Skip Navigation

glizzyguzzler

@ glizzyguzzler @piefed.blahaj.zone

Posts
2
Comments
96
Joined
1 yr. ago

  • Write-Up: My Multi-Purpose Travel Server

    Jump

  • This is great, I’d love to see the config files - especially the WiFi pass through stuff. No experience with that! But the rest all fitting together would be rad as hell.

    Peeps would be able to get the 4GB banana zero and just rock it up quick full service!

    I know that’s a big ask, sharing your cursed config files is work… if you feel up for it tho - hell yes

  • Setting Up OPNsense on Proxmox: Doubts regarding NIC setup

    Jump

  • I have this setup. Upfront, I would not recommend Proxmox, the update methods are annoying. The better way is straight Debian with Incus installed, then you get straightforward stable Debian updates automatically - they won't break anything and you're secure. Sometime I'll redo it - I haven't because, of course, it is my router and when its down I don't have internet! So foreboding and on the back burner.

    Also also Proxmox's GUI leaves a lot to be desired (for me, it looks like ass and is confusing), Incus is nicer for VM control and Cockpit is nicer for host control. After typing all that I realize I'm a hater at this point

    I haven't really noticed downtime issues cause of Proxmox updates cause I just do it when nothing is happening. And Proxmox hasn't bricked itself, though I am wary of it because that has happened to others due to their rolling release update style.

    I've got a Dell Wyse 5070 Extended with a 2 port Intel NIC in it. I pass both ports through leaving the built-in port for managing Proxmox.

    Here are my notes:

    Set NIC PCIe Passthrough for Network Card

    nano /etc/default/grub

    • Edit this line by adding intel_iommu=on to get

    GRUB_CMDLINE_LINUX_DEFAULT="quiet intel_iommu=on"

    update-grub

    nano /etc/modules

    • Add these lines

       
        
vfio  
vfio_iommu_type1  
vfio_pci  
vfio_virqfd

    update-initramfs -u -k all

    reboot

    Click on 2nd level thing named router on the left side vertical bar hierarchy thing and then click in the top right the blue Create VM button.

    • General tab
      • Name: OPNsense
      • Start at boot: checked
      • Start/Shutdown order: 1
      • Startup delay: 15

    • OS tab
      • Use media: DVD version (usb might work) of OPNsense.iso

    • System tab
      • Machine: q35
      • Bios: OVMF (UEFI)
        • Storage: local-lvm
        • UNCHECK Pre-enroll Keys (HATE)

    • Hard Disk tab
      • Disk size (GiB): 15
      • Discard: checked
      • SSD emulation: checked

    • CPU tab
      • Cores: 4
      • Type: host {makes it not moveable between diff CPU types but will theoretically allow for more speed}

    • Memory tab
      • Memory (MiB): 2048
      • Minimum memory (MiB): 512

    • Network tab
      • No network device: checked

    • Confirm tab
      • Do not start on creation

    • After creation, go to Hardware tab in the 2nd left vertical list on the browser page and click add
    • Click PCI Device
      • Device: ...01:00.0 I350 Gigabit... & ...01:00.1 I350 Gigabit... (1st & 2nd ones)
      • PCI-Express: checked

    Go to the Console tab in the 2nd left vertical list on the browser page and hit enter to get to a command line in the OPNsense VM

    !Add expand storage via command line!

    And lastly, during setup I have these notes 

       
        
It will choose wrong (WAN gets igb1 and LAN gets igb0 -> we want WAN gets igb0 and LAN gets igb1)  
Default User: root, PW: opnsense (they don't tell you anywhere, you don't have internet b/c this is your new router, fuck em)  
**Access at 192.168.1.1 via pluging an ethernet cable into the 1st port in a set of forwarded ports**  
*Note that we will move it so the 1st port is the WAN (can't access OPNsense from the WAN port for safety), so after following this you access via 2nd port*

    So watch out for those things. Not sure quite what I mean by the 1st and 2nd port things, may be related to on setup it had the order of the ports I wanted wrong so they're switched till setup is complete and it reboots.

    I don't remember doing this at this point, but maybe this info dump will help!

  • Question WRT secure networking with Podman/Docker stack and a reverse proxy in a VM "DMZ"

    Jump

  • Pangolin has a lot more going on than I expected, I thought it was just a mesh system. That might be a one-stop shop, thanks for sharing!!

