Guenther_Amanita

That's a question I always asked myself.
Currently, I'm running Debian on both my servers, but I consider switching to Fedora Atomic Core (CoreOS), since I already use Fedora Atomic on my desktop and feel very comfortable with it.

There's always the mentality of using a "stable" host OS bein better due to following reasons:

• Things not changing means less maintenance, and nothing will break compatibility all of the sudden.
• Less chance to break.
• Services are up to date anyway, since they are usually containerized (e.g. Docker).
• And, for Debian especially, there's one of the biggest availability of services and documentation, since it's THE server OS.

My question is, how much of these pro-arguments will I loose when I switch to something less stable (more regular updates), in my case, Fedora Atomic?

My pro-arguments in general for it would be:

• The host OS image is very minimal, and I think most core packages should be running very reliably. And, in the worst case, if something breaks, I can always roll back. Even the, in comparison to the server image, "bloated" desktop OS (Silverblue) had been running extremely reliably and pretty much bug free in the past.
• I can always use Podman/ Toolbx for example for running services that were made for Debian, and for everything else there's Docker and more. So, the software availability shouldn't be an issue.
• I feel relatively comfortable using containers, and think especially the security benefits sound promising.

Cons:

• I don't have much experience. Everything I do related to my servers, e.g. getting a new service running, troubleshooting, etc., is hard for me.
• Because of that, I often don't have "workarounds" (e.g. using Toolbx instead of installing something on the host directly) in my mind, due to the lack of experience.
• Distros other than Debian and some others aren't the standard, and therefore, documentation and availability isn't as good.
• Containerization adds another layer of abstraction. For example, if my webcam doesn't work, is it because of a missing driver, Docker, the service, the cable not being plugged in, or something entirely different? Troubleshooting would get harder that way.

On my "proper" server I mainly use Nextcloud, installed as Docker image.
My Raspberry Pi on the other hand is only used as print server, running Octoprint for my 3D-printer. I have installed Octoprint there in the form of Octopi, which is a Raspian fork distro where Octoprint is pre-installed, which is the recommended way.

With my "proper" server, I'm not really unhappy with Debian. It works and the server is running 24/7. I don't plan to change it for the time being.

Regarding the Raspi especially, it looks quite a bit different. I think I will just try it and see if I like it.

Why?

• It is running only rarely. Most of the time, the device is powered off. I only power it on a few times per month when I want to print something. This is actually pretty good, since the OS needs to reboot to apply updates, and it updates itself automatically, so I don't have to SSH into it from time to time, reducing maintenence.
• And, last but not least, I've lost my password. I can't log in anymore and am not able to update anymore, so I have to reinstall anyway.

What is your opinion about that?

Probably a dumb question, but I have to report pretty much the same post (some website-link + some mentioned usernames, but always sent from different instances) multiple times a day.

The weird thing is, that this happens only here in this community, and not in any else I have subscribed to.

Is this some targeted attack, because due to the self hosting, we're a more valuable victims, or is it just due to time shift because the mods are in a different time zone and asleep when we report the posts?

I think the latter one isn't the case, since there are many active moderators here :)

Is there something we can do about it?

I feel super dumb right now.

I always thought, that all user data (/home/) are decently safe against physical access, as long as my user and root password is strong enough. If I just plug in the hard drive, nobody except the Super User has access to the data on it.

Well, the guys on the other community (Link) have shown me how wrong I've been.

All of my devices are securely encrypted. Well, all of them, except the most important one: my server, where all pictures, documents and other private stuff is stored.

Now, I'm afraid as hell that this will go wrong in the future. Imagine a vengeful ex girlfriend, a police raid, whatever.
It's just dumb from my side to secure everything except the one thing that would need it the most.

I've already done my homework, and encryption doesn't seem like a highly important topic in the selfhosting community, or on many servers else.
At least that's what I've got the feeling.

The most common argument I hear is "nobody will get physical access anyway, so I don't care".

Threat model and security measures

My threat model: not high. I don't do any illegal stuff and don't have any enemies. Still, I want everything at least somewhat secure.
If it only serves the purpose to annoy the intruder it's already enough.

The only thing that has online access is my Nextcloud (AIO from Docker), and that is already well secured against hacking attacks (password, 2FA, brute force protection, etc.).

It's also the only thing that is worth securing in my eyes.

Options for encryption

LUKS2 full disk

I would need to factory reset the whole server for that, which would be ... highly inconvenient for me. It took me quite a long time to get everything working, and I don't wanna loose my configuration.

Also, how should I access the device when I don't see anything? Is there a workaround or something when I want to reboot without a monitor and keyboard?

Only encrypt the home folder

Same problem as with FDE

Nextcloud server side encryption

That one isn't recommended from what I've read. It causes compatibility issues and an extreme hit on performance according to forums. Is this still correct?

Cryptomator (?)

Encrypting and decrypting with every up- and download sounds quite annoying. Wouldn't be my prefered method tbh.

What is your opinion on that topic? What would you recommend me?

Please remember, that I'm not that experienced as much, so please be patient with me 😬