this post was submitted on 13 Nov 2024
190 points (96.6% liked)

Selfhosted

40677 readers
641 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

  1. Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.

  2. No spam posting.

  3. Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.

  4. Don't duplicate the full text of your blog or github here. Just post the link for folks to click.

  5. Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).

  6. No trolling.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 2 years ago
MODERATORS
 

I never could get Nix working but maybe someone will

top 50 comments
sorted by: hot top controversial new old
[–] tatterdemalion@programming.dev 42 points 1 month ago* (last edited 1 month ago) (1 children)

Wireguard is p2p.

EDIT: I guess the point is it's doing peer discovery without static public IPs or DNS. Pretty cool!

[–] infeeeee@lemm.ee 10 points 1 month ago* (last edited 1 month ago) (1 children)

Or port forwarding. You have to open a udp port for wireguard

[–] offspec 2 points 1 month ago (1 children)

Technically you can nat punch with wire guard

[–] possiblylinux127@lemmy.zip 6 points 1 month ago (1 children)

How do I learn this power? Don't you still need at least one server exposed?

[–] tehfishman 3 points 1 month ago

Afaik you need some external resource to coordinate the punch. The STUN protocol is purpose built for this, and both clients need to be able to reach a STUN server to coordinate which port and public IP they'll try to connect to each other on. I assume this does something similar but with p2p network tech instead of a STUN server.

[–] infeeeee@lemm.ee 28 points 1 month ago (3 children)

Interesting, it's on AUR, I will try it.

So it doesn't need any port forwarding, and works on CGNAT? How the "NAT hole punching" works? Both clients connect to something on IPFS?

Afaik, for DHT with torrent, clients need to know at least one tracker, what is the "tracker" here? Something on IPFS? Who am I sending my IP addresses?

How much overhead does this add to speed? I love with Wireguard, that it's barely noticeable, really close to p2p speeds, OpenVPN was awful in this regard.

[–] possiblylinux127@lemmy.zip 11 points 1 month ago* (last edited 1 month ago) (1 children)

First off great find. I didn't think to check the AUR. I personally wouldn't use it as that version is 3 years out of date but its existence means that it might be entirely possible to get a non Nix version. I'm not sure I fully understand why it needs Nix OS but what do I know.

It is all libp2p magic

There have been lots if talks on libp2p and Nat traversal. I suggest you check them out. How it actually works is pretty complex and requires someone more knowledgeable than me to explain. One way it works is that both devices start a TCP connection at the same time which gets the proper ports to open up.

[–] infeeeee@lemm.ee 14 points 1 month ago* (last edited 1 month ago) (1 children)

AUR packages ending with"-git" or "-svn" always pull the latest commit from source. The version number means that was the last time the packager had to change something on the PKGBUILD script, not the actual version which would be installed.

Where should I look? Where were these talks? I'm interested.

Edit: I found the whitepaper about hole punching: https://research.protocol.ai/publications/decentralized-hole-punching/

It says it connects to a "Hole Punch Coordination (DCUtR - Direct Connection Upgrade through Relay)". So for NAT traversal to work, you need a third party, this relay. As I expected. I guess you can self host this, but than you could just host a wireguard server. I guess if you are on a locked down network where you cannot connect to any relay (e.g. how the Chinese Great Firewall works technically they could block it) you can't initiate a connection behind a NAT.

Nonetheless it seems interesting, but no magic here. Maybe the big difference that the relay servers are distributed, so no central authority to block easily.

[–] Jenseitsjens 2 points 1 month ago (1 children)

That doesn't match my experience with AUR at all. Usually it pulls a specific git revision and checks the hash. This also ensures that the build shouldn't suddenly fail to some extent.

Though it's entirely possible that it's not like this for all packages, though I find it kind of counterintuitive since your package manager wouldn't know when to perform an update in this case.

[–] infeeeee@lemm.ee 3 points 1 month ago

It's documented in the wiki, they are called VCS packages, and it's not the usual, they work a bit differently: https://wiki.archlinux.org/title/VCS_package_guidelines

You can see in this instance, that it skips the sha checking for upstream source, in line 15 of the PKGBUILD it says 'SKIP': https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=hyprspace-git#n15

sha1sums parameter is documented in the wiki: https://wiki.archlinux.org/title/PKGBUILD#sha1sums

In the PKGBUILD file you can list sources (line 12,13) and their respective checksums (line 14,15). In this PKGBUILD there are 2 sources: the first is the systemd unit file, it's coming from the package's AUR repo, not from upstream, you can see its checksum. The second source is the actual source, and you can see, it's checksum is 'SKIP' so it shouldn't be checked.

With these kind of packages you can't get notified if there is an update available, but if you install it again with your favorite AUR helper it would update itself for the latest version. It calculates version number from the latest commit hash, before building and installing, so if that is the same it won't update again.

