thecoffeehobbit
Exactly this. As a European I don’t feel comfortable anymore relying on any US service for essential needs. Stuff like youtube is fine, it’s just entertainment. But I cannot rely on big tech on anything that, if suddenly gone one day, would cause me any sort of actual annoyance. When you think about it the list is quite long and sneaky.
As for smart home control, HA is the standard. No-brainer. For mobile OS, you can buy Fairphones with /e/OS pre-installed, a fork of LineageOS. There are some tradeoffs, but it’s generally usable, though not as secure as stock Android as it gets the security patches with a delayed schedule.
Oh yeah and I did enable Proxmox VM firewall for the TrueNAS, the NFS traffic goes via an internal interface. Wasn’t entirely convinced by NFS’s security posture when reading about it… At least restrict it to the physical machine 0_0 So I now need to intentionally pass a new NIC to any VM that will access the data, which is neat.
A wrap-up of what I ended up doing:
- Replaced the bare metal Ubuntu with Proxmox. Cool cool. It can do the same stuff but easier / comes with a lot of hints for best practices. Guess I’m a datacenter admin now
- Wiped the 2x960GB SSD pool and re-created it with ZFS native encryption
- Made a TrueNAS Scale VM, passed through the SSD pool disks, shared the datasets with NFS and made snapshot policies
- Mounted the NFS on the Ubuntu VM running my data related services and moved the docker bind mounts to that folder
- Bought a 1Gbps Intel network card to use instead of the onboard Realtek and maxed out the host memory to 16GB for good measure
I have achieved:
- 15min RPO for my data (as it sits on the NFS mount, which is auto-snapshotted in TrueNAS)
- Encryption at rest (ZFS native)
I have not achieved (yet…):
- Key fetch on boot. Now if the host machine boots I have to log in to TrueNAS to key in the ZFS passphrase. I will have to make some custom script for this anyway I guess to make it adapt to the situation as key fetching on boot is a paid feature in TrueNAS but it just makes managing the storage a bit easier so I wanna use it now. Disabled auto start on boot for the services VM that depends on the NFS share, so I’ll just go kick it up manually after unlocking the pool in TrueNAS.
Quite happy with the setup so far. Looking to automate actual backups next, but this is starting to take shape. Building the confidence to use this for my actual phone backups, among other things.
I guess I’ll give it a spin. There seems to be a big community around it. I initially thought I might migrate later so keeping the host OS layer as thin as possible. Ubuntu was mainly an easy start as I was familiar with it from before and the spirit in this initiative is DIY over framework - but if there’s a widely used solution for exactly this… Yeah.
Always a good reminder to test the backups, no I would not sleep properly if I didn’t test them :p
Aiming to keep it simple, too many moving parts in the VM snapshots / hard to figure out best practices and notice mistakes without work experience in the area, so I’ll just backup the data separately and call it a day. But thanks for the input! I don’t think any of my services have in-memory db’s.
Right, so my aversion to live backups comes initially from Louis Rossmann’s guide on the FUTO wiki where he mentions it’s non trivial to reliably snapshot a running system. After a lot of looking elsewhere as well I haven’t gotten much hints that it would be bad advice and I want to err on the side of caution anyway. The hypervisor is QEMU/KVM so in theory it should be able to do live snapshots afaik. But I’m not familiar enough with the consistency guarantees to fully trust it. I don’t wanna wake up one day to a server crash and trying to mount the backed up qcow2 in a new system and suddenly it wouldn’t work and I just lost data.
It won’t matter though as I’ll just place all the important data on the zpool and back that up frequently as a simple data store. The VMs can keep doing their nightly shutdown and snapshot thing.
