Self Hosting Blog

Despite this blog being initially set up to primarily talk about self-hosting, I’d actually been hosting it on AWS until very recently. This was due to caution - I know just enough about security to know that I know next-to-nothing about security, and so I didn’t want to expose any ports on my own network to the Internet. Instead, I set up an AWS CodePipeline to build the blog and deploy to S3 anytime I pushed a new change. Admittedly, this was a pretty cool project in itself that taught me a lot more about CDK and some AWS services; but it didn’t feel like true self-hosting, even though I wasn’t using anything like Medium or WordPress.

Thanks to this great blog post, I found an alternative that allowed me to feel the nerd-pride of self-hosting while retaining security. Cloudflare offer a free service called “Cloudflare Tunnel” (formerly “Cloudflare Argo”). To quote that blog:

This approach solves a lot of problems at once: there’s no need to open up any inbound firewall ports (hooray!); I don’t need to set up dynamic DNS records for my home IP address (which would, among other things, have some bad privacy implications); and I get Cloudflare’s DDoS protection and CDN features (which I would have wanted anyways for the blog). And crazily enough, it’s all free!

My setup’s a little different than that author’s (for one thing, I’m not running k8s…yet…), but the approach still works just fine. I built:

• a script that runs as part of my primary homelab Pi setup which creates the tunnel (from blog.scubbo.org to a port on the local machine)
• a script that’s part of the blog content repo which will pick up any new content, rebuild, and host on that same port.

I do admire the elegance of my previous setup (and of the setup I’m copying) whereby a push to the repo will trigger the build-and-republish - but, since I haven’t taken the plunge to self-host Gitea yet¹, that will have to wait. I suppose I could set up a local server (to trigger rebuild) which is called by a GitHub action after pushing, but that seems like throwaway work for nothing.

I also don’t have quite the same level of paranoia as the author about network rules. That said, I did just install an OPNSense router (to replace the ISP-provided router that kept dropping my Raspberries Pi after a few days of uptime), so learning more about VLANs and Route Tables could well be in my future, too.

• meta
• homelab