How safe/unsafe is it to host a website with a database on a Raspberry Pi?

Discussion
21

Kiran said:
@Pat
The problem isn’t opening ports on your router, it’s about what risk a compromised Raspberry Pi on your local network poses to everything else.

Yes, but as long as you don’t open ports it can’t operate as a server on the wider internet.

That’s why I said ‘don’t start …’

22

It will just get really hot and slow. But in theory, you can, especially if you have little traffic.

23

Harlan said:
It will just get really hot and slow. But in theory, you can, especially if you have little traffic.

I’m curious about this as well. Can it handle ~300 clients per month?

24

@Dex
It depends. If it’s a static HTML page it should be.

25

Harlan said:
@Dex
It depends. If it’s a static HTML page it should be.

If it’s a static HTML page it should handle thousands of clients per day without breaking a sweat.

26

Brett said:

Harlan said:
@Dex
It depends. If it’s a static HTML page it should be.

If it’s a static HTML page it should handle thousands of clients per day without breaking a sweat.

No. Uploads still take memory.

27

Harlan said:
@Dex
It depends. If it’s a static HTML page it should be.

I see. Thanks.

28

@Dex
That doesn’t really tell us much. How often are the 300 clients using the site? A step up would be a mini PC with a Celeron, which you can get for around $100. I’d opt for that over an RPi.

29

Vin said:
@Dex
That doesn’t really tell us much. How often are the 300 clients using the site? A step up would be a mini PC with a Celeron, which you can get for around $100. I’d opt for that over an RPi.

It’s for a very niche project. Overall around ~15MB PHP files. Clients register an account, save to SQL DB, that’s it. Maybe clients come back to change something/account settings. What do you think?

30

@Dex
Sounds like an RPi would handle it no problem. If we’re talking about under a thousand rows, and only like a dozen daily active users, it should be fine. Keep track of the CPU usage and realize when you need to upgrade.

That said, you can get a VPS for like $3/mo that’ll run laps around an RPi.

So if you have one already, there’s no harm in trying. If you’re looking to purchase one to host something, I’d look elsewhere…either a VPS or at least an x86 mini PC.

31

@Vin
Yeah, I have an RPi lying around. I’ll try. Thank you.

32

Dex said:
@Vin
Yeah, I have an RPi lying around. I’ll try. Thank you.

I’d recommend an M.2 hat or a USB drive instead of the micro SD if you’re going to be using it for a server.

33

@Dex
Yes, definitely. I would begin to monitor closely at 4-5 concurrent users.

34

Many developers vastly overestimate the server hardware & network requirements necessary to run a site. It all depends on concurrent load/traffic.

A Pi can support potentially hundreds of concurrent requests, depending on what the site is doing. A heavy application might drop that down to a couple dozen.

The first bottlenecks you’ll likely encounter on a Pi will be its own RAM and network throughput.

  • More RAM is better… depending on what you’re doing, 2GB might not be enough. 4GB is a safe starting point.
  • A server doesn’t need a desktop environment occupying RAM.
  • Older Pis that route Ethernet activity over the USB bus have limited network throughput.

Web servers and databases have decently performant defaults, but expect to optimize them for your specific environment and use case.

Security depends on the Pi’s access controls and your local network.

  • Only expose the absolutely necessary Pi ports (80, 443, etc.) outside your LAN.
  • Don’t use the default pi user.
  • Set the Pi’s root password.
  • Put the Pi in a DMZ configured on your local router.

There are many guides to setting up a local Pi server (web or otherwise). Jeff Geerling on YouTube probably has several relevant videos.

35

Put it behind a firewall, and subnet it from the rest of your network.

36

Luca said:
Put it behind a firewall, and subnet it from the rest of your network.

Thanks, that’s smart.

37

Morgan said:

Luca said:
Put it behind a firewall, and subnet it from the rest of your network.

Thanks, that’s smart.

And have the database server listen on a Unix socket rather than an IP.

38

Start by hosting it on the Raspberry Pi, and then upgrade to a VPS later if you need to.

I used my Raspberry Pi for hosting my own projects for quite a while before I decided to move over to a VPS.

39

Storm said:
Start by hosting it on the Raspberry Pi, and then upgrade to a VPS later if you need to.

I used my Raspberry Pi for hosting my own projects for quite a while before I decided to move over to a VPS.

Projects hosted for internal/home use or external/internet use?

40

Honestly, it’s doable, but I wouldn’t recommend it for anything serious. Main issues:

  • Your home IP becomes public, making you more vulnerable.
  • Power/network outages = site down.
  • Pi’s aren’t really built for sustained heavy loads.

If it’s just a personal project for learning, go for it. But for anything you want reliable/secure, stick with a VPS - they’re cheap these days anyway (~$5/month).

If you still want to try the Pi route, look into:

  • Setting up a good firewall.
  • Using Cloudflare as a proxy.
  • Regular backups.
  • Monitoring for suspicious activity.