A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
No trolling.
Resources:
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
The trouble with cloudflare is that there is just one. It’s one of the best registrars out there, the only free/cheap and usable DNS host (have you seen what route53 charges per zone??). That without getting into the whole tunnels and DDoS mitigation end of things, which is nearly unique at any price point.
The problem with cloudflare is that we’re missing three other cloudflares to move to if they decide to pull evil shit.
The bigger trouble is creating a CDN has a stupidly high barrier to entry. You literally need your own data centers across the world, your own server infrastructure, the man power to manage it, etc.
You could try to host it on a cloud provider but you’d go bankrupt even quicker. Unless someone were to try to build a co-op run CDN, it’s just not gonna happen without a profit motive and a large amount of capital.
That’s true. The bizarre paradox of the centralization of edge infrastructure is real.
That said, the other edge-lords (haha) could offer similar functionality, but they chose not to.
I once realized so many of my favourite businesses were cooperatives. I started thinking of what other co-ops I could start and grow. The excitement faded once I realized it would have to not be about the money.
Coops are still about the money. They're about saving money by sharing resources with fellow workers/consumers, and maintaining democratic control over the company. You're not going to get rich from a coop (without embezzlement), but you and your coowners will be cutting out the middle man. Obviously, it only makes sense for industries that you're heavily invested in.
It's not the only free DNS service.
It's only a good registrar if you don't care about privacy and you're ok with their selection of TLDs (selected only from registries without privacy).
The free accounts do not benefit from DDoS protection. Re-read their terms of service, they're vague on purpose. If you were ever DDoS'ed (I don't know who would bother btw but that's another discussion) they'd just drop you.
You can establish the tunneling thing on your own with any VPS.
The problem with cloudflare is that we’re missing three other cloudflares to move to if they decide to pull evil shit.
You can and should diversify your services and spread them to different providers that are easy to switch. I've been with "all in one" providers before, they inevitably end up leveraging their convenience into all sorts of crap. But until you get burned a couple of times they look really good.
only free/cheap and usable DNS host
Check out desec.io als an alternative
there is just one
Well it's cloudflare, not cloudsflare. Maybe overcasthosting, or sunblockservers...
Why does Cloudflare get a pass on the "if it's free, you're the product" mantra of the self-hosting community? Honest question. They seem to provide a lot for free, so...
It's usually free tiers of paid products
That makes sense, except Google kinda does the same thing. Everything they have is technically just a "free tier" of the Google One subscription, right? I guess I'm saying that "free tier of paid product" doesn't automatically qualify a company as trustworthy for me. Is there something else that sets Cloudflare apart?
For me personally, it was all about balance.
15 years ago, Gmail/Inbox was a great email client, the domain was great and popular (so no need to spell it out for people) and I would "pay" by getting ads based on my emails read by a bot.
Now Gmail is a terrible email client, the best updates are ridiculous things like moving buttons around and it takes Google years to roll out. The thing loses emails, mislabels and misclassifies stuff and the rules work for a week then blow up. On top of that, google is now basically a proctologist considering how far up my ass they want to go
The balance is broken... Google now officially sucks (IMO)
In my opinion, the difference with Google is that Google is actively using your data and you're giving them a lot of it. For Cloudflare, what do they have exactly? Depends on what services you use, but really all they get from me is the list of servers that connect to my domains. Google does that too if you use 8.8.8.8, or if you have any of their hardware that overrides router DNS settings like Chromecast and Google TV.
Strictly speaking, they’re leveraging free users to increase the number of domains they have under their DNS service. This gives them a larger end-user reach, as it in turn makes ISPs hit their DNS servers more frequently. The increased usage better positions them to lead peering agreement discussions with ISPs. More peering agreements leads to overall cheaper bandwidth for their CDN and faster responses, which they can use as a selling point for their enterprise clients. The benefits are pretty universal, so is actually a good thing for everyone all around… that is unless you’re trying to become a competitor and get your own peering agreement setup, as it’d be quite a bit harder for you to acquire customers at the same scale/pace.
we should definitively have a wiki (though people should use "search" too, I wonder if a wiki would help really). This "topic" comes every month. I have posted this already, here it goes again: https://github.com/anderspitman/awesome-tunneling
Sure it's easy to set up, but the same behaviour is what I get with my handrolled solution. I rent a cheap VPS with a fixed IP solely for forwarding all traffic through wireguard. My DNS entries all point to the VPS and my servers connect to the VPS to be reachable. It is absolutely network agnostic and does not require any port shenanigans on the local network nor does it require a fixed IP for the internet connection of my home server.
Data security wise the HTTPS terminates on my own hardware (homeserver with reverse proxy) and the wireguard connection is additionally encrypted. There are no secrets or certificates on the rented VPS beyond the bare minimum for the wireguard tunnel and my public key for SSH access.
Shuttling the packets on the VPS (inet to wireguard) is done by socat because I haven't had the will or need to get in the weeds with nftables/iptables. I am just happy that it works reliably and am happy to loose some potential bandwidth to the kernelspace/userspace hoops.