[–] possiblylinux127@lemmy.zip 2 points 1 month ago (1 children)

The PKGBUILD looks like it is just building via go. I'm not sure how you would configure it without Nix. I'll try building it.

[–] infeeeee@lemm.ee 2 points 1 month ago

Nix just calls the *.nix files, it's still go under the hood. PKGBUILD is similar to the flake.nix and package.nix files to me, but I have no experience with nix.

load more comments (1 replies)
[–] cellardoor 13 points 1 month ago (2 children)

YAML?? (╯°□°)╯︵ ┻━┻)

[–] infeeeee@lemm.ee 32 points 1 month ago* (last edited 1 month ago) (3 children)
what:
  is:
  your:
    - problem
    - with:
      YAML
# At least you can have comments unlike in json. Who need comments in a config file anyway.
[–] flubba86 12 points 1 month ago

Toml is superior to all.

[–] itslilith@lemmy.blahaj.zone 11 points 1 month ago (2 children)

Nothing too major about how it's usually used, but the yaml spec does allow arbitrary code execution when parsing a file and relies on the parser to have that feature disabled: https://en.m.wikipedia.org/wiki/YAML#Security

That's why for python, yaml.save_load() is a thing. That's fine for your local config files and may even be a feature for you, but it shouldn't be used to exchange information between services.

[–] netvor 1 points 5 days ago (1 children)

nit: you mean yaml.safe_load().

[–] itslilith@lemmy.blahaj.zone 1 points 5 days ago

Oh yeah, of course.

[–] infeeeee@lemm.ee 8 points 1 month ago (2 children)

My general view is similar, yaml is better if it should be written by humans, json is better if it should be written and read only by a machine. but hyprspace uses json for configuration, so I don't really understand cellardoor's comment

[–] itslilith@lemmy.blahaj.zone 4 points 1 month ago

Yeah I agree. Although recently I've become partial to toml... In the end I'll use what's common in the ecosystem I'm developing in

[–] FierySpectre 2 points 1 month ago

Xml has entered the chat

[–] Zangoose 9 points 1 month ago

Hey did you know that any JSON file is also a valid YAML file? I bet you'll love YAML a lot more now that you have this information

[–] corsicanguppy@lemmy.ca 5 points 1 month ago

Careful. The yaml cult will come after you in a long and formless column, and only self destruct when one of them is a step too far to the left.

This reminds me of nebula although nebula does require a central server to coordinate hosts.

[–] semperverus 3 points 1 month ago (1 children)

Is this made by the same guy who does hyprland?

[–] Andres4NY@social.ridetrans.it 10 points 1 month ago (1 children)

@semperverus @possiblylinux127 No, this other person has a working 'e' key on their keyboard.

[–] mexicancartel@lemmy.dbzer0.com 3 points 1 month ago

Eh what its hyprspace. The title is incorrect but the link says hypr

[–] DieserTypMatthias@lemmy.ml 2 points 1 month ago* (last edited 1 month ago) (2 children)

What about Tailscale? I know it's Proprietary software, but still.

[–] drathvedro@lemm.ee 12 points 1 month ago (5 children)

Tailscale... is not that good. The underlying wireguard is robust, but tailscale control plane is completely proprietary, as well as their DERP servers that it too often uses completely needlessly. They can also block you off from downloading it, updating, or logging in, if you happen to be in a wrong country.

I'm myself looking for an alternative to it, but having trouble finding something I could share with non tech savvy friends while not being as complex on my end as, say, open/strongswan ais. Any suggestions welcome.

[–] sorter_plainview@lemmy.today 7 points 1 month ago (1 children)

Have you considered having Headscale on a cheap VPS? We are actually doing that and it is pretty capable. IIRC, you can configure not to use the tailscale servers at all, and use your own public VPS for coordination. Bonus point, tailscale hired the Headscale developer and maintainer, and they are allowed to work on Headscale while on their payroll. The team looks very much into FOSS.

[–] drathvedro@lemm.ee 2 points 1 month ago (2 children)

Yep. That's the number one contender. Well right after overriding default DERP's with my own VPS machines. I'll definitely try it out over some weekend.

One of my other concerns with this and other solutions suggested is the reliance on wireguard which can be subject to fingerprinting and censorship. Do you happen to know if it'd be possible to swap out Headscale's implementation of wireguard to amnezia? I'll have to do my homework anyway, but who knows, maybe there are some pitfalls to avoid.

load more comments (2 replies)
[–] histic@lemmy.dbzer0.com 6 points 1 month ago

I use zerotier personally

load more comments (2 replies)
[–] possiblylinux127@lemmy.zip 11 points 1 month ago

Tailscale is actually a lot more open than you think. The agents are all foss and there is a self hostable version.

[–] exu@feditown.com 2 points 1 month ago (4 children)
load more comments (4 replies)
load more comments