pibox-os VS ansible-anu

About my business? Sure! It's at https://kubesail.com and we sell our hardware at https://pibox.io :)

Our best feature is that the website will detect if you're on the same network as your machine and if so, offer "local" links instead of remotely proxied ones. That way non-technical users dont need anything fancy. On top of that, the "local" urls still get valid HTTPS certs for free, so non-technical users dont get any scary browser warnings.

We started out as a way to make self-hosting easier for corporations, but the users who joined our community were mostly home-hosters, so we leaned into that! Jellyfin is now our most popular app.

I built a small business around this idea (particularly your last sentence about it evolving quickly), so I can’t not promote https://KubeSail.com and our hardware at https://pibox.io

That said, I use an old workstation as my home router and server. It’s worth the power bills in saved subscription cost alone. Much more relevant is how much of my time I spend on it!

We make tiny Linux servers packed with real devops tools (but also sporting a somewhat-easy-ish-to-use UI) for home-hosting and self-teaching: https://pibox.io - works great with Jellyfin!

There are several projects designed to help you self-host your own services.

Proxmox[0] is mentioned by a few folks here. It's mostly a hypervisor. It's good if you have a "big" server and want to split it up into VMs for various needs. It doesn't have any concept of an AppStore or service catalog. I think this is too low level for what you're asking.

Unraid [1] is probably the easiest way to turn an arbitrary computer into a useful server. You install the OS on a thumb drive and it runs from there. It provides network storage services out of the box, can host VMs, and has a solid catalog of packaged services in their Community Applications plug in [2]. These are packaged in weird obscure way that I tried and failed to figure out. I've run this on an old T410 for a couple years and it's been pretty good. Not as flexible as some other options, but quick to get going on the basics. You can see this in their storage system... you can easily add arbitrary disks to your pool, but parity options are limited. My biggest complaint is that it's hard to spin up your own docker images, especially if you don't want to mess with Docker Hub.

TrueNasSCALE [3] is my next platform. It's an iteration on the very solid FreeNAS/TrueNAS and ZFS. It handles containers and containerized services as first-class citizens using kubernetes, but also includes KVM so you can do virtual machines. Like Unraid, it has a healthy app library over at TrueCharts [4]. Unlike Unraid's weird XML manifest, SCALE uses Helm. Nice.

coolLabs [5] is sort of a self-hosted Heroku alternative. I just discovered it on HN the other day [5a] in that context. It looks pretty neat. It has some pre-packaged services already [6] but seems to lack any concept of a community-curated service package repo. It seems to be mostly focused on helping you deploy applications you develop yourself. I don't think it gives you network shares, for example. Still, it could be a great choice to throw onto the VPS you're wonder what to do with. [7]

Kubesail [8] is a k3s-based self-hosting operating system. It's designed to help you run basic web services as easily as possible. Where Unraid assumes you have an old computer laying around, Kubesail will sell you a PiBox [9] to get you up and running. (You can also bring your own hardware). The have a nice AppStore and have put particular attention into the photo use case you mentioned - they emphasize support for PhotoStructure [10].

Cloudron [11] was mentioned by a few other comments. I haven't dug into it, but it does seem to have an appstore as well.

[0] https://www.proxmox.com/en/

[1] https://www.unraid.net/

[2] https://unraid.net/community/apps

[3] https://www.truenas.com/truenas-scale/

[4] https://truecharts.org/

[5] https://coollabs.io/

[5a] https://news.ycombinator.com/item?id=33077118

[6] https://docs.coollabs.io/coolify/services/

[7] https://docs.coollabs.io/coolify/installation

[8] https://kubesail.com/homepage

[9] https://pibox.io/

[10] https://kubesail.com/template/erulabs/photostructure

[11] https://www.cloudron.io/

I am using https://yunohost.org, but https://pibox.io/ looks like a cool setup that takes care of some of the more difficult things such as tunneling and backups.

The few times our hardware had reached the front page have basically made our startup viable. It was only two days ago, but https://pibox.io

We figure HN is one of the toughest crowds. If we can make a hardware product y’all don’t completely dislike - we’re on to something!

PiBox - CM4 with proper 2xSATA (for which you might have to wait a few months)

We run KubeSail which is free to use, and all of our featured apps are tested and tuned to run well on a https://pibox.io. Our dashboard isn't open source, but nearly everything else we make is, including the YAML configs which are used to spin up the apps themselves. Hope this helps!

If you’re interested in a piece of hardware I’d say just use an old PC and install k3s. I also build and sell tiny raspberry pi kubernetes clusters at https://pibox.io if you’ll excuse the ad. Either way - a set of VMs or old PCs or a couple Pis is the way to go for a home lab and for getting hands on.

Actually all of your questions are excellent and I’ve been adding them to the “FAQ” section of https://pibox.io as I answer them :)

I prefer to run Ubuntu machines and at least in terms of provisioning a new secure server I built an Ansible playbook I called 'ANU' (as in A New Ubuntu). I'd expand to other distros, but then I'd have to change the name!

https://github.com/MitchellCash/ansible-anu

It is based on the DevSec OS/SSH hardening playbooks, but I lean closer towards ease-of-use over security where I think it makes sense. For example, I disable forced password rotation and I keep the default umask value of '022' instead of the more secure '027'.

When I come across something the upstream playbooks change that "gets in my way", I will disable it if the security trade off makes sense for me. I'm not running highly sensitive systems, so these trade-offs make sense for me, and maybe they will for you as well!

In terms of ongoing security upkeep, I run the usual `apt update && apt dist-upgrade` when I can, but I’ll be keeping my eye on this thread for additional advice.