Skip Navigation

A Mouse

@ mouse @midwest.social

Posts
1
Comments
12
Joined
3 yr. ago

  • Mullvad exit IPs are surprisingly identifying

    Jump

  • I also posted this on the cross-post, here's a response.

    I work at Mullvad. (co-CEO, co-founder)

    Some aspects of the described behavior are as we intended and some are not. The cause is not exactly as described in the blog post. As for mitigation, we are already testing a patch of the unintended behavior on a subset of our infrastructure. If any of you try to reproduce the blog post's findings you may get confusing results throughout the day.

    We will also re-evaluate whether the intended behaviors are acceptable or not. Some of this is a trade-off between multiple aspects of privacy, and multiple aspects of user experience.

    Please note that this is my current understanding, which may change. I was only made aware of this an hour ago, and most of that time was spent talking with Ops, considering what to do immediately, and writing this post.

    Finally, for those of you who do security research: when you find a security or privacy issue, please consider notifying the maintainer/vendor before publishing your findings, even if you intend to publish right away.

    https://news.ycombinator.com/item?id=48145679

  • Mullvad Leta shutting down

    Jump

  • Headscale

    Jump

  • Look at either putting it behind a reverse proxy or using the built in Let's Encrypt / ACME configuration.

    Suggested documentation:

    The config linked to in their documentation states

     
        
# Address to listen to / bind to on the server
#
# For production:
# listen_addr: 0.0.0.0:8080
listen_addr: 127.0.0.1:8080

# Address to listen to /metrics and /debug, you may want
# to keep this endpoint private to your internal network
metrics_listen_addr: 127.0.0.1:9090

    Port 8080 TCP is used for the connection, 9090 TCP is for metrics and not suggested to port forward. If you use a reverse proxy, you do not need to port forward to either of those ports directly, and instead to the reverse proxy.

  • Those who don't use dashboards, how are you managing your services?

    Jump

  • Bookmarks for linking to services. Grafana for graphs that I only look at if I am curious or looking into when a problem arises. I could use Uptime Kuma if I wanted a simpler solution or notifications.

  • FFmpeg moves to Forgejo

    Jump

  • selfh.st: improper etiquette by 2010 standards? (trackers, no RSS) Thoughts?

    Jump

  • The ?ref tag is from the Ghost blogging platform. https://forum.ghost.org/t/remove-ref-from-links-in-posts/37701/2

    This is called “Outbound link tagging” - you can configure this on the Analytics Settings page (/ghost/#/settings/analytics)

    And yeah, they do the same as GamingOnLinux with not including the content in the RSS feeds.

    Forgot to give my opinion. The ref tag doesn't bother me because it's not giving any private information up, besides where I am from just like the referrer header does. I am kind of conflicted with the RSS feeds because I personally use them for many things, however I understand that these places need to advertise to make money (though I block ads too).

  • This Week in Self-Hosted (11 April 2025)

    Jump

  • How do I use HTTPS on a private LAN without self-signed certs?

    Jump

  • Unfortunately that's one area I am bad with, I tend to use reverse_proxy for most such as Baikal running with the ckulka/baikal Docker image (which runs Nginx or Apache), otherwise I only static sites.

    I'd start by looking at Baikal's config for Apache and Nginx, https://sabre.io/baikal/install/ and comparing to the directives for Caddy, https://caddyserver.com/docs/caddyfile/directives and

    Since it uses PHP, it will need that, https://caddyserver.com/docs/caddyfile/patterns#php

    Upon my searches I came across this, it talks about running Baikal with Caddy specifically. https://github.com/caddyserver/caddy/issues/497

    I hope that this provided some helpful directions.

  • How do I use HTTPS on a private LAN without self-signed certs?

    Jump

  • I use Caddy for this. I'll leave links to the documentation as well as a few examples.

