45
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 07 Jul 2024
45 points (100.0% liked)
Selfhosted
39877 readers
333 users here now
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
-
No spam posting.
-
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
-
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
-
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
-
No trolling.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
founded 1 year ago
MODERATORS
No.
3-2-1
Three copies; your working copy, and a cloud copy, and (as an example) on and external HD that you keep at a friend’s house….
On two separate media… so yes cloud can cover that
One off site. So yeah cloud covers that.
Encryption on your off site copies. Yeah I don’t care if they are Linux ISOs or your grandmas recipes. ENCRYPTED
Thanks for coming to my TED talk
And I would argue that all data should be encrypted now, even the working copy. If you have data that's worth backing up, you probably don't want it in the hands of criminals or weirdos either.
It's so easy to set up, just tick a box during os install most times. Then if you do rcline just use an encrypt on top of your remote, make sure your conf is backed up, and you're golden
If you tick the encryption box during install, you will have to enter the decrypt password at every boot and that means that if the power goes out for long enough (UPS doesn't keep the server up for hours), I (and my family) will not have access to the self hosted stuff until I'll be home and this is why I encrypt only the data partition and not the boot one.
You can decrypt via ssh at boot. I used dropbear to accomplish that on my machine
That's interesting, but that won't help if I'm away or on vacation on the other side of the world
I may be missing something in your use case. As long as you have the port forwarded you can decrypt from anywhere. Use pub key auth and you're good to go
You're just missing the part where I want to be on vacation without the need to find a decent Internet connection to boot my server because the power went off. What's the plus of encrypting the OS partition too?
Fair enough. Every service I run depends on encrypted data, so starting the machine without decrypting isn't worthwhile in my case. I have to decrypt to get everything back up after power loss anyway.
Main advantages I'm aware of for full disc encryption are encrypted swap and system config. Overkill for some use cases so YMMV, but wanting to point out that decrypting at boot can be done.
Thanks for your point of view. All of my services are containers that have config and data folder bind mounted from an encrypted partition. After power on, a script download from a website half of the key needed to decrypt data, the other half is in the boot partition. In this way if my server gets stolen I can delete the half key stored on the website and the data disk can't be decrypted. About swap, you're right, but that doesn't worry me at all since I don't think that there's anybody that would goes into that trouble just for my data. If someone is able enough and takes the trouble to read it, I guess that's going to be the last of my problem: it would mean that I'm already in biiiiig troubles! 😆
Agreed… Yes, and… specific to backups all the encryption….
Your production stuff, yes should be as well