Findmysec

Running a CA is cool however, just be aware of the risks involved with running your own CA.

All they say that if the private key is stolen then you're screwed. Think about it, if an attacker can:

1. Get into your network.
2. Presumably bypass key-based ssh/container runtime protections
3. Access pod/VM which is running the CA
4. Bypass default MAC settings (Apparmor on debian, SELinux on RHEL)
5. Steal private key without you knowing from your logs

You have a much bigger problem my friend

why is creating one's own CA the wrong way? I don't want to have to pay cloudflare or porkbun to run HTTPS at home

The easiest way is to pay for a public domain, use a subdomain of that which does not have an A record on the wide internet, and then use certbot to get Let's Encrypt certificates for them and auto-renew. Stuff these in your individual reverse-proxy instances (or propagate them, no idea how) and you're done

So, you want an LDAP server or a forum? That's either FreeIPA or hosting Discourse

Is there an SLA on the Hetzner storage boxes? What do you think about their reliability (will they recover if their underlying hardware fails?)

How much does OVH cost you for storage?

I admit that Storj is less expensive but it has egress costs which B2 + cloudflare doesn't (the latter with a free account)

That's personal pictures, ripped media, documents, some sensitive information etc. Netflix can go to hell

Any storage provider with client-side encryption

Personally I'm using rclone with the crypt backend of top of the usual b2 remote

Yeah well I have over 3TB to store

I'm just afraid of data loss, but I also know that that is unlikely. I have a local backup but sometimes I feel like that's not enough, unfortunately my budget is also tight which means I can't spend too much on replicated buckets/another cloud provider with a complete backup etc.

Also, have you ever faced the issue where you're pushing files to backblaze with rclone and there are many failed uploads (rclone retries them eventually after reaching the end of the queue), which is something I've never had with S3. Well, you get what you pay for I suppose.