lemmyvore

@lemmyvore@feddit.nl

This is a remote user, information on this page may be incomplete. View at Source ↗

⁨Comment⁩ on ⁨Question about using gluetun for other containers⁩ ⁨⁨12⁩ ⁨hours⁩ ago⁩:
You can’t use dependencies cross-stack.

If you know the IP that the gluetun interface is supposed to have you tell the BT client to use that interface as output interface. Usually BT clients have this option, other apps might not.

Another thing you can do is wrap the client in a script that waits for the interface to be up (respond to ping) before it moves one. Something like (in sh):
```
while ! ping -c 1 -q -W 1 "$IP" &>/dev/null ; do
    echo "Waiting for ${IP} to come up..."
    sleep 5
done
# run BT client here
```
Alternatively if the gluetun interface itself doesn’t respond to ping, you can ping something else (like 1.1.1.1) through the interface, and use the -I ${IP} option for ping to bind to it for output.
⁨Comment⁩ on ⁨How do you isolate a printer in your homelab?⁩ ⁨⁨1⁩ ⁨day⁩ ago⁩:
IPP is a universal printer protocol aka “print anywhere”. Some printers support it natively, some need some help from a PC. If that PC runs Linux the most likely method is to run CUPS and connect it to the printer over USB.

By IPP autodiscovery, do you mean mDNS? If so, does the router needs to install avahi as well for single-network discovery to work? Or just the client?

Yes the autodiscovery is done with mDNS, which on Linux is done with Avahi.

Typically Avahi is needed if you consume services over mDNS or provide them.

So the Linux clients need Avahi. But the router only needs Avahi if the printer is connected to it, or to propagate broadcasts across zones.

I’ve thought users could just manually input the IP addresses

You can, but it’s really nice to have the printer available automagically (on any OS).

BTW one extra potential benefit of solution 3 might be that the “printer” would always appear to be present on the network and accept print jobs, even if the actual printer is off, because the Pi running the print server would actually be on. Otherwise if the printer itself is providing the connectivity and announcement it will not appear in the list when it’s off. Whether you consider this a plus or not depends on how you handle your printers, I turn mine off when not in use, but some people let it go into powersaving mode so it’s always ready to print.
⁨Comment⁩ on ⁨How do you isolate a printer in your homelab?⁩ ⁨⁨1⁩ ⁨day⁩ ago⁩:
If it’s a networked printer it needs to be able to broadcast to the LAN if you want IPP to work – which you probably do, since it’s well supported by all OS and lets you autodiscover the printer and print directly from most of your devices.

This means you can’t isolate it fully from the LAN, so solution 2 is out.

Solution 1 is good if you can trust the thing not to change or disguise its MAC address. I’ve heard of devices that have a 3rd dynamic MAC in addition to the wifi and ethernet MACs, that they use to bypass such restrictions. 🤪

In order to do (1) properly you should create a firewall zone specifically for the printer, and deny that zone access to WAN. Then associate that zone with either a wifi access point created specifically for the printer, or with a specific switch plug if connected via Ethernet. This way the printer can’t bypass the restriction because it comes packaged with the only way it has of getting any connectivity.

Solution 3 seems best if you want to fully isolate it as well as retain IPP capability. That’s what I did with my printer, I connected it with USB to the server and I run CUPS + Avahi in a docker container that uses an ipvlan network to broadcast.
⁨Comment⁩ on ⁨Do I need https on everything⁩ ⁨⁨2⁩ ⁨days⁩ ago⁩:
There’s no cartel, you can buy a HTTPS cert from lots of places all over the world. Most domain registrars can set you up. It just won’t be free like Let’s Encrypt and also will have a very different renewal process (most likely once a year manually rather than every 90 days automatically).
⁨Comment⁩ on ⁨Do I need https on everything⁩ ⁨⁨2⁩ ⁨days⁩ ago⁩:
It’s not even that hard to imagine, this is exactly what rogue wifi access points do. It’s surprisingly common for wifi access at places like coffee shops to be compromised and used to silently conduct these types of attacks. The people that set them up are not very knowledgeable and also they don’t ever check up on them as long as they keep working.

This is also why you want to enable HSTS on top of your HTTPS, so that rogue requests to downgrade the connection to plain HTTP are ignored.

Another good idea is to place all the services that should only be accessed over VPN only in private DNS (home LAN DNS and the VPN’s DNS), never in public DNS. A simple and effective way of doing that is to place them on a deep subdomain like *.private.example.com rather than *.example.com. That way if your VPN drops when you try to resolve those subdomains you don’t get any response anymore and there’s no connection for the rogue wifi to hijack.
⁨Comment⁩ on ⁨Self-Host Weekly (6 November 2026)⁩ ⁨⁨4⁩ ⁨days⁩ ago⁩:
One problem is that it’s not much use applying secondary auth methods on the server side if the mobile app can’t use them.
⁨Comment⁩ on ⁨Update all your stuff, NOW - again.⁩ ⁨⁨4⁩ ⁨days⁩ ago⁩:
Yes, and that’s what I disagree with. Neither AI nor scripts will make a script kiddie into an actual hacker.

