Sovereign: Ansible playbooks to build and maintain your own private cloud
There are so many servers and apps being installed by Sovereign that I&#x27;m certain few would be able to keep it secure (<a href="https:&#x2F;&#x2F;github.com&#x2F;sovereign&#x2F;sovereign&#x2F;wiki&#x2F;Software-used-by-Sovereign" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;sovereign&#x2F;sovereign&#x2F;wiki&#x2F;Software-used-by...</a>). The big win for the cloud is that you&#x27;re paying a fraction of the cost for access to a, typically, enormous security and operations team. If you want to build software like this that allows people to self-host, you need to scale down what you deploy to what a single person can reasonably manage. This isn&#x27;t it.<p>Fun todo: Install this somewhere, nmap it for open ports, then ask &quot;How many of these services had a remotely exploitable CVE in the last year?&quot; &quot;If one of these services had one tomorrow, would I know to patch it and take action faster than someone would takeover my box?&quot; I don&#x27;t see any containment mechanisms on any of these services beyond what&#x27;s included by default so a compromise of one service likely leads to total compromise of the entire box.<p>I had to think about this a lot with AlgoVPN (<a href="https:&#x2F;&#x2F;github.com&#x2F;trailofbits&#x2F;algo" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;trailofbits&#x2F;algo</a>), and we built a system with no out-of-the-box remote administration, strong isolation between services with AppArmor, CPU accounting, and privilege reductions, and limited third party dependencies and software. You can&#x27;t count on a full-time, expert system administrator.