You don’t have the knowledge or experience to do this for a business. This is different than a personal cloud. You will be blamed when things don’t work.
Don’t touch this with a 10ft pole.
If you want to help, find commercial services that offer this and suggest those.
The comments here saying to not bother with 10gbe is surprising considering it’s the selfhosted community, not a random home networking self help. Dismissing a reasonable request form someone who is building a homelab is not a good way to grow niche communities like this one on the fediverse.
10gbe has come down in price a lot recently but is still more expensive than 1gb of course.
Ideas for switches: https://www.servethehome.com/the-ultimate-cheap-10gbe-switch-buyers-guide-netgear-ubiquiti-qnap-mikrotik-qct/
https://www.servethehome.com/nicgiga-s25-0501-m-managed-switch-review-5-port-2-5gbe-and-sfp-realtek/
For a router: https://www.servethehome.com/everything-homelab-node-goes-1u-rackmount-qotom-intel-review/
This should help
This is the correct answer for the selfhosted crowd
And borgmatic makes retention rules with automatic runs super easy. It basically a wrapper that runs borg on the client side.
I’ve been using this for a few months now. Its really great.
Security in layers.
All your services should be using https. Vaultwarden in particular won’t even run without https unless you bypass a bunch of security measures.
This is how to setup local only and external https, I highly recommend this as a baseline setup for every homelab. It allows you to choose how much security you want on a per app basis and makes adding new apps trivially easy.
Anyone with the knowledge to self host will quickly discover 3-2-1. If they choose to follow it, that’s on them but data loss won’t be from ignorance
Keep vaultwarden behind wireguard for local only access then also use https certs and good master password. Very secure like this
FWIW collabora and open office can integrate with other clouds like Seafile and owncloud Infinite scale. So even without NextCloud it can be used. It can also be used stand alone.
Self hosted AI seems like an intriguing option for those capable of running it. Naturally this will always be more complex than paying someone else to host it for you but it seems like that’s that only way if you care about privacy
I think I saw a tutorial on YouTube for how to do it but this page describes it as well. I edited the default login flow to include the password box
https://docs.goauthentik.io/docs/flow/stages/identification/
Authentik works very well and has the most flexibility if you have the resources to run it (not an rpi)
You can change the logon flow to make the username and password on the same page
Another user mention issues with password managers auto filling. There is a comparability button as well on the login flow that allows bitwarden and other to auto fill correctly.
Authentik has LDAP built in along with every SSO method that exists. Makes it super nice to integrate into as many services as possible.
I use it with oAuth, LDAP and reverse proxy authentication.
It shouldn’t?
I have wireguard on my phone 24/7 with no discernable battery difference
Yup, authentik integration has been amazing to friends and family to just use it as a drop in replacement for google photos.
Once you have SSO it’s a real game changer for self hosted setups with multiple users
I don’t know. This docker allows you to use the standard Linux command tc on a docker container. Perhaps check to see if tc allows you to prioritize traffic like you. This isbgenerall called “quality of service”. That search term may help as well.
https://github.com/lukaszlach/docker-tc
This is probably the way to go
The domain makes proper security certificates for HTTPS much more usable and easy to manage.
The reason you are finding it hard to use IP only is because yiu have to disable certain security features ti make it work.
You can get a domain for $1 per year. I would highly suggest getting a domain and setting up a proper reverse proxy which will allow to to easily setup any service you want after that.
Nextcloud is also one of the harder things to setup.
You could start with something easier like a simple dokuwiki site as a test to get the reverse proxy and domain name part working.
There is a reason why this is the “correct” way to do this. It will make all future projects much easier.
For services that I want exposed, I use traefik reverse proxy (jellyfin etc).
For things that warrant an extra layer of security I use wireguard and then also traefik reverse proxy with HTTPS but it’s only accessible locally (vault warden).
Would appreciate a link please! Can’t seem to find it on DDG