A lot of the services that I use daily, I host myself on my own hardware. It’s perfect for me, because I get better privacy over my data, whilst also being able to tinker around with computers a lot.
However, there is one issue that is a constant burden for me, and I don’t think there’s a way to resolve it. The trouble with the internet is that there are lots of people (and increasingly lots of AIs) that would love nothing more than to have access to my server and my services, for data leaks, or even to execute some kind of attack. And what’s the safest way to stop the internet accessing your stuff? Don’t have it accessible to the internet in the first place!
So I keep my services all behind a VPN tunnel — specifically Tailscale — which means that only the devices I register can access services, whilst non-authorised machines don’t even know I exist. It even works outside of LAN, so as I’m writing this on holiday, I can stream music from my Navidrome instance.
But say I don’t have my phone, or otherwise need to do something from a different device, I can’t grab a document from Nextcloud unless I download it to my phone and then share it. The sharing feature becomes useless on a solo-access Tailnet. It’s amazing for security and preventing attacks on my home services, but useless when I want to get someone else involved.
I suppose it sort of showcases the problem that you face when self-hosting: that of security vs convenience. Either I can access all my documents from anywhere, but so can anyone else, which isn’t secure; or I can restrict access to only specific devices, which stops me being as free to use them as if I used say Google Drive.
So why do I self-host then? Trust me — it’s a question I’ve asked myself many times when my system confidently tells me that there is an error, but not where or how to fix it.
I’ve been reading a bit of economics lately, entirely coincidentally, which led me to discover Robert Coase and his article “The Nature of The Firm.” In a nutshell, the article describes how firms emerge because they are better at dealing with the cost of production than individuals are. What that means in practice, is that if I feel a company can do a better job with their hosted service than I can with my self-hosted, I prefer to use the hosted service. Extend that to my issue with network access, and you arrive at the conclusion that anything I’d need constant, 24/7 access to from anywhere — such as passwords and authentication, email et cetera — is better hosted by someone I can access from anywhere. That is why Proton AG is my security provider of choice for critical infrastructure, but non-crucial or offline-supporting features like contacts or music can stay behind Tailscale.
(On the Proton note, there’s also the added bonus of I’d rather attackers be pushing again Proton’s professionally hardened servers than my hobbyist one, but let’s stick with the high-minded philosophical reasoning — makes me sound wiser.)
So it’s inconvenient, and at times a bit annoying, but it’s secure and it works for me. I’ve even started writing things down for later — how horrific! 😂
If I had to change something, it would be to make one public endpoint, not necessarily from my server directly but which I could use for a kind of ephemeral sharing protocol. In my head, I have a vision of being able to drag a document from my Nextcloud instance into this storage bucket of sorts, and then get a publicly shareable link that allows me to manage access and delete whenever I want. Probably just in that sentence are five different things preventing this from happening, but one can but dream.
So that’s my deal with self-hosting stuff; the main issue, and how far I allow myself to go with it.