Solène rebuilt a personal self-hosting platform on a single laptop using Incus OS as an immutable foundation. The stack runs about twenty unprivileged Ubuntu system containers (one per service) managed as Incus instances, with applications packaged as podman containers described by quadlets. Everything is declared in git and provisioned by OpenTofu and cloud-init so instances are disposable: changes trigger destruction and recreation from a fresh image, while persistent data lives on dedicated Incus volumes. Services include Nextcloud, Forgejo (with a CI runner), Immich, PeerTube, Vaultwarden, a Prometheus/Grafana/Loki monitoring stack, and backups with restic. Incus OS provides secure boot, A/B updates, TPM disk encryption and no local shell or package manager; management happens via the Incus API.
Security is enforced by design: default-deny network ACLs declared in OpenTofu, a single filtered egress proxy and container registry mirrors, and two VMs for exposed or risky roles (haproxy DMZ with PROXY protocol and a CI runner). Public ingress flows through a haproxy VM with CrowdSec+nftables blocking, then caddy to terminate TLS; private services use a VPN-access caddy on Tailscale and a private CA issuing ACME certs. Secrets are encrypted with sops and age, keys are stored per-instance, and automated rebuilds eliminate configuration drift at the cost of brief downtime during redeploys.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
German police have opened an investigation after a robot allegedly groped a teenage girl. The incident raises concerns about safety and regulation of robotic devices. (cnn.com)
Many cars lack their lights on in heavy rain, not due to forgetfulness but because of confusing iconography and interface design. The complexity of car light controls, with similar icons and multiple functions, makes it hard for drivers to quickly understand and use them correctly. (unsung.aresluna.org)
President Trump has waived sanctions related to Russia before they were set to take effect. The move bypasses the usual implementation process for new sanctions. (cnn.com)
China plans to add 40 AI, biotech, and solar technologies to its export control list by 2026, restricting the export of open-weights models. The move aims to regulate advanced technological exports from the country. (reuters.com)
Richard Stallman warns that cloud computing is a marketing hype that leads to locked, proprietary systems costing users more over time. He criticizes web-based programs like Gmail as part of this trap, emphasizing the risks to user freedom and affordability. (theguardian.com)
Android introduces AI-based defenses to combat messaging scams and fake calls. The new features aim to improve security against evolving AI-driven threats. (bleepingcomputer.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.