@vegetaaaaaaa@lemmy.world avatar

vegetaaaaaaa

@vegetaaaaaaa@lemmy.world

This profile is from a federated server and may be incomplete. Browse more on the original instance.

vegetaaaaaaa,
@vegetaaaaaaa@lemmy.world avatar

If OP’s router is so basic that they can’t change DNS server addresses, there are chances they can’t disable the builtin dhcp server either. 2 DHCP servers on the same network will not end well.

I think the only way is to manually set DNS servers on each client.

Who / why puts a downvote on almost each new post on r/selfhosted?

I haven’t really posted a lot to r/selfhosted (or Reddit in general), but whenever I did, there was always someone who voted my post down in less than 30 minutes after it was posted. Maybe because of this (or maybe because they were actually perceived as low quality posts), these posts never received a lot of engagement with...

vegetaaaaaaa,
@vegetaaaaaaa@lemmy.world avatar

I have to agree with the second reply there though (and will definitely downvote these kind of posts):

It sometimes feels like if you take any day in a vacuum and look at the posts, it’s: 75% things that’ve either been answered 300 times already or are Googleable; 15% troubleshooting that would probably be better asked towards that software’s community; 5% “hey there’s an update!” spam (4% of that being from the 300 different no code internal apps builders); and MAYBE 5% original content, questions, or good discussions.

vegetaaaaaaa,
@vegetaaaaaaa@lemmy.world avatar
  • Docker swarm does not respect its own compose spec, exposes services on all interfaces and bypasses firewall rules [1], [2]
  • 1 million SLOC daemon running as root [1]
  • Buggy network implementation, sometimes requires restarting the daemon to release bridges [1]
  • Requires frequent rebuilds to keep up to date with security patches [1] [2] [3]
  • No proper support for external config files/templating, not possible to do graceful reloads, requires full restarts/downtime for simple configuration changes [1]
  • Buggy NAT implementation [1]
  • Buggy overlay network implementation, causes TCP resets [1]
  • No support for PID limits/fork bomb protection [1], no support for I/O limits [2]
  • No sane/safe garbage collection mechanism, docker system prune --all deletes all unused volumes - including named volumes which are unused because the container/swarm service that uses them is stopped at that particular moment for whatever reason. Eats disk space like mad [1] [2]
  • Requires heavy tooling if you’re serious about it (CI, container scanning tools, highly-available registry…) [1], Docker development and infrastructure is fully controlled by Docker Inc. [1] [2] [3] [4] [5] [6]
vegetaaaaaaa,
@vegetaaaaaaa@lemmy.world avatar

Your LAN router/switch will see the credentials unencrypted. An untrusted device on your network could perform ARP spoofing, pretend to be 192.168.something.something, and intercept the credentials. Do you trust all devices on your network?

It’s better practice (and simple enough) to setup HTTPS with self-signed certificates and have the browsers manually accept the cert on first connection.

vegetaaaaaaa,
@vegetaaaaaaa@lemmy.world avatar

Use files when possible - I use a combination of:

  • filesystem hierarchy (max 3-4 levels deep, I can share the general structure if needed)
  • markdown notes for wiki-like content or notes (either versioned in git - so also accessible from my Gitea instance, or under the Nextcloud Notes/ directory, so also accessible from the Nextcloud Notes app)
  • software mirrors either through a mirroring script or using Gitea’s mirroring feature
  • Shaarli for bookmarks and wiki-like content, which get processed every day by a script that archives content to local files (mostly audio/video for now, I’m still writing the page archiving part, archivebox is too bloated for my needs and is missing critical features such as ad blocking)

All these components are linked in some way or another (e.g. all media automatically goes to the media directory of a jellyfin instance)

How are you keeping up with new selfhosted apps?

I’ve calmed down a bit but still would like to know if there are any new ‘cool’ apps to selfhost. I know of the awesome-selfhosted github repo. Any other great sources, and could we incorporate something like that into our selfhosted community here? Maybe a bot that checks if any new ones been added?

vegetaaaaaaa,
@vegetaaaaaaa@lemmy.world avatar

I maintain github.com/awesome-selfhosted/awesome-selfhosted :) Reviewing additions takes some time but it gives a good insight on new releases. You can check the list of Pull Requests/software being added here

There is also a third-party tool that tracks newly added software.

vegetaaaaaaa,
@vegetaaaaaaa@lemmy.world avatar

FTP requires a installing a thick client, is an old, insecure, complicated protocol, doesn't play well with firewalls... FTP must die! https://mywiki.wooledge.org/FtpMustDie. At least use SFTP (not FTPS) which is built-in to SSH servers and much simpler to setup. But then good luck explaining normal users how to configure a client (WinSCP is decent but sill requires some configuration) unless they are running Linux (most file managers support SFTP in a simplified way).

An alternative is Samba/SMB (multiplatform file sharing protocol Linux/OSX/Windows) - configuring it is a bit involved, but definitely doable. Client setup/file manager integration is OK.

But I would rather use Nextcloud for this, a simple web interface is probably more intuitive for non-technical users. And you get other features such as comments, tags... if that's your thing. Can also be accessed from desktop file managers using WebDAV.

SMB would probably have the best performance of the three, though. Depends on the number and size of files being shared.

How to encrypt content of docker volumes?

I would like to run Paperless in my homeserver. While this server is not running sensitive data, this would change once paperless gets to manage all my invoices, bank statements, health docs and so on. So while running my Proxmox VMs and LXCs unencrypted, in this case I'd like to encrypt paperless-ngx data so that if someone...

vegetaaaaaaa,
@vegetaaaaaaa@lemmy.world avatar

Full disk encryption of the underlying disk (cryptsetup/LUKS)

vegetaaaaaaa,
@vegetaaaaaaa@lemmy.world avatar

This answer says it all. A reverse proxy dispatches HTTP requests to several “backend” services (your applications), depending on what domain name is requested in the HTTP request headers. For example using Apache as a reverse proxy, a config block such as

<pre style="background-color:#ffffff;">
<span style="color:#323232;"><VirtualHost *:443>
</span><span style="color:#323232;">  ServerName  media.example.org
</span><span style="color:#323232;">  ...
</span><span style="color:#323232;">  ProxyPass "/" "http://127.0.0.1:8096/"
</span><span style="color:#323232;"></VirtualHost>
</span>

will redirect requests made on port 443 with the HTTP header Host: media.example.org (for example a request to https://media.example.org/my/page) to the “backend” service listening on 127.0.0.1 (local machine), port 8096 (which may be a media server, a wiki, …). This way you only have to expose ports 80/443 to the outside network, and the reverse proxy will take care of dispatching requests to the correct “backend” service.

Most web servers can be used as reverse proxies.

In addition, since all requests go through the proxy, it is a good place to manage centralized logging, SSL/TLS certificates, access control such as IP whitelisting/blacklisting, automatic redirects…

  • All
  • Subscribed
  • Moderated
  • Favorites
  • megavids
  • kavyap
  • DreamBathrooms
  • thenastyranch
  • magazineikmin
  • InstantRegret
  • GTA5RPClips
  • Youngstown
  • everett
  • slotface
  • rosin
  • osvaldo12
  • mdbf
  • ngwrru68w68
  • JUstTest
  • cubers
  • modclub
  • normalnudes
  • tester
  • khanakhh
  • Durango
  • ethstaker
  • tacticalgear
  • Leos
  • provamag3
  • anitta
  • cisconetworking
  • lostlight
  • All magazines