The Star Trek “Prophecy” might actually come true! :o

In all seriousness, it makes a whole lot more sense now that the consequences of Brexit are disproportionately felt by the population in the north.

They probably mean this: https://mycroft.ai/blog/update-from-the-ceo-part-1/

Hey 1960’s, I have a quick question:

What the fuck??!! 😂😂

They finally banned AfD???

No, but still good news.

Read a publisher called Wired

Look inside

No wires…

You should do application level backups and put those in backblaze b2:

• for postgres look here.
• look at all the software you’re running and what they say about making backups.
• for files that don’t change often, making a an archive (with tar) is probably good enough. But if it changes during making the archive, the backup will be inconsistent.
• think about your RPO: how much data are you willing to loose in case of a crash? 1 day? 2 hours? 15min? Schedule your backups to be at least as frequent.
• Don’t forget to test your backups! Otherwise you’ll only find out that the backup is unusable when you need it most…

Those are very good things to think about; I agree with all of that.

None of the suggestions I made cover what actual information you (or your users) share ont the platforms (lemmy, mastodon etc).

As long as you federate with other servers (I.e. allow content to be shared with other servers, like how my account on my own server can comment on a post from the server you’re using), all the information posted on the platform should be considered 100% public.

If you want a place for just your friends, without talking with other instances, you should keep federation off.

I want to spin up my own services so that I own my data and have greater control over my connections, and possibly have a hub that friends and family can use.

That’s a noble goal; but you’ll have to think about what kind of adversaries you want to protect yourself (and your users) from.

E.g. if you don’t want to link your lemmy account to your government name you of course won’t use your real name, but you’ll also need to anonymize the WHOIS data of the domain, since that’s public information.
Not all domain registrars allow this.

And depending on how far you want to take this, you might also want to buy the server anonymously.

All of that doesn’t even touch the security of the actual server, lol. Some pointers for that:

SSH

• use keys for to login, not passwords
• use a different port than 22 (it’s not more secure, but will reduce noise in the logs)
• install fail2ban (temporary blocks ips after a few failed attempts)
• make SSH only reachable from your home IP with a firewall

HTTP/S:

• use a caddy or nginx proxy in front of anything that talks http.
• use letsencrypt certificates (and check renewal is working)
• use proper SSL settings: https://ssl-config.mozilla.org/

VPS hosting:

• setup 2FA for your login

Monitoring: You can get very detailed, but try to cover at least the following:

• uptime (request your lemmy homepage)
• disk usage over 80%
• SSL certificate expiration

If I spin up my own instance, won’t that expose my domain, since my username will be @username@example.com ?

Yes (click on my username for example).

What are your reasons for not exposing your domain? And why do you want to set up your own instance?

If you don’t want that, just make an account at another instance. There’s a few big ones to choose from, I think.

(I have no idea if this is true for xmpp too)

If you do setup your own server. Please make sure you automate regular backups and put them somewhere safe. Otherwise you might loose all your stuff.

Both nginx and apache are webservers and can do what you need.
Apache calls this Name-based Virtual Hosts. (see ServerName/ServerAlias)
Nginx calls this Name-based virtual servers (see server_name in the docs)

Either will listen on ports 80/443 on the IP and proxy the request depending on the hostname used. If you’re not really familiar with either, I would recommend nginx. It’s very popular, the documentation is good and the syntax is a lot better IMO.

I hear caddy is also a nice alternative with even simpler syntax, but I haven’t used it myself.

Good luck!

I can see how you’re not yet familiar with all these terms :p Both nginx and apache are http servers and work the exact same in your case.

The server (apache or nginx) listens on the IP on port 80 and 443. Depending on the hostname that is used to connect, the request is proxied to a different location. Apache calls this virtual hosts, nginx call this virtual servers

Please correct me if I’m wrong, but here’s what I think the situation is:

• you have two different sevices that you have domains for, e.g. lemmy and bitwarden.
• you have two domains, lets call them lemmy.com and bitwarden.com .
• you have one (public?) IP address. let’s call that 123.123.123.123 .
• you want to use this IP address for both domains (e.g. bitwarden.alpha.com and lemmy.beta.com)

In that case you need both domains to connect to the same computer (because that’s the one with that IP address) which routes it to the correct location (either on the same computer or on a different one).

You basically have two solutions (that you already mentioned)

1. single machine

• You run both services on a single machine, listening on different ports on localhost/127.0.0.1 .
  • lemmy listens on port 1234 and bitwarden on port 8080.
• You use nginx (or caddy/apache) to listen on the web ports (80, 443) and reverse proxy(!) the content.
  • if the domain is lemmy.com it proxies from localhost:1234
  • if the domain is bitwarden.com it proxies from localhost:8080 This is the easiest solution IMO.

2. different machines.

This is essentially the same, but instead of the services running locally, one or both run on different machines.

• you run both services on different machines
  • lemmy on 10.0.0.10:1234
  • bitwarden on 10.0.0.20:8080
• You use nginx again as reverse-proxy(!):
  • if the domain is lemmy.com it proxies from 10.0.0.10:1234
  • if the domain is bitwarden.com it proxies from 10.0.0.20:8080
• be sure to check the firewall settings of the machines, that allow it.

In both cases the IP address points to the machine running nginx.

If you can run both services on the same machine with docker, you should just use this: https://github.com/nginx-proxy/nginx-proxy