“AI makes hacking easy” is like saying “building houses is now easy because we have cranes”. Sure, but if you jump into a crane without knowing what you’re doing it’s not magically going to make a house appear.
⁨Comment⁩ on ⁨Update all your stuff, NOW - again.⁩ ⁨⁨5⁩ ⁨days⁩ ago⁩:
Ah I agree it’s easier to hack. What I don’t agree with is the notion that it enables a class of people that couldn’t hack before. It’s easier to hack, yes, but for the same people who were hacking before.

Ignorant people trying to use ready-made tools for hacking isn’t a new thing, it goes back a while, there’s even a term for it (script kiddies).
⁨Comment⁩ on ⁨Update all your stuff, NOW - again.⁩ ⁨⁨5⁩ ⁨days⁩ ago⁩:
I expect it’s a common trend though, people generally use Dropbear on embedded devices for the same reasons they prefer Alpine, it’s more compact.
⁨Comment⁩ on ⁨Update all your stuff, NOW - again.⁩ ⁨⁨5⁩ ⁨days⁩ ago⁩:
That’s because it turns out there are tons of vulnerabilities out there introduced by very lazy and/or dumb code.

It isn’t that AI has lowered the bar for hacking, it’s that it’s showing us just how much bad code is out there.

Or, to put it another way, it will end up raising the bar for security everywhere.

Unfortunately we have a lot of legacy crap to clean first.
⁨Comment⁩ on ⁨Update all your stuff, NOW - again.⁩ ⁨⁨5⁩ ⁨days⁩ ago⁩:
Most Android apps that make a ssh server use dropbear afaik.
⁨Comment⁩ on ⁨Update all your stuff, NOW - again.⁩ ⁨⁨5⁩ ⁨days⁩ ago⁩:
I mean, anybody who’s still using password login for SSH is kind of asking for it.
⁨Comment⁩ on ⁨Update all your stuff, NOW - again.⁩ ⁨⁨5⁩ ⁨days⁩ ago⁩:
It’s not quite as simple as that. The author in this case followed a pretty specific trail to find the bug.

Where AI helped was as the last step. They already knew what the bug would do and where to look, but actually looking through the source code for all the possible musl implementations out there would have taken a lot of time.

So they brute-forced it instead and asked AI to spin up actual running instances of all those implementations and simply tried the bug against each of them, rather than looking at all the code.
⁨Comment⁩ on ⁨Update all your stuff, NOW - again.⁩ ⁨⁨5⁩ ⁨days⁩ ago⁩:
Unless it’s explicitly installed no. The default Alpine image doesn’t come with OpenSSH.
⁨Comment⁩ on ⁨Looking to offload Plex from my gaming PC⁩ ⁨⁨1⁩ ⁨week⁩ ago⁩:

Clementine

Whoa, has Clementine picked up again? I’ve long ago switched to Strawberry and then to Fooyin.
⁨Comment⁩ on ⁨Looking to offload Plex from my gaming PC⁩ ⁨⁨1⁩ ⁨week⁩ ago⁩:
As someone who’s used all three (moved from Plex -> Emby -> Jellyfin):

Plex’s killer feature is the relay and the fact it’s completely transparent for users. You log in with a Plex client (whatever device, whatever location in the world) and it will sort out a connection to the Plex server. Complete no-brainer.

Jellyfin has been killing it lately, the last 3 versions (10, 11, 12) were all amazing leaps forward. The devs have been really hitting their stride and are addressing fundamental design issues and making Jellyfin better from the ground up. If you want complete independence, openness and control, excellent performance, this is it.

Emby for me sits somewhere in-between and it’s not necessarily the better off for it. Feels like a compromise or the worst of both worlds. It has touches of Plex’s enshittification streak, it hasn’t addressed any of the core problems like Jellyfin has.

Both Emby and Plex have issues navigating VPNs and complex/unusual network setups because their plug’n’play approach relies too heavily on autodetection. Plex has the relay to fall back on (provided you pay for it) but Emby doesn’t.

Both Emby and Plex will move features around and really, really want you to keep paying so it’s anybody’s guess what you’ll be paying for from month to month. Lifetime passes were (can I say it?) a tremendously STUPID idea and now that ship has sailed anyway.

IMHO, one of these days someone will come up with a way for Jellyfin to provide free, transparent, aecure client+server pairing behind NAT and that will be a huge blow to both Plex and Emby.
⁨Comment⁩ on ⁨Is POP email still a thing?⁩ ⁨⁨1⁩ ⁨week⁩ ago⁩:
You can