Does this cause all traffic at the reverse proxy to appear to come from the source IP of your VPS or does it preserve the original source IP?
I've been working on setting up a similar setup myself and am trying to figure out specifically how to handle the forwarding on the VPS.
I also have a similar setup to maiskanzler. But I use iptables to forward the traffic over wireguard and I am able to preserve the original client IP by not snat the packets. I then have to use policy based routing to make sure that traffick goes back out through the wg tunnel.
I'm happy to share info on how to get this working.
That’s a good setup.
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:
| Fewer Letters | More Letters |
|---|---|
| CF | CloudFlare |
| CGNAT | Carrier-Grade NAT |
| DNS | Domain Name Service/System |
| HTTP | Hypertext Transfer Protocol, the Web |
| HTTPS | HTTP over SSL |
| IP | Internet Protocol |
| NAT | Network Address Translation |
| SSH | Secure Shell for remote terminal access |
| SSL | Secure Sockets Layer, for transparent encryption |
| SSO | Single Sign-On |
| TCP | Transmission Control Protocol, most often over IP |
| TLS | Transport Layer Security, supersedes SSL |
| VPN | Virtual Private Network |
| VPS | Virtual Private Server (opposed to shared hosting) |
13 acronyms in this thread; the most compressed thread commented on today has 8 acronyms.
[Thread #830 for this sub, first seen 26th Jun 2024, 04:45] [FAQ] [Full list] [Contact] [Source code]
It's almost like the big tech companies are really good at their jobs....
Unless you are behind CGNAT; you would have had the same plug+play experience by using your own router instead of the ISP supplied one, and using DDNS.
At least, I did.
Yes, but it does expose your own IP address and thus where you live. Tunnels don't.
True, but the downside of cloudflare is that they are a reverse proxy and can see all your https traffic unencrypted.
I also really like the tunnels feature. It makes self hosting at home easy for those under NAT/CGNAT or whatever it was called.
I prefer Tailscale Funnel for these kinds of things. NetBird and ZeroTier also work just fine if you don't want to expose your services to the public.
Tailscale is so cool too. I'll definitely be switching if I can ever use my own domains
Just stop supporting the biggest actor in the market.
That's just a bandaid on capitalism's issues. Urging people not to support the biggest actor will never work in the grand scheme of things, when said actor provides their best immediate interests.
I use Cloudflare as my registrar and public DNS. And only for that. Sorry but they don't get to peek at my network traffic.
Well, centralization and giving up your freedoms, letting someone else control you, is always kinda easy. Same applies to all the other big tech companies and their platforms. I'd say it applies to other aspects of life, too.
And I'd say it's not far off from the usual setup. If you had a port forward and DynDns like lots of people have, the Dns would automatically update, you'd need to make sure the port forward is activated if you got a new router, but that's pretty much it.
But sure. if it's too inconvenient to put in the 5 minutes of effort it requires to set up port forwarding everytime you move, I also don't see an alternative to tunneling. Or you'd need to pay for a VPS.
Their static website hosting is probably the best in the business. We seriously need some competition though.
I mean, I used to think Google Public DNS was great until I switched to 1.1.1.1...
If you like 1.1.1.1 the. You should try 9.9.9.9. Or better yet host unbound pihole if you’re up to the challenge. Best dns experience I’ve had.
I am out of the loop, what's going in with snooping?
I use their cloudflared tunnel sometimes for accessing home hosted stuff.
Because Cloudflare acts as a reverse proxy it can see everything that happens in a session.
This is also known as a man in the middle attack. But Cloudflare meds to do this in order to do it's checks for bad actors.
Now, as Cloudflare has access to the unencrypted traffic and we know that NSA is all about data vacuuming due to the Snowdn leaks we can make a tin foil hat guess whaylt goes on.
Just note, OP, that the last part of his statement is pure speculation. The first part is technically true, which can lead to that inference, but no information has been released which corroborates it. However, that does not mean it’s not possible.
This is true. Which is why I said tinfoil hat guess.
Though those leaks showed they actually did it on a large scale. I don't think they stopped for some arbitrary reason. Why would they? And technology developed further, surveillance is only getting easier. I'd say even without a tin-foil hat on, it's more likely they do it than not.
I don’t understand why Cloudflare gets bashed so much over this… EVERY CDN out there does exactly the same thing. It’s how CDN’s work. Whether it’s Akamai, AWS, Google Cloud CDN, Fastly, Microsoft Azure CDN, or some other provider, they all do the same thing. In order to operate properly they need access to unencrypted content so that they can determine how to cache it properly and serve it from those caches instead of always going back to your origin server.
My employer uses both Akamai and AWS, and we’re well aware of this fact and what it means.
I use cloud flare tunnel for my home server too. Are there any viable and somewhat easy alternatives?
Get a cheap VPS and set up a VPN of your choice.
Just make sure the VPS will shut down if the bandwidth is exceeded rather than giving you a big overage charge.