@easeKItMAn@lemmy.world avatar

easeKItMAn

@easeKItMAn@lemmy.world

This profile is from a federated server and may be incomplete. Browse more on the original instance.

easeKItMAn,
@easeKItMAn@lemmy.world avatar

Some fancy case options depending on your needs: Shop Inux3d
Added passive cooling for PI running HA and never encountered any issues.

easeKItMAn,
@easeKItMAn@lemmy.world avatar

I’m somewhat paranoid therefore running several isolated servers. And it’s still not bulletproof and will never be!

  • only the isolated server, ie. no internet access, can fetch data from the other servers but not vice versa.
  • SSH access key based only
  • Firewall dropping all but non-standard ports on dedicated subnets
  • Fail2ban drops after 2 attempts
  • Password length min 24 characters, 2FA, password rotation every 6 months
  • Guest network for friends, can’t access any internal subnet
  • Reverse proxy (https;443 port only)
  • Any service is accessed by a non-privileged user
  • Isolated docker services/databases and dedicated docker networks
  • every drive + system Luks-encrypted w/ passphrase only
  • Dedicated server for home automation only
  • Dedicated server for docker services and reverse proxy only
  • Isolated data/backup server sharing data to a tv box and audio system without network access via nfs
  • Offsite data/backup server via SSH tunnel hosted by a friend
easeKItMAn,
@easeKItMAn@lemmy.world avatar

Rotating passwords only for web services. Vaultwarden does make it easy. Not all services allow 2FA.

easeKItMAn,
@easeKItMAn@lemmy.world avatar

Guessing it is more a habit from back in time when ssl certification wasn’t common. Panic of MITM attacks, friends sharing their trusted access to other friends, etc. all contributed to my actual status of paranoia.
Don’t make me reconsider my cybersec approach ;)

easeKItMAn,
@easeKItMAn@lemmy.world avatar

I used VMs some time ago but never managed to look deeper into separation of bare metal vs VMs. Hence I can’t assess this reasonably.
Docker got me interested when it started and after discovering its networking capabilities I never looked back.
Basically I’m trying to minimize the possibility that by intercepting one dockerized service the attacker is able to start interacting with all devices. And I have lots of devices because of a fully automated house. ;) My paranoia will ensure the constant growth of privacy and security :)

easeKItMAn,
@easeKItMAn@lemmy.world avatar

I can recommend mopidy and snapcast.
This will allow for a Sonos like setup you are looking for.

easeKItMAn,
@easeKItMAn@lemmy.world avatar

You can configure multiple zones on a server snap with multiple hosts
A client can assign to one host only.

easeKItMAn,
@easeKItMAn@lemmy.world avatar

Personally I use Raspi 2 and Zero for that purpose. HATS for digital connection or if you want connecting speakers directly consider AMP2 HAT.
Homeassistant controls grouping, volume etc.

easeKItMAn,
@easeKItMAn@lemmy.world avatar

If I’m understanding you correctly, you could make use of a shell script for this. Use WGET to download lists, then combine them into a single large file, and finally create a new file with no duplicates by using “awk ‘!visited[$0]++’”

wget URL1 URL2 URL3
cat *.txt > all.txt (This overwrites all.txt)
awk ‘!visited[$0]++’ all.txt > no_duplicates.txt

easeKItMAn,
@easeKItMAn@lemmy.world avatar

It depends a bit on what you want to accomplish, the threat model, the devices in use, and other topics. I think this is a good read: avoidthehack.com/best-pihole-blocklists

Some specific social blocklists: github.com/d43m0nhLInt3r/socialblocklists

easeKItMAn,
@easeKItMAn@lemmy.world avatar

Beets is my favorite tagger since I prefer CLI. Match making policy can be adjusted and discogs plugin can be added I recommend the folder structure /artist/album/track

easeKItMAn,
@easeKItMAn@lemmy.world avatar

www.home-assistant.io

Possibly Home Assistant is able to cover your devices and needs.

easeKItMAn,
@easeKItMAn@lemmy.world avatar

Guessing, millions of people will feel obligated to share their ID. Not everyone can be saved

easeKItMAn,
@easeKItMAn@lemmy.world avatar

Make sure the SQL server is not writing/blocking any files: docker-compose stop vaultwarden

Backup that specific folder to another destination and restart docker-compose up -d

Recommended hard drive monitoring (Ubuntu server) options?

I’ve had a home server for years, at first using Windows Server, then Unraid, and now using Ubuntu server. I’ve long known that I should keep a close eye on my spinning rust, but I never really knew the best way to have that monitoring quietly automated in the background, only sending me a message when something bad shows...

easeKItMAn,
@easeKItMAn@lemmy.world avatar

If you want regular automatic hdd checks and don’t need a WebUI I recommend github.com/smartmontools

easeKItMAn,
@easeKItMAn@lemmy.world avatar

SMART value monitoring helped me finding faulty drives, not only once. And drives are tested before adding to a production system.
Certainly system drives are separate from data drives. The latter can be perfectly monitored by SMART values.

easeKItMAn,
@easeKItMAn@lemmy.world avatar

I think you can’t track data corruption either because you will find out only when it occurred. Same is valid for SMART values as you correctly state. I believe it is a mix of using zfs, ECC and SMART monitoring.
phoenixnap.com/blog/data-corruption

Thanks for clarifying the intricacies connected to SMART monitoring.

easeKItMAn,
@easeKItMAn@lemmy.world avatar

I set up custom bash scripts collecting information (df, docker json, smartCTL etc) Either parse existing json info or assemble json strings and push it to Homeassistant REST api (cron) In Homeassistant data is turned into sensors and displayed. HA sends messages of sensors fail.
Info served in HA:

  • HDD/SSD (size, smartCTL errors, spin up/down, temperature etc)
  • Availability/health of docker services
  • CPU usage/RAM/temperature
  • Network interface/throughput/speed/connections
  • fail2ban jails

Trying to keep my servers as barebones as possible. Additional services/apps put strain on CPU/RAM etc. Found out most of data necessary for monitoring is either available (docker json, smartCTL json) or can be easily caught, e.g.

df -Pht ext4 | tail -n +2 | awk '{ print $1}

It was fun learning and defining what must be monitored or not, and building a custom interface in HA.

easeKItMAn,
@easeKItMAn@lemmy.world avatar

At last we keep it simple ;)

  • All
  • Subscribed
  • Moderated
  • Favorites
  • JUstTest
  • kavyap
  • DreamBathrooms
  • cubers
  • osvaldo12
  • mdbf
  • magazineikmin
  • normalnudes
  • InstantRegret
  • rosin
  • Youngstown
  • slotface
  • khanakhh
  • ethstaker
  • Leos
  • ngwrru68w68
  • everett
  • cisconetworking
  • tacticalgear
  • anitta
  • thenastyranch
  • Durango
  • tester
  • GTA5RPClips
  • modclub
  • megavids
  • provamag3
  • lostlight
  • All magazines