Hey everyone! Iām completely new to self-hosting, but Iāve become convinced of its benefits and would like to get started in the near future. Iām still trying to figure out which hardware and software would be the best fit for my needs, so Iād really appreciate some advice.
What Iām looking for:
- I live in the EU and want to move away from US-based and other non-EU cloud providers, which is one of the main reasons Iām interested in self-hosting.
- I want to de-Google my digital life and replace services like Google Photos, Google Drive, and Googleās contact and calendar syncing with self-hosted alternatives.
- Iād like to automatically back up photos from my phone, sync files, contacts, and calendars, and access everything remotely.
- I want to avoid proprietary operating systems and vendor-specific apps as much as reasonably possible, ideally relying on open-source software.
- (Eventually, Iād also like to consider hosting my own email server, although Iāve heard that this comes with quite a few challenges. This isnāt a priority for now.)
- I donāt want to become a Linux or server administration expert just to keep everything running.
A little more context:
- Users: Just two people.
- Workload: Mainly file storage and syncing, photo backups and management, contacts, and calendars. No video editing, media transcoding, or other particularly demanding tasks.
- Budget: Around ā¬500ā800 for the NAS itself, excluding storage drives.
- Hardware preference: Iād prefer a compact, reasonably power-efficient, ready-made NAS rather than building a full PC, mostly due to limited space.
- Technical experience: Iāve been building my own PCs for almost 30 years and consider myself an advanced Windows user. However, my last real Linux experience was with Ubuntu about 20 years ago.
- Internet connection: 250/40 Mbps DSL with a public (dynamic) IPv4 address and a FRITZ!Box 7590 router, which supports WireGuard VPN.
Here are my main questions:
- Which operating system would you recommend? Iāve been looking into TrueNAS Community Edition and OpenMediaVault, but Iām open to other suggestions. Ease of use, stability, and low maintenance are important to me.
- Would a prebuilt NAS be a good choice? Iāve been considering devices like the UGREEN DXP4800 Plus and TerraMaster F4-424 Pro. Can their proprietary operating systems be replaced with something open-source without losing important functionality, such as fan control, power management, or hardware monitoring? Are there particular models known to work especially well with TrueNAS or OpenMediaVault?
- How much hardware performance do I actually need? Given my relatively modest requirements, would something like an Intel N100 already be sufficient, or would it make sense to invest in a more powerful CPU and additional RAM for future flexibility?
- Which software stack would you recommend? Iām currently considering Nextcloud for files, contacts, and calendars, and possibly Immich for photos. Iād prefer solutions with reliable automatic syncing and open-source Android apps.
- What should I consider regarding backups and remote access? Iām planning to use WireGuard for remote access, but Iād be interested in recommendations for a simple, reliable backup strategy as well.
Iām happy to learn new things and follow technical guides, but Iād prefer a system that doesnāt require constant tinkering once itās set up.
Thanks for reading, and I appreciate any suggestions or experiences youāre willing to share!
Apt and most package managers have cryptographic verifications on all packaged by default since the 1990s.
Docker pull does not, so it will happily download a maliciously modified image, without checking.
Thatās because package managers are designed to use mirrors. You have to verify a digital signature because the package isnāt necessarily coming from the package maintainerās repo.
Docker pulls come from the registry, not a mirror. There is no such thing as a mirror in docker. The registry is something you decide on, and if you donāt trust it, you shouldnāt use it. If the registry itself is compromised, thatās essentially like the private key of a package manager getting compromised. Same risk.
The two biggest registries are Docker Hub and GitHub. If either of them were compromised, it wouldnāt take very long for them to mitigate it. The damage would likely be very small.
Oh, they can also mitigate it 100% on their side. With a package manager, your computer will trust a compromised key until the package manager removes it, which may be too late.
Youāre talking about publishing infrastructure compromise
Compromise of the integrity of the traffic between your server and theirs can happen. Loads of CAs have been compromised. X.509 root stores insecurity breaks https.
Thatās why most package managers have signatures. And most hardened servers use Tor to fetch packages, to mitigate targeted attacks like indefinite freeze
I feel like your threat model is not realistic. It is way more likely that you will be running malicious and/or vulnerable code that was packaged appropriately by the actual package maintainer than for a CA compromise to allow an attacker to inject a malicious package during a MITM attack while retrieving an OCI image from a container repository.
Like, yes, you shouldnāt 100% trust your ISP or your DNS server, but if youāre that paranoid, you shouldnāt trust your distroās repository either. You should be building everything from source.
MITM attacks happen all the time. As are there a ton of historical cases of CA compromise.
I canāt think of a time that a Debian maintainer went rogue and put something malicious into the official repos.
And, if they did, everyone would see it. But MITM attacks are not publicly visible because theyāre targeted.
I can literally think of the XZ utils off the top of my head. That was nearly the most prolific supply side attack of all time, and it absolutely was in the Debian repos, signed by the Debian package maintainers. In a docker container, that attack wouldnāt have worked. Itās only when installed on bare metal.