  • Question WRT secure networking with Podman/Docker stack and a reverse proxy in a VM "DMZ"

    Jump

  • I do see Authentik can apparently act as a reverse proxy, so it can sit at the very front. But I’d lose out on caddy + crowdsec then…

    I’ll have to do some reading if caddy can actually just forward to caddy, and where the TLS is terminated and all that.

    And I do use the internal setting now, but I need it off if I want to publish the port on the LAN so that the VM can see the ports on the LAN. But if I can have WAN caddy do the auth check and forward along good stuff to the LAN caddy, then I’ll only need to publish LAN caddy’s port and that’s not the worst at all.

    Thanks for the ideas, I’ll try to cook “caddy (DMZ) -> auth OIDC (DMZ) -> caddy (LAN) -> services (LAN)”!

  • Question WRT secure networking with Podman/Docker stack and a reverse proxy in a VM "DMZ"

    Jump

  • Rootful to get the cross-user networkingEdit: cross-user via running the containers with userNS & user or volume idmap from root Podman. Containers can be run by different users and share networks, but the containers don't have root access

  • How do you manage you DB in a docker environment?

    Jump

  • Containers lower the bar since the developer doesn’t need to make their program work on every system - just the container’s system.

    Price we pay for more programs. And they bring boons like read-only, rootless, limited capabilities, and constrained perf limits (esp if you use Podman with Quadlets).

    And don’t feel trapped - the Dockerfile is a recipe to build that program. Probably want to do it in an LXC container since it’ll want to use /data for its data or something. But the LXC container can also be run as a user but the program thinks it’s root. Plenty of security abounds!

    I think it’s worth the price and you’re not trapped. They’re trapped with you and your robust Quadlet files

  • The truth will set you free 🥲

    Jump

  • You can slam semicolons at the ends of lines in Python, interpreter doesn’t care

    P sure you can do multiple lines in one line by slamming semicolons too, though idr for sure and I can’t be arsed to check

  • Single Sign in for Home Assistant now possible with OpenID

    Jump

  • Do you know of how it compares to the option that’s been around for a while?https://github.com/christiaangoossens/hass-oidc-auth

    I see they say “seamless”; the extant one requires a different landing page and it doesn’t remember logged in browser well. So on the face of it, this sounds better.

    But the one linked has had many more eyes and is made by the person who made a big stink on the forums https://community.home-assistant.io/t/open-letter-for-improving-home-assistants-authentication-system-oidc-sso/494223

    For the ease teased, I’ll prob check it out though

  • How bad of an idea is it to use computing HDDs in a DIY NAS?

    Jump

  • F in the chat for your savings, least you’ve got the peak of home NASes. Pretty fuckin cool and I hold out hope when the drop comes in a… 6 months to 3 years…? that I’ll be able to afford full SSD NAS life. The power savings, the speed, the no worries of shock or vibrations, the silence - jealous

  • How bad of an idea is it to use computing HDDs in a DIY NAS?

    Jump

  • It is a gamble, fuck the AI bozos for speculating us into economic uncertainty

  • How bad of an idea is it to use computing HDDs in a DIY NAS?

    Jump

  • For power on and off automatically, I just rely on Linux’s spin down timer. Which I guess is built in - not sure of anything more specific!

  • How bad of an idea is it to use computing HDDs in a DIY NAS?

    Jump

  • Backup drive doesn’t need to be anything more than holding your (ideally daily) backup of your main drive(s). It doesn’t need to be powered up and spinning all the time, it can be in the same computer. Spinning up and down causes major wear on hard drives, but I think spinning up once a day for backups is fine and won’t stress it.

    For example, have 3 used enterprise drives in my computer case: 2 in BTRFS RAID1 (mirror) as a data drive and 1 with BTRFS as a backup drive. I use snapshotting to mirror the data drive to the backup drive. I then use restic to copy essential data from the backup drive to a remote cloud location (friend’s house with a 4th smaller hard drive - if I did not have a friend with a hard drive I would use hetzner most likely). My Linux ISO’s don’t go remote, but my photos do.

    Thus I have immediate redundancy (and bit rot protection) from the BTRFS RAID1 data drives, I have a local full backup with the BTRFS backup drive, and I have my essential stuff far away if the computer explodes or something.

    Edit: again, if I was going to save cash I would drop the RAID1 from the data drives and just get 1 data drive and 1 backup drive. RAID1 is never as good as an independent copy.

  • How bad of an idea is it to use computing HDDs in a DIY NAS?

