This is one good article. I guess humans are now mostly redundant in open source. Bots can do everything themself, write code, submit PR, merge them and even blog about it. Time to book a place for myself in a graveyard.
for start private keys should never leave the system which uses them.
Wildcards are even worse, as if one host got compromised, all others can be spoofed.
"Maybe because I run Frigate in a virtual machine in Proxmox, so the Coral has to be passed through to the VM? Not sure."
FreeBSD + linux VM under Bhyve . Never had problems.
IMHO Jellyfin is processing everything it sent to clients. So I do not think it possible to put it behind SDN( may be it possible if server side transcoding is off)
Please define slow. Slow on what part? It should be like 250ms RRT to your server which is not much for web-based apps.
Imho not worth the risk. Nothing except ECC is protecting system from memory corruption. And consequences of flipped bit can be huge. Unless it is in a system you do not care about, just do not use it.
If you care about security you build it is own. No need to trust random dude in the internet. After all It just fire and forget. Copy whatever "code" is used to build container you are after, verify it once and than just rebuild it periodically to pull patches from more reliable sources.Docker security is a joke, no need to make it worse.
If you need something which can withstand some bitrot on single drive, just use par2. As long is filesystem is readable, you can recover files even if bit of data get corrupted
It means you published 8080. Just stop doing it. nginx can reach that container via internal network (assuming they are on same network). Publishing docker-compose would help.
This is one good article. I guess humans are now mostly redundant in open source. Bots can do everything themself, write code, submit PR, merge them and even blog about it. Time to book a place for myself in a graveyard.