Re: Website hosting dilemma

On Thu, Mar 12, 2015 at 6:59 PM, Tomas Sobek <[email protected]> wrote:
> I will be soon moving into a new house with fibre-optic connection. I am rethinking my website hosting, playing with the idea of hosting it at home. Does anyone have any experience to share, useful resources to read, etc?

Risk is the first consideration - If there is a disaster at your
house, you'll lose your original data, plus the website copies,
therefore I hope you have decent external backups on a different
service (Amazon Glacier perhaps?) as well as on physical media (in
your desk at work, for example)

> * It's predominantly a photo gallery that includes high-resolution files for download. I have maybe couple thousands photos up there, currently taking about 9 GB of disk space. New jpeg files are up to 10 MB each (yeah 24 mega-pixels camera).

That's relatively small data use, in today's standards. Should be
trivial to provide that on almost any storage medium.

> * In 2014 I had following stats from Webalizer (total for 12 months):
> - KBytes: 550,880,368 ~ i.e. about 50 GB per month of traffic

Not too bad. Check your ISP details for upload speeds, which under
ADSL models were much smaller than download speeds, but under fibre
seem to be generally the same both ways.

> - Visits: 144,476
> - Pages: 935,884
> - Files: 1,524,967
> - Hits: 1,822,670

That rate of work is basically no problem for almost any machine to
provide. Possibly even an RPi (although I would never recommend an RPi
for real work, it's a video-decoding toy)

> * I am currently using Gallery3 but will be looking at other options before final deployment. For ideas, here is a list - http://www.design3edge.com/2010/08/26/best-free-and-open-source-php-image-galleries/

Don't restrict yourself to PHP if you're looking for a change. Perhaps
a bigger change ... OwnCloud might have a gallery-like featureset that
you could use.

> * Other requirements:
> - PHP
> - mail server

No, no, no, a thousand times no. Do not consider even for a moment
running a "real" Internet-facing mail server on a residential
connection, you will be blacklisted all over the place (because the
majority of botnet spam comes from residential machines, the big mail
providers have become very good at ignoring them). On the other hand,
having a mail server "internally" that sends and receives via someone
elses service is a potential winner, if you want to learn about mail.

> * Current website for reference: http://tomassobekphotography.co.nz/

I thoroughly recommend everyone to check out Tomas' photos, even if
you're not going to say anything about his questions :-)

> Ideas and questions running through my mind are:
>
> * Which provider to choose? My colleague at work is sorting some issues with his Vodafone connection and every time he calls them, he needs to wait for couple of hours before he gets to speak to someone - i.e. we have a lot of crappy music in our office lately. This isn't my idea of having fun and good support. Does anyone have a better experience with other providers? Recent price/speed/data caps comparison?

The fibre connections all seem to be 'unlimited data', and speeds are
100Mbps upwards (all the way to GIGATOWN! lol) Price would be
~$100/month, make sure you get a static IP address (which not everyone
will give you) because dynamic DNS services are not suitable for
reliable connectivity (not their fault, that's just the way it is).
When I chose a fibre ISP recently, my shortlist was Snap and
MyRepublic.

> * What hardware to host the website on?
> - Would something like the new Raspberry Pi be adequate?
> - Or ShivaPlug? https://en.wikipedia.org/wiki/SheevaPlug
> - Or build a small server, for example something like this - http://linuxlookup.com/howto/build_linux_home_web_server_under_250
> - I also liked the look of Linutop - http://www.linutop.com/linutop5.en.html
> - Any other ideas or suggestions to look at?

Anything that has low power consumption should be OK, as long as you
aren't asking it to do too much computation for the website. The
RaspberryPi is unsuitable. A Beaglebone Black would be fine, as would
any Geode (PC Engines) or Atom-based CPU - talk to Hadley at
nicegear.co.nz for these. You need to work out what the mass storage
technology will be, how redundant you need it to be. SSDs fail often,
so you'll need to use RAID1. Avoid RAID5/6/n+1 like the plague. RAID
1+0 perhaps. Do the data rate calculations - would a USB3 flash
storage device provide data quickly enough? If so, a low power box
with a couple of thumb drives might suffice (but check that they do
USB3!). Otherwise SATA. If you use traditional spinning drives, you'll
be eating power all the time.