    Jump

  • I got several from them and they’ve been fine for a year now - and theoretically have a 5 year warranty from them too. So worked out for me to save some cash! Buuuut if they do end up failing, it’s gonna be a hassle to get replacements for sure

  • How bad of an idea is it to use computing HDDs in a DIY NAS?

    Jump

  • Consumer is fine then, cheapest you can. Edit: I did see people mention SMR drives, get cheapest CMR drives. SMR is not worth the money saved for usual use cases.

    You can def wait, but do the over-under with what you can pay. External drives, even if shucked, seem to be the lowest quality drives and die earliest. May be better to get real drives now, even with inflated costs.

    Make sure you get a drive for backup. Extra layout up front but worth it. I’d recc 1 data drive + 1 backup drive over just 2 raid1 data drives any day.

  • How bad of an idea is it to use computing HDDs in a DIY NAS?

    Jump

  • Now is a bad time to buy hard drives price-wise. Massive price gouging going on with all storage pre-sold based on IOUs to “AI” companies.

    If you must…

    Buy used enterprise drives with a ~5 year warranty. In US there is serverpartdeals and goharddrives. I am not sure of the Europe equivalents but I am sure they exist. The enterprise drives should be cheaper than new drives and will last longer; they’ve been used out of their early failure bathtub curve but they’re young enough to be given a 5 year warranty. Make sure to get ones with SATA connectors not SAS, you’ll need a PCIe card to talk to the SAS ones, and maybe something for power idk.

    They should be cheaper - I am not sure if price uncertainty has upended that.

    Enterprise drives are louder, I have them in a quiet case with sound dampening padding (fractal define) and I do not hear them 5 feet away.

    I have heard bad things about consumer drives longevity. I used several 1 TB barracudas for years with no issues in a server setting, I used 3 TB barracudas in a server setting and one failed early. I used a 4 TB Toshiba that failed early and I used an 8 TB blue that is fine in a personal computing setting. I have bought enterprise drives and none have an issue yet.

    It seems luck of the draw, so the thing to maximize is cheapest per GB.

  • Self-hosting paradox: Windows for specifically MS word

    Jump

  • King, simply neg your collaborators into using overleaf

  • I still haven't figured out how to do this

    Jump

  • You cannot control where pictures occur within a text body in latex, it decides for you. You can give it recommendations, but it’ll figure out the final alignment when rendering to page. I’m not sure that’s a limitation you want for design-focused use cases.

    And if you want to do something seriously nice you need to code a it in latex’s reverse Polish notation code language from hell, let me tell you latex ain’t the future of ease haha

  • How do I become one with the botnet

    Jump

  • SSH lets you remotely control a computer It runs on port 22 If you forward port 22 to your computer, you will allow anyone on the internet to SSH to your computer

    You can do that pretty safely by disabling root login and disabling password logins - only using keys to SSH in.

    You can join the borg botnet by enabling root login, setting a simple password (maybe even password as recommended!), and waiting.

  • How do I become one with the botnet

    Jump

  • King, all you must do is set up root ssh access with a short password and port forward port 22 to it. Super easy, super quick!

    For extra spice, I’d recommend also hitting your hard drives with a hammer once or twice a day. They just don’t like vibrations; you’ve gotta weed out the weak ones. Only the strong data will survive.

  • How do I avoid becoming one with the botnet?

    Jump

  • The only thing that can get hacked is something that responds on the World Wide Web.

    So you limit the scope of what talks to the WWW:

    Wireguard VPN will not respond unless the magic keys are correct, it’s ideal security and obscurity. Put everything you can behind it.

    For things I want on the WWW without a VPN, I split out two options otherwise.

    1. Caddy checking mTLS certificates that basically allows a device access without extra steps - relying on Caddy to be strong and mTLS to be strong.
    2. Authentik’s proxy check, I think Authelia has this too, but to access a site you hit an Authentik login first.

    For both of those, you rely on those services not having 0-day hacks. More likely for these services to stay ahead of the game and/or fix quick than something that doesn’t exist just to do authentication. I run them in containers that are run by independent users and are read-only with capabilities limited, in a VM.

    I’d say the Caddy route is more secure than Authentik, but it needs more effort to setup the certificate stuff. Authentik route needs a web browser to log in with. Obviously the WG VPN is primo.

    Edit: also tailscale is just managed wireguard, so it has the same benefits as a wireguard vpn with the catch a company has access to your network also now. But really simplifies setup…..