I'm already running Headscale, and it works great. But to expose individual services to individual devices it feels like an overkill. I don't actually need all these devices to connect to the tailnet all the time, and some of these devices I don't even want to be able to access the entire tailnet.
My thinking is to put Immich, Matrix, and CalDAV/CardDAV behind mTLS. So the clients practically do connect via native mobile apps rather than a browser. The devices belong to a small number of users, I don't manage them, but can distribute the keystores, and plan on doing the PKI manually as it's really not a lot to keep track of.
Not an authentication replacement for sure, just an extra layer of protection. The goal is mostly so that if there's a new critical exploit, I don't have to drop everything I'm doing and immediately mitigate.
I was talking about the packaging, not the brand. However setting my VPN exit node to a US location and looking up pictures of the product, most results do indeed have the same English-French labelling, funny.
I do for work but not for my self hosting operation, I don't think it makes sense at least in my case. My recommendation is not to use full disk encryption on a home server, but to encypt specific directories as needed (I use fscrypt on an ext4 file system).
I'll check out sli.dev, I've been using Reveal.js for years now and highly recommend, I love how hugely customizable that is, but one issue for perfectionists is that it's relatively hard to perfectly convert to a PDF, these days I use DeckTape that does a decent job. I used to be one of those nerds that used LaTeX (Beamer) but fell out of love with it.
If you have a single node, external USB storage is 100% fine. Even if you have more machines, if you don't actually need a massive amount of storage, you can share that external drive as NFS.
Rarely happens, I freeze bread and consume cheese fast enough. But bread would be more annoying, I can make breadcrumbs but I don't use that too often (so that will have to go to the freezer too)
The fundamental difference between GPG encryption and encrypted partition is that of asymmetric vs. symmetric encryption. Whether you mount encrypted storage or decrypt a file with GPG, there's some "effort" in putting in the passphrase and in both cases the system's keyring is briefly aware of it and the plaintext is saved to memory (volatile, unless you have encrypted swap or other edge cases).
Asymmetric encryption is not normally used for personal stuff but mostly to exchange material with one party holding the private key, and other having access to the public key (which is public). Of course you can act as both parties if you like. If you do, keep in mind:
Asymmetric encryption algorithms may be vulnerable to quantum computing attacks in the coming years. There are quantum-resistant algorithms, but to my understanding they are not necessarily quantum-proof and could potentially be broken in the more distant future.
If you do choose to use GPG, make sure that the plaintext never touches the disk, for example save it to /dev/shm before encryption.
You can also protect your private key with a passphrase.
Personally I use Joplin. On the clients it's secure because the database is saved on encrypted storage secured by my login phrase. On the server it's secure by Joplin encrypting the files saved to WebDAV storage. Is it 100% safe? Probably not, but probably good enough to stop all but a nation-state level actor.
Ah, interesting. Looks like using grants does resemble what I envision and probably easier to set up that mTLS. I'll certainly explore that!