    Here's the documentation for wildcard certs. https://caddyserver.com/docs/automatic-https#wildcard-certificates

    Here's how you add DNS providers to Caddy without Docker. https://caddy.community/t/how-to-use-dns-provider-modules-in-caddy-2/8148

    Here's how you do it with Docker. https://github.com/docker-library/docs/tree/master/caddy#adding-custom-caddy-modules

    Look for the DNS provider in this repository first. https://github.com/caddy-dns

    Here's documentation about using environment variables. https://caddyserver.com/docs/caddyfile/concepts#environment-variables

    Docker

    A few examples of Dockerfiles. These will build Caddy with DNS support.

    DuckDNS

     
        
FROM caddy:2-builder AS builder
RUN xcaddy build --with github.com/caddy-dns/duckdns

FROM caddy:2
COPY --from=builder /usr/bin/caddy /usr/bin/caddy

    Cloudflare

     
        
FROM caddy:2-builder AS builder
RUN xcaddy build --with github.com/caddy-dns/cloudflare

FROM caddy:2
COPY --from=builder /usr/bin/caddy /usr/bin/caddy

    Porkbun

     
        
FROM caddy:2-builder AS builder
RUN xcaddy build --with github.com/caddy-dns/porkbun

FROM caddy:2
COPY --from=builder /usr/bin/caddy /usr/bin/caddy

    Configure DNS provider

    This is what to add the the Caddyfile, I've used these in the examples that follow this section. You can look at the repository for the DNS provider to see how to configure it for example.

    DuckDNS

    https://github.com/caddy-dns/cloudflare?tab=readme-ov-file#caddyfile-examples

     
        
tls {
	dns duckdns {env.DUCKDNS_API_TOKEN}
}

    CloudFlare

    https://github.com/caddy-dns/cloudflare?tab=readme-ov-file#caddyfile-examples Dual-key

     
        
tls {
	dns cloudflare {
		zone_token {env.CF_ZONE_TOKEN}
		api_token {env.CF_API_TOKEN}
	}
}

    Single-key

     
        
tls {
	dns cloudflare {env.CF_API_TOKEN}
}

    PorkBun

    https://github.com/caddy-dns/porkbun?tab=readme-ov-file#config-examples Global

     
        
{
        acme_dns porkbun {
                api_key {env.PORKBUN_API_KEY}
                api_secret_key {env.PORKBUN_API_SECRET_KEY}
        }
}

    or per site

     
        
tls {
	dns porkbun {
			api_key {env.PORKBUN_API_KEY}
			api_secret_key {env.PORKBUN_API_SECRET_KEY}
	}
}

    Caddyfile

    And finally the Caddyfile examples.

    DuckDNS

    Here's how you do it with DuckDNS.

     
        
*.example.org {
        tls {
                dns duckdns {$DUCKDNS_TOKEN}
        }

        @hass host home-assistant.example.org
        handle @hass {
                reverse_proxy home-assistant:8123
        }
}

    Also you can use environment variables like this.

     
        
*.{$DOMAIN} {
        tls {
                dns duckdns {$DUCKDNS_TOKEN}
        }

        @hass host home-assistant.{$DOMAIN}
        handle @hass {
                reverse_proxy home-assistant:8123
        }
}

    CloudFlare

     
        
*.{$DOMAIN} {
        tls {
	        dns cloudflare {env.CF_API_TOKEN}
        }

        @hass host home-assistant.{$DOMAIN}
        handle @hass {
                reverse_proxy home-assistant:8123
        }
}

    Porkbun

     
        
*.{$DOMAIN} {
        tls {
	        dns porkbun {
			api_key {env.PORKBUN_API_KEY}
			api_secret_key {env.PORKBUN_API_SECRET_KEY}
	        }
        }

        @hass host home-assistant.{$DOMAIN}
        handle @hass {
                reverse_proxy home-assistant:8123
        }
}

  • Replacing router with OpenWRT on Proxmox

    Jump

  • It can be used as a VPN router, any VM that needs a VPN can be connected to a network bridge that is forward through the VPN. This could also be done on the primary router and a VLAN.

  • Self hostable gif database?

    Jump

  • Project that rates Big tech EULA's

    Jump
  • Selfhosted @lemmy.world
    A Mouse @midwest.social

    Is bit rot really a threat that I should worry about?