Skip Navigation

Jul (they/she)

@ irotsoma @piefed.blahaj.zone

Posts
4
Comments
64
Joined
11 mo. ago

  • What's your favourite thing to self host and why?

    Jump

  • With a reverse proxy there's no need for hoops unless you add some authentication mechanism on top of that. I use reverse proxies for several things so that they flow through filtering like crowdsec or fail2ban. It just routes the single port to the device on question as is. The idea is to make it indistinguishable from a fully exposed port to the user. Just have to make sure whatever system runs the reverse proxy is secured. I always make sure that nothing significant is on the system that is exposed to the internet other than the reverse proxy server and all other ports are closed internally and externally. Ideally a device that has multiple Ethernet ports works well so you can keep an ssh port open on the internally facing ethernet port for troubleshooting. Nice if they are 2.5Gbit or 10Gbit ports, too, since they route a lot of traffic. But not needed.

  • What's your favourite thing to self host and why?

    Jump

  • Yubikeys work great for me for 2FA or passwordless auth. NFC and USB interfaces. Very secure. Pretty durable, though USB-C is inherently less durable due to the size and complexity than the USB-A footprint. But I've never had an issue with mine in my pocket or purse right with my keys. But if you bend it while it's inserted in something it can be an issue.

  • PSA: the bitwarden clients got an upgrade that makes them incompatible with vaultwarden

    Jump

  • This would be the 3rd time since I've been using it that it has broken compatibility with Vaultwarden, but Vaultwarden always fixes it pretty quickly. But usually browser plugins end up updating before I get around to updating Vaultwarden.

  • PSA: the bitwarden clients got an upgrade that makes them incompatible with vaultwarden

    Jump

  • Yeah it has both onetime and subscription. I got the one time for around $15.

    And yeah the app is available in multiple places. For Android, I get it from a custom Fdroid repo but Obtanium would work as well. I use that for a few apps.

  • PSA: the bitwarden clients got an upgrade that makes them incompatible with vaultwarden

    Jump

  • Yes they can both be used at the same time, though KeyPass stuff is new and beta. I've never used it.

    There is both a subscription model and a one time payment model. I bought it with the one-time payment. I believe it was $15. But don't quote me.

  • PSA: the bitwarden clients got an upgrade that makes them incompatible with vaultwarden

    Jump

  • Keyguard. It's not perfect and makes money from the paid version for syncing changes back to the server as well as offline editing that will then sync when you're back online. But it was worth it back when I bought it, and it has never broken so far.

  • PSA: the bitwarden clients got an upgrade that makes them incompatible with vaultwarden

    Jump

  • Thanks, probably saved me a lot of headache on my laptop browsers. Fortunately, I don't use the official Bitwarden client on android partly because this seems to keep happening.

  • Reliable messenger for family use?

    Jump

  • I use Signal because it's the best balance of privacy and security vs. convenience and reliability I have found. Not self-hosted, but I've yet to find a self hosted alternative that is as reliable, especially since I don't want to set up distributed servers, and it's one of those things that "just needs to work" or people will abandon it quickly.

    And the older people I've convinced to use it, like my mom, have had very little trouble adopting it. It helped that RCS messaging is so unreliable on my phone since Google or my carrier keep seeming to break it (likely became I use GrapheneOS), and also for those with iPhones it is way more compatible with itself vs Apple and Google refusing to implement RCS in a way that all features work between them, like message reactions. Without RCS, my mom couldn't send me decent quality pictures of my niece all the time, and I couldn't send nice pictures of my outfits to the girl I'm dating, LOL.

  • Privacy respecting registrars

    Jump

  • Can you use a dummy address or a friend's address in another country and/or sign up via a VPN to mask your location? There are companies that will open and scan your mail and make it available online so it could be a real address. But they are a little pricey. It's likely due to UK laws not the provider themselves, so probably all reputable providers (that follow the law) may require it.

  • Selfhosted @lemmy.world
    Jul (they/she) @piefed.blahaj.zone

    Example Flux Kubernetes Setups

  • [META] Are paid for, closed source projects, being advertised on this community, appropriate?

    Jump

  • If it's closed source but can be self hosted, what is the business model? I think it would be hard to fight piracy in that case. If it requires connecting to a service periodically for licenses and has no free version that doesn't require that, then I believe it should be banned. I don't consider that self-hosted. If the company disappears and the served goes down, its dead. That's just running on your hardware, but not under your control. If the application is open or can be run locally without connecting to their servers and the paid portion is an add on like working as a proxy or something, then I have no real issue with that.

    That said, there definitely should be a higher standard for users who are only marketing here. They should be making posts specifically for this group, not just sharing generic ads. The post should specifically state why it's useful to self-hosters and thus relevant to the group.

  • How do you manage you DB in a docker environment?

    Jump

  • I run a single instance of Postgres and one of MariaDB on my NAS that all services connect to. And all of my containers store their settings in NFS shares from that NAS and backup most other things to the NAS. This greatly simplifies off-site backups overall when a copy of almost everything critical lives on the NAS.

    Of course, the NAS needs to be powerful enough to handle the load, but since settings don't get changed often and backups are during off hours and NFS has good caching anyway, the DBs are really the only heavy load on the NAS outside of storing and serving media. It has plenty of memory and has two 2.5Gb ports trunked together and a couple of small SSDs for fast caching in addition to the RAID array of HDDs. So it's easily able to handle all of its file sharing duties as well as hosting the DBs.

    Only negative might be that there's no fail over if the NAS goes down. But I also don't have a second router, so that's another even more devastating single point of failure. But since everything critical is backed up to the NAS and then off-site, it's an acceptable risk considering the cost to properly remediate it and the unlikelihood of major issues outside of times I'm doing maintenance..

