Why do you use two separate Debian VMs plus a truenas VM running nextcloud?
Security is the first thing that comes to mind. Compartmentalization prevents or at least makes it considerably harder for compromised services to screw up all the others.
Another thing would be that it might be easier to manage backups and snapshots.
From my understanding, it's helpful that each VM will have its own IP so ports can be opened only on specific VMs, increasing overall security.
Am I doing something wrong? All my services are grouped in docker compose files. Containers that have to communicate internally - a server and it's db for example - are on their own private docker network. A reverse proxy has its ports 80 and 443 open and it is on an external docker network. Services that I need to access from the outside are on this network and they do not have any ports open. Except for the torrent client, which has a UDP port open.
It's strong, but splitting services into separate VMs is stronger than just using separate docker containers. This is especially true for the torrent client.
I'm not a netsec professional, this is just my understanding of best practices.
I am also just a hobbyist, so that was a genuine question. Thanks for the answer.
Same here! Good luck with your setup!!
Soooo this is not really true unless you don't trust your kernel. While a VM is more isolated from the host, since a container shares kernel space, that doesn't make it less secure. I.E. isolation does not equal security.
Actual sandbox escape vulnerabilities happen in VMs as frequently as they do in Docker, and while all VMs have a full systems that many exfiltrations can hit (due to a full suite of services running), many docker containers are locked to a user space with only one process running.
@kureta@lemmy.ml if you are running separate Docker networks in compose, I would not recommend switching to VMs. If that kind of isolation is a requirement, add another server and use different SSH keys for it.
Same. One single docker compose, and a dozen images. I get to take advantage of publicly available docker images too which makes managing and updating things a breeze.
You should look into container technology. No reason to have this many operating systems wasting resources
Nice stack! What's the crab logo? I don't recognize it.
Do you notice a massive increase in request latency (like 10x-50x) when using a CloudFlare tunnel vs connecting directly to your IP? I've experimented with it a few times, but it really negatively impacts QoS for me, especially with federated services (like Matrix) where there are lots of small requests.
the crab is Homarr and no, i haven't had any issues with cloudflare
Thanks! I haven’t tried that dashboard yet, I might give it a spin.
What do you use it for?
its a dashboard application, i just have my hosted apps there
But like, does it help you with anything specific. Or is it just nice to look at
For me, it becomes very useful when you manage local and public services and the same time. I'm actually planning to return to use a dashboard because I added new services and devices to my stack, so now there are more IPs and domains I use for different tasks and I'm too lazy to remember/write all of them :)
Do you notice a massive increase in request latency (like 10x-50x) when using a CloudFlare tunnel
Have not noticed that at all. I don't run any federated services tho. Might be the difference, I don't know.
Yeah I’m thinking the request frequency was the issue rather than bandwidth.
That seems unlikely; trust me, there are services running behind Cloudflare tunnels that are doing more requests per second than whatever you're hosting does in a year.
The only times I've had performance problems with Cloudflare tunnels it's been intermediate network kit that didn't like IPv6 or didn't like QUIC (or both). You can try disabling both in cloudflared to diagnose (at least, you used to be able to disable them/switch to HTTP/2+IPv4, it's been a very long time since I've needed to so I'm just assuming it's still an option.)
My ISP is stuck in the Stone Age and doesn’t support IPv6, so I’ll look into that.
What is your reason for running two separate Debian docker hosts with under 5 containers in total? That seems like quite the overhead? And why did you choose to install Nextcloud on your TrueNAS server?
Not OP. But i do the same.
I have multiple proxmox hosts, running multiple VMs, each running containers.
I do it so I can minimise disruption. Fixing a fault in immich doesn’t mean the house is without plex for a week.
Running multiple Proxmox hosts in a cluster makes sense so you can swap VMs from one the other and have extra hardware reliability. I'd also get grouping your containers on different Docker VMs the apply the same security rules to containers in a group (internally vs. externally available for example). But how does a faulty Immich container take down a Plex container?
Could be anything.
Something decides it’s going to fill your disk up with noise and plex enters a crash loop as it can’t write to disk any more.
Your reverse proxy decides it’s not going to issue valid SSL certificates so all your plex clients refuse to connect.
One day an OS update decides your network configuration wasn’t important, and your OS throws a shit fit because there’s no route to 192.168.1.100 any more
i love selfhosting :3
Me2! Nice solid stack you got going there bro.
Dutch user spotted
nee hoor jij liegenaar
Lol
Nice setup.
Though in terms of manageability it looks like a nightmare.
Cosmos Cloud You can thank me later ;) or azukaar for that matter.
And Cosmos OpenWrt for the ultimate all in one OS (my creation)
Is proxmox a viable option to be used on a NUC for example?
Yes, I run it on mine, with an N100 processor. Make sure it's a recent-ish one with the necessary virtualization extensions. https://www.proxmox.com/en/products/proxmox-virtual-environment/requirements
And obviously more storage and more RAM is better, especially if you plan to use zfs. Keep that in mind when selecting hardware.
Thanks, I will look into the provided link.
Mine is just Debian.
" Why won't somebody think about the backups ? "
None of you come in my shop.
Or the restores... 😉
But there's a RAID!
🤦🏼♂️
[Cough]
TruNAS is a VM? I thought it preferred bare metal? I would think it would be side by side with proxmox? (Still learning and planning my setup.
Absolutely no problem with it being virtualized as long as you have a pci storage controller and pass that through to trueNAS. HBA cards can be found that do this without raid or anything so you can use zfs in trueNAS.
I've got a virtualized set up to.
Its pretty unbothered being virtualized so long as the disks are passed through. In my set up, I have the SAS board passed through and its using that.
My reasoning is that I wanted a lot of disks space, but I couldn't get that without just a big case in general, so I use the extra space to store GPUs for AI and encoding stuff
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:
| Fewer Letters | More Letters |
|---|---|
| HTTP | Hypertext Transfer Protocol, the Web |
| IP | Internet Protocol |
| NUC | Next Unit of Computing brand of Intel small computers |
| Plex | Brand of media server package |
| RAID | Redundant Array of Independent Disks for mass storage |
| SSH | Secure Shell for remote terminal access |
| SSL | Secure Sockets Layer, for transparent encryption |
| UDP | User Datagram Protocol, for real-time communications |
[Thread #270 for this comm, first seen 2nd May 2026, 08:00] [FAQ] [Full list] [Contact] [Source code]
4 running nodes for like 5 services? Seems exessive, no?
What makes you think its 4 proxmox nodes?
To me it looks like 3 Debian VMs (2 of them running docker containers) and 1 TrueNAS VM running in a single Proxmox node.
Running everything in a VM to run it in Docker is excessive as well. It is supposed to use bare metal containers.
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
No trolling.
No low-effort posts. This is subjective and will largely be determined by the community member reports.
Resources:
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
