{
  "id": 14865291,
  "title": "My self-hosted infrastructure with Incus OS",
  "url": "https://urgent.news/2026/10/16/my-self-hosted-infrastructure-with-incus-os",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-16T03:25:49.000Z",
  "source": {
    "name": "Lobsters",
    "slug": "lobsters",
    "url": "https://dataswamp.org/~solene/2026-10-15-selfhosting-infrastructure-incus-os.html"
  },
  "original_language": "en",
  "account": "Over the past seven months, the author dedicated considerable personal time to redesigning their home self-hosting infrastructure. Their goal was to create a secure, fully automated system that can be rebuilt from scratch if necessary, inspired by their work on the SecNumCloud standard and ISO 27001. The resulting architecture is composed of several key components.\n\nThe foundation of the system is Incus OS, a small immutable system that runs Incus, a manager for system containers and virtual machines. This choice was made due to its locked nature, providing a secure and controlled environment. Incus OS is not exposed to the internet; instead, it is managed from the local area network (LAN) using the Incus API with certificate-based authentication.\n\nInstead of using SSH for management, the author opted for the Incus API. This eliminates the need for SSH keys, SSH endpoints, and TERM variable issues. When accessing an instance, the author can utilize incus exec to run commands or incus shell to open a shell, all through the Incus API.\n\nUpon creation, each instance is based on a fresh Ubuntu cloud image. Cloud-init handles the entire initialization process, including system upgrades, installation of podman, writing of quadlet files, decryption of secrets, and starting of services. The inspiration for this process comes from the author's experience with Qubes OS, where each instance is created from a clean state after any changes, ensuring no configuration drift. If any changes are made to an instance, OpenTofu rebuilds it from scratch, providing a clean and consistent environment.\n\nRegarding security, each instance is connected to an internal bridge with an Incus ACL that rejects all connections by default. Explicit network connections are declared in the OpenTofu code, specifying the purpose of each connection. This design aims to minimize potential vulnerabilities if a service is compromised. The least trusted systems are isolated in virtual machines (VMs) for enhanced security, while most instances run as unprivileged system containers within Incus.\n\nFor sensitive services, separate VMs are employed to provide an additional layer of isolation. Network traffic is carefully managed, with a dedicated instance serving as the sole exit point. This instance offers package management, container image access, and a filtering proxy to ensure secure internet access for the necessary applications. Exceptions such as ACME certificates for public reverse proxy, CI runner, Uptime Kuma probes, and backups to S3 are documented and explicitly allowed.\n\nOverall, the author appreciates the simplicity and security provided by this architecture, with all instances created from fresh images and configurations, ensuring consistency and eliminating configuration drift. While there is a slight performance overhead during changes, the benefits of a secure, automated, and easily rebuildable system outweigh the costs.",
  "summary": null,
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}