  • How many and how much are your subscriptions?

    Jump

  • ISP: $75/month for symmetrical 1Gbit fiber and unlimited data. This is the biggest expense. All other options are 1-25 Mbps up with cable or dsl and most are just as expensive.

    VPSs: around $40/month, though I'm planning to cut back a bit as I'm moving some stuff local.

    2 Domains: < $30/year

    The rest is purchased with no future subscription costs. This covers everything except for the security cams that I need to migrate off of corporate services one of these days.

  • How would you expose Jellyfin securely without a vpn?

    Jump

  • Reverse proxy with fail2ban or crowdsec. It's possible to set up things like Pangolin which ultimately use a VPN between external and internal access points but not at the client, though it takes more setup if you want to use apps over pangolin instead of just the browser.

  • People who are staying on Plex, have you tried Jellyfin? What about it do you not prefer? (real question)

    Jump

  • I have a lifetime pass from many years ago when it was cheap. So I'm not in a huge rush to convert and want to do it right. But I am on the path to converting. I decided to make a major change to my home server infrastructure and it's still in an experimental stage. Moving from a really old standalone computer I've used for. HTPC purposes over the years, currently dedicated to Plex combined with a few raspberry pi's of various generations for the little stuff, and a single, good NUC for my router, to adding two additional NUCs and eventually upgrading the Plex computer with a more modern processor and video card for ML stuff for Immich and a few other systems that I plan to start using. I'm not just moving from Plex, but also a lot of Google and Nest products.

    My dilemma has been Docker Swarm vs Kubernetes. I was trying to set up Kubernetes in a way that is easily repeatable and self documenting, but ended up with lots of manual steps required to install things and lots of things that I had to write my own helm charts for as well as the scripts to install and set up Kubernetes itself on each of the servers. Lots of custom stuff. Docker Swarm would be way easier, but the issue is I'm worried about Docker getting so proprietary these days and swarm mode getting so little attention, and Podman quadlets aren't self balancing across multiple small servers like swarm. So that's why I haven't switched to Jellyfin yet.

  • Plex Announces Massive Price Hike on Lifetime Subscription Plans

    Jump

  • Seems funny that they continue to increase the price as that value sharply declines with the limited life left in it.

  • Bitwarden's new CEO has a Private Equity background, removed 'Inclusion' and 'Always Free' from their website -- because of course he did

    Jump

  • I mean at this point in its evolution, what parts does vaultwarden rely on from bitwarden? The clients, but there are alternatives like keyguard for Android devices. What other layers does it rely on, I actually have been trying to figure this out myself.

  • Bitwarden's new CEO has a Private Equity background, removed 'Inclusion' and 'Always Free' from their website -- because of course he did

    Jump

  • Glad I started using Vaultwarden a while back. Just need to find better apps for android and Firefox I guess because I'm guessing they're going to try to break compatibility.

  • What does your IPv6 setup look like?

    Jump

  • Right, but my point is, most US ISP are shitty and don't offer IPv6 blocks. If you are in the lucky minority who's ISP does provide proper support for IPv6, then why bother dealing with IPv4 at all, ignore it. Almost nothing needs it anymore besides the majority of ISPs in the US which all suck.

    There are some cases where locally defined addresses (private IPv4 or IPv6 ULAs) and NAT are useful for controlling what people and devices on your LAN can access, but usually not in a residential or home lab situation. So why bother. Either if your ISP offers proper IPv6, just use that, or if they don't, just use IPv4 and ignore the transitional IPv6 addresses. With both you end up writing every NAT and firewall rule twice, I don't see the point unless you have an old device that can't handle IPv6.

    As for performance hits, I was referring to the fact that most ISPs dont offer proper blocks of IPv6 and the transitional technologies they do offer like 6rd or 6to4 do have performance hits, sometimes extremely significant ones. So if you implement dual stack and your DNS query returns AAAA record and your systems prefer it, they will always take a hit. This is from lots of experience. I always disable IPv6 because my ISP uses 6rd and it is the only one in the major city I live in that offers >10Mbps upstream, so it's not feasible to switch. When I was on Comcast and got an IPv6 block, I disabled IPv4. Dual stack would be too much work.

  • Best way to manage all my services as containers?

    Jump

  • What do you use for repeatable recovery and deployment of systems?

    I've looked at ArgoCD and FlexCD. ArgoCD was too flaky. When I made changes to helm files it would often fail to deploy them and the UI often wouldn't really show the detailed errors from things like helm syntax errors, so it was a pain to troubleshoot.

    FlexCD was just really a pain to configure in the first-place and I didn't want to learn kustomize when I already have helm charts.

    And neither really supported staged deployments or dealt with dependant services well. So I couldn't get it to deploy the infrastructure level helm charts like PostgreSQL before deploying the services that depend on it. Technically, with Kubernetes it shouldn't matter about the order of deployment but in reality when ArgoCD would deploy the other stuff first and wait for it to come up and it never came up because the dependencies weren't there, it caused it to choke a lot.

    Just an example of the issues I've had. But I really want an easy way to make lots of small changes to charts and deploy them quickly as well as being able to quickly recover the cluster from backups if something catastrophic happens like a fire without having to manually deploy each chart. Just curious how others handle it or if it's always manual deployment of charts via CLI only.

  • Selfhosted @lemmy.world
    Jul (they/she) @piefed.blahaj.zone

    Ollama Server Component Recommendations

  • Selfhosted @lemmy.world
    Jul (they/she) @piefed.blahaj.zone

    IPv6 With ISP That Only Does 6rd

  • Selfhosted @lemmy.world
    Jul (they/she) @piefed.blahaj.zone

    SSH Client for Linux Desktop and Android - Alternative to Termius