because you want to learn them or just think they’re neat, then please do! I suspect a lot of people with these types of home setups are doing it mostly for that reason
That's an interesting take.
because you want to learn them or just think they’re neat, then please do! I suspect a lot of people with these types of home setups are doing it mostly for that reason
That's an interesting take.
Are you sure? A big bank usually does... It's very common to see groups of physical machines + public cloud services that are more strictly controlled than others and serve different purposes. One group might be public apps, another internal apps and another HVDs (virtual desktops) for the employees.
Kinda Scenario 1 is the standard way: firewall at the perimeter with separately isolated networks for DMZ, LAN & Wifi
What you're describing is close to scenario 1, but not purely scenario 1. It is a mix between public and private traffic on a single IP address and single firewall that a lot of people use because they can't have two separate public IP addresses running side by side on their connection.
The advantage of that setup is that it greatly reduces the attack surface by NOT exposing your home network public IP to whatever you're hosting and by not relying on the same firewall for both. Even if your entire hosting stack gets hacked there's no way the hacker can get in your home network because they're two separate networks.
The scenario one describes having 2 public IPs, a switch after the ISP ONT and one cable goes to the home firewall/router and another to the server (or another router / firewall). Much more isolated. It isn't a simple DMZ, it's literally the same as two different internet connections for each thing.
~~If you're using a VPS from Amazon, Digital Ocean or wtv you're by definition not self-hosting. Still dependent on some cloud company, so not self-hosting in a pure sense...~~ misread comment.
~~Is that still... self-hosting? In that case you would be hosting in a cloud company so... ~~
misread comment.
I'm curious is there documented attacks that could've been prevented by this?
From my understanding CPU pinning shouldn't be used that much, the host scheduler is aware that your VM threads are linked and will schedule child threads together. If you pin cores to VM's, you block the host scheduler from making smart choices about scheduling. This is mostly only an issue if your CPU is under constraint, IE its being asked to perform more work than it can handle at once. Pinning is not dedicated, the host scheduler will schedule non-VM work to your pined cores.
I'm under the impression that CPU pinning is an old approach from a time before CPU schedulers were as sophisticated, and did not handle VM threads in a smart manner. This is not the case anymore and might there be a negative performance impact with it.
If there’s an exploit found that makes that setup inherently vulnerable then a lot of people would be way more screwed than I would.
Fair enough ahah
the more complicated it gets the more likely you are to either screw up unintentionally, or get annoyed at it, and do something dumb on purpose, even though you totally were going to fix it later. (...) Pick the one that makes sense, is easy for you to deploy and maintain
This is an interesting piece of advice.
Anyway maybe I wasn't clear enough, I'm not looking to pick a setup, I've been doing 2.B. for a very long time and I do work on tech and know my way around. Just gauging what others are doing and maybe find a few blind spots :).
Thanks.
What’s your concern here?
No specific concern, I do like in scenario 2, option B. I was just listing the most common options and getting feedback on what others think about those.
I personally believe the setup 2B is more than enough if a nation state isn't after you, but who knows? :)
So you do trust LXC isolation to the point of thinking that it would be close to impossible to compromise your host?
are we talking what’s good enough security for hosting an anime waifu tier list blog or good enough security for a billion dollar corporation?
You tell me. :)
What would you do/trust in both situations?
Sorry, I misread your first comment. I was thinking you said "VPS". :)