freyjagp/blog.raer.me
1
0
Fork 0
Code Actions Packages Releases Activity

Remove tables of contents since they don't work, fix base template.
Some checks failed
/ Build static site, docker image, upload artifact... (push) Successful in 3m28s
Details
/ Connect to deployment host, update, and redeploy docs website. (push) Has been cancelled
Details

Browse Source
This commit is contained in:
Freyja Odinthrir
2024-09-27 14:23:34 -07:00
parent 08380ee33d
commit 78b76df473
9 changed files with 1 additions and 72 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
content/2024/09/26/configuration-management.md
View File

@@ -4,13 +4,6 @@ tags: post, git, gitops, devops, cicd, tech, scripting
date: 2024-09-26 05:21
edited: 2024-09-27 13:53
# Table of Contents <!-- omit in toc -->
- [Managing homeserver configs](#managing-homeserver-configs)
- [So how do I do things?](#so-how-do-i-do-things)
- [conclusion](#conclusion)
# Managing homeserver configs
I've run my home services a number of different ways over the years. I've split things between multiple virtual machines, I've set up a 'bare metal ' kubernetes cluster distributed between multiple VMs and hardware devices on my home network. I've used FreeBSD and its Jails to run things I compiled by scratch in an effort to lower attack surface. I ran (and run) VMs and containers on proxmox, truenas core and truenas scale. Each method brings its pros & cons, security tradeoffs, and configuration complexity. Though I've practiced more complex enterprise-level user & permission management (ldap/active directory) techniques, I've settled on "good enough" security practices for my uses/needs (I don't have multiple people accessing things over ssh, for example, so I do the unthinkable and - gasp - ssh directly into root with an ed25519 keypair to administer servers). No SSH ports are exposed directly to the internet anyway - well, except for gitea. But that's also protected with keypairs.