— GPG Proofs —

This is an OpenPGP proof that connects my OpenPGP key to this Lemmy account. For details check out https://keyoxide.org/guides/openpgp-proofs

[ Verifying my OpenPGP key: openpgp4fpr:27265882624f80fe7deb8b2bca75b6ec61a21f8f ]

  • 0 Posts
  • 37 Comments
Joined 2 years ago
Cake day: July 10th, 2023
  • pezhore@infosec.pubtoTechnology@lemmy.world•New downloads of DeepSeek suspended in South Korea, data protection agency saysEnglish
    1·
    5 days ago

    I’m doing that with docker compose in my homelab, it’s pretty neat!

    services:
  ollama:
    volumes:
      - /etc/ollama-docker/ollama:/root/.ollama
    container_name: ollama
    pull_policy: always
    tty: true
    restart: unless-stopped
    image: ollama/ollama
    ports:
      - 11434:11434
    deploy:
      resources:
        reservations:
          devices:
            - driver: nvidia
              device_ids: ['0']
              capabilities:
                - gpu

  open-webui:
    build:
      context: .
      args:
        OLLAMA_BASE_URL: '/ollama'
      dockerfile: Dockerfile
    image: ghcr.io/open-webui/open-webui:main
    container_name: open-webui
    volumes:
      - /etc/ollama-docker/open-webui:/app/backend/data
    depends_on:
      - ollama
    ports:
      - 3000:8080
    environment:
      - 'OLLAMA_BASE_URL=http://ollama:11434/'
      - 'WEBUI_SECRET_KEY='
    extra_hosts:
      - host.docker.internal:host-gateway
    restart: unless-stopped

volumes:
  ollama: {}
  open-webui: {}
  • pezhore@infosec.pubtoSelfhosted@lemmy.world•How do you all handle security and monitoring for your publicly accessible services?English
    4·
    13 days ago

    This is the way. Layer 3 separation for services you wish to access outside of the home network and the rest of your stuff, with a VPN endpoint exposed for remote access.

    It may be overkill, but I have several VLANs for specific traffic:

    • DMZ - for Wireguard (and if I ever want to stand up a Honeypot)
    • Services - *arr stack, some Kubes things for remote development
    • IoT - any smart things like thermostat, home assistant, etc
    • Trusted - primary at home network for laptops, HTPCs, etc

    There are two new additions: a ext-vpn VLAN and a egress-vpn VLAN. I spun up a VM that’s dual homed running its own Wireguard/OpenVPN client on the egress side, serving DHCP on the ext-vpn side. The latter has its own wireless ssid so that anyone who connects to it is automatically on a VPN into a non-US country.

  • pezhore@infosec.pubtolinuxmemes@lemmy.world•What's with the overkill hardware setups?
    8·
    24 days ago

    I don’t know if I can completely explain the difference, but I would classify myself as a home labber not a self-hoster.

    I use Proton for email and don’t have any YouTube/Twitter/etc alt front ends. The majority of my lab (below) is storage and compute for playing around with stuff like Kubernetes and Ansible to help me with my day job skills. Very little is exposed to the Internet (mostly just a VPN endpoint for remote lab work).

    I view self-hosting as more of a, “let me put this stuff on the internet instead of of using a corporation’s gear” effort. I know folks who host their own Mastodon instance, have their own alt front ends for various social media, their own self-hoster search engines.

  • pezhore@infosec.pubtoSelfhosted@lemmy.world•What are your Homelab goals for 2025?English
    1·
    2 months ago

    For the nginx reverse proxy - that’s how I ran things prior to moving to microk8s. If you want I can dig out some config examples. The trick for me was to set up host based stanzas, then update my internal DNS to have A records for each docker service pointing to the same docker host.

    With Kubes + external-dns + nginx ingress, I can just do a deployment/service/ingress and things automatically work now.