> * What operating system to run it with? It will be a learning curve anyway so why not pick the best option for the job? Currently I am running just desktops with Mint 17. Naturally I expect no GUI should be on the server.

Sounds like Debian, or perhaps Ubuntu (as a server). Ubuntu LTS "lasts
longer" than a Debian though.

> * How to secure the box?
> a) Should I try to create some form of a DMZ? What would the network diagram for this look like? Do I need anything special from the internet provider? I had an idea to plug this server directly into the modem/router and plug another router (with WiFi) into that first router. Then all my devices would connect via that second router, i.e. would be behind another firewall and separated from my server. At the same time, the server would be easily accessible from my devices. Does it sound sensible from security standpoint?

The whole point of a DMZ is to presume that a server in there *will*
be compromised, and *will* be hostile at some point in time. So your
proposal would give the web server access to the internal management
interface of your primary router, which probably doesn't have decent
protection.

You need to have a device that runs multiple logically separate
interfaces (that leaves out the typical consumer device, but if you
install OpenWRT or similar on something, you'll get the control you
need). Your DMZ needs to be actively firewalled such that it cannot
talk to your internal network (except for syslog, see below) - that's
really what DMZ is for. Your internal network can talk to the DMZ, of
course.

> b) I assume I should use pre-shared keys for SSH. I would keep the SSH port closed from internet and open to my home devices only.

You're thinking of public/private keys, not pre-shared. In any case,
if you cannot log in from the Internet it doesn't necessarily matter.

> c) I thought I should probably use auto-update for security patches, if the operating system would support it.

Oh yes; but don't forget how to detect and apply patches for your
application software (e.g. Gallery itself)

> d) A while back I read about tripwire. Would it make sense to configure it in this case? Or would it be more painful than useful together with the auto-update?

It's one of a series of measures; collecting all the syslog messages
onto a separate machine actually does more to help debug and fix
issues than anything else :-) So that means another server somewhere
:-)

e) Application segregation

Your host OS should be separated from the Internet-facing application.
You should isolate the webserver/gallery from the rest of the OS with
virtualisation of some flavour - containerisation with Docker is
great, running a chroot jail is OK (hard work to set up though),
running a whole "OS in a VM" using KVM or VirtualBox would do at a
pinch. In all of these cases, you have to keep patching the
application's VM as well as the host (although this would be a minimal
install)

> * Is it worth hosting from home at all, or should I keep my external shared web-hosting? Or get some local one? My current one is in Australia. When I was setting it up I couldn't find anywhere here for reasonable price with PostgreSQL.

It is worth hosting at home, if you want to learn :-)
However, you can also learn by hosting externally ... you do pay for
hosting, but if it is done well you're avoiding lots of problems.
cloudatcost.com are based in Canada and are stupid cheap; but they
haven't proven themselves to be long-term stable. Rimuhosting.co.nz
are wonderfully technical, they will support you a lot, they change a
lot more but over the years will upgrade your VM for free as their
hardware improves ...


> * If I go with home hosting, how does it work with transferring the domain name? And can I hook it into dynamic DNS? Or do I need static IP? So far this was done by the web-hosting company and I feel clueless.

There are plenty of registrars who will provide decent services for
just your domain and the DNS. I use iwantmyname.com because they're
NZ-based (I always buy locally if I can) and I know Lenz. They run all
my DNS now.

>
> * I would also need a primer on setting up a mail server for my domain.

"No"

There you go. Do not run your own mail server - this is a learning
subject easily bigger than web hosting, and if you get it wrong you
*lose* your ability to communicate.

> To me it feels like a reasonably big project. Therefore your ideas and opinions on any of the above would be greatly appreciated.

Keep it simple, figure out exactly how everything works from the
domain name registration down to the restoration of backups before you
start changing things, if you can :-)

Happy to talk directly over coffee/beer any time.

-jim

_______________________________________________
DunLUG mailing list
[email protected]
http://lists.ethernal.org/listinfo/dunlug
DunLUG Wiki - http://dunlug.kallisti.net.nz/