.
I host my own email and a matrix server. I would never think of exposing my home network to the internet. I use tailscale to get into the homelab, anything exposed to the net lives somewhere far, far away.
I use netcup for my email and matrix. It’s extremely reasonable.
I also don’t get this fear. Assuming you aren’t blindly exposing your entire filesystem or opening tons of ports what is the risk?
Update with a link to your instance when you’ve done it so we can show some love and support
Do it. You’ll learn something new. Maybe you’ll even contribute to the code.
I probably wouldn’t host it at home, there are so many personal devices containing personal information on the network that I don’t consider the risks involved worth it. I would get a VPS, even if they’ve increased in price lately. If you do set it up at home, you will have to harden the server and the network, and that requires a lot of time, knowledge and effort. Just keep this in mind!
You can easily sequester your personal stuff from your self hosted stuff. Most traffic going anywhere is encrypted as it should be. The main concern is lateral movement hence the network isolation.
I think the bigger concern is someone uploading CP to it and then maybe having your house raided by the cops. Even if you completely separate your personal files from the lemmy server, the police are just going to seize every computer in the house. And the fact will remain that they found CP on your computer. The burden of proof then falls on you to prove that it wasn’t you who put it there.
oh very interesting. i’ve been wanting to get into the details of how federation actually works, and i wanted to figure out why mastodon<->lemmy federation does often not seem to work. but i guess that’s a deep rabbit hole too!
It does work! To an extent. It’s just not popular to do this… Because of the extent. No votes, easy to find threads, etc.
Honestly I could help you. If I had the time.