Alternatives to Hashicorp Vault?

vsis@feddit.cl · 2 years

git is already a decentralized version control software. Your local git repos are mirrors by themselves.

Put some git fetch in a server crontab, and you’re done. You can access them via ssh if your user have permissions.

vsis@feddit.cl · 2 years

Sorry, I can’t hear you over the artillery noise.

vsis@feddit.cl · 2 years

Wait.

Does Portainer ask your email? I haven’t used it in years. I though it was just a container that you run, with mounted docker socket, and that’s it.

Is it now doing some “telemetry” and sending user data, like email, to their servers? If so, I’m glad I’m not using that anymore.

vsis@feddit.cl · 2 years

VPS + VPN is the cheapest option I believe for the services. It doesn’t have to be “elaborated”.

You can port-forward public VPS ports to your private addresses/ports. If you don’t want to use iptables you can use firewalld.

The only “but” will be latency. For gaming it won’t perform as you may need.

vsis@feddit.cl · 2 years

It’s no longer open source. Big Deal in my books.

vsis@feddit.cl · 2 years

Vault features are cool. I really like it. But with Hashicorp now there is this big risk of “rug pulling” regarding its license.

The wise thing, in my opinion, is to avoid this company as much as possible.

vsis@feddit.cl · 2 years

I want a centralized way to manage keys and secrets. And some service users with little privileges over a subset of the secrets. Ideally, a service user only should be able to read its own subset of secrets. So, let’s say, if a container gets pwned it will only read its secrets and no more. It should be FOSS and self-hostable.

And a beautiful nice-to-have feature would be access log, to know who read what and when.

My only experience with something similar is Hashicorp Vault, but I don’t want to be near any Hashicorp stuff ever again.

Do you know a FOSS alternative to Vault?

vsis@feddit.cl · 2 years

If your comments have been federated to other instances, they will be there until they are deleted locally. If someone clicks on your user profile, they will get a DNS error if the domain is no longer there. Images in the comments pointing to you instance will be broken too. Nothing terrible actually happens.

Migrating accounts a la Mastodon is not happening soon in Lemmy.

My advice is: Go on and save some money.

vsis@feddit.cl · 2 years

Sorry to read that.

I’ve dded an external drive instead of an SD card once by mistake. I’ve never felt more stupid than that day.

vsis@feddit.cl · 2 years

It’s running NetBSD, isn’t it?

vsis@feddit.cl · 2 years

Some security tips:

Firewall should block everything by default, and you start allowing incoming and outgoing connections when you need them or if something fails.

Disable passwords and root access in ssh daemon.

Use fail2ban or something similar to block bots failing to log-in.

Use random long passwords for everything (eg: like databases). And put then in a password manager. If you can remember the database password, it’s not strong enough. If you can remember the admin password for a public web service, it’s weak.

Don’t repeat the passwords. Everything should have its own random long password.

.env files and files with secrets should be readable only by its service user. Chmod them to 400.

Monitor logs from time to time to see if something funny is happening.

vsis@feddit.cl · 2 years

Random ports are easy to discover and there are tools to discover what service is behind a port.

It’s annoying for the legitimate user and easy to bypass by an actual attacker.

Also, if you use a random port above 1024 it could be a security issue since any user could star listening if the legitimate process crashes.

See this

vsis@feddit.cl · 2 years

Nothing illegal is being discussed.

But I’m happy to talk about Jolly Roger.

vsis@feddit.cl · 2 years

https://workaround.org/

Wow! this is exactly what I needed. Although, I didn’t exactly ask for it.

Thank you very much

vsis@feddit.cl · 2 years

Thanks to both of you.

I had the hope that DMARC, SPF and DKIM was stuff I could just ignore if not sending email. It seems I was wrong about that.

vsis@feddit.cl · 2 years

Hello. Let’s say I want to selfhost an email server (smtp + imap) that only will be used to receive email.

I only will send email internally (from my domain to my domain) and receive from 3rd parties.

Should I setup DKIM, DMARC, SPF and reverse IP lookup?

To be honest, I’m having a bit of hard time understanding the madness of email authentication. So I can’t figure it out by myself if those mechanisms are needed in my case.

I haven’t deployed anything, but probably will use Stalwart. It looks like it’s easy to deploy. Is there any other beginner-friendly email service I should read about?

Thanks!

vsis@feddit.cl · 2 years

I’ve got 3 tricks for ya:

backups
backups
backups

vsis@feddit.cl · 2 years

You may have one psql server per region and then use Bucardo to synchronize them.

I’ve never done this in production, so take my advice with a grain of salt.

vsis@feddit.cl · 3 years

Since you posted it in a selfhosting community, this is the feeling I get:

vsis@feddit.cl · 3 years

I don’t know any product that matches your requirements.

If I had to deal with that today I’d buy a rasberry pi, a USB sim card dongle and some raspberry hat with GPS receiver.

You can write a small API that listens to the raspberries, who sends periodically their positions, and save it to a database.

But it’s a quite large project. There’s a lot of aspects to consider. The GUI, security, batteries, and a way to attach it to an animal without being lost or destroyed.

Sorry for not giving a useful answer lol. If you come out with an actual solution I’ll be glad to hear it, so I can track my cats in case they get lost.

Alternatives to Hashicorp Vault?

Receive only email server