• 0 Posts
  • 9 Comments
Joined 1 year ago
cake
Cake day: October 29th, 2023

help-circle
    1. Domain auth (1 place to set passwords and SSH keys), no root SSH
    2. SSH by key only
    3. Passworded sudo (last line of defence)
    4. Only open firewall hole is OpenVPN with security dialled up high
    5. VLANs - laptops segregated from servers
    6. Strict firewall rules between VLANs
    7. TLS on everything
    8. Daily update check alerts (no automatic updates, but persists until I deal with them)
    9. Separate isolated syslog server for audit trails
    10. Cold backups

  • DIY - No Regrets.

    I built my NAS out of spare parts originally and then it evolved into needing dedicated purchases. I like having full control of the OS and everything on it - it helps me understand what daemons are doing what. It does a lot more than file sharing.

    The likes of QNAP and Synology may make a more polished product with an easy UI, as well as offering support, but as far as I care, I am support, so I like to fix problems myself.

    If you’re ping-ponging between the two options, from your post it reads like cost is the biggest problem you face. But as you say, storage is a critical part of the infrastructure and sometimes you do have to spend money on it if you want it to be reliable. I just upgraded my main NAS with a larger chassis and motherboard (from an ITX) so I can expand it further. It cost me a sizeable amount of money that might have bought me a low-end ready-made, but this is far more flexible.



  • Yes, this should work fine. SAS does not care what path the signal takes - it doesn’t differentiate between internal and external. You can run internal over external cables without issue. I’ve done similar by turning my old NAS chassis into a DAS, and connecting it to her internal ports of the HBA. And you can connect SAS or SATA drives to the DAS (system 1).





  • Power in the UK has gone through the roof. I’ve downsized my lab as much as I can and have at times wondered if I should shut it down completely.

    Originally I was running an EdgeRouter 4, Zyxel 48-port managed switch and custom-built NAS with an i3-9100T, 32GB ECC and 6x 12TB SAS drives in a zpool. The NAS did everything - VMs, storage, backups etc. but it was pulling quite a lot of power.

    A while back I ran a USFF PC as my server, which idled at 8W. Versus my 200W Xeon machine at the time, it paid for itself in 12 months. I dug that out and moved the VMs onto it. Storage went onto an ARM NAS. I was running too many VMs for a single USFF even maxed out, so I bought another 2 of them (identical). Now I run them in a Proxmox cluster. I use a passive cooled HP 1810 managed switch and an EdgeRouter Lite for the network, plus an Apple Airport with its transmitter dialled down to 25%. The ARM machine is much slower than my ZFS NAS, but it is much lighter on power - at that point, the HDDs are the significant draw, so I only run 2 spinners that are non-redundant and make sure they’re backed up to cold storage. I also power up my ZFS machine once a month or so and sync the data from it. Other than that, I keep the big x86 machines shut down until needed.


  • My homelab got me my last 2 jobs and the one I’m switching to for significantly more money.

    I gave it a passing mention in my resume and a couple of sentences in a cover letter. It got brought up in interview and I was able to talk through all the tech I had experience with, which sold them on me and got me an offer. Job I’m moving to, we only had a casual interview where I discussed my lab, and it turned out 90% of what they use, I’ve played with at home. Got an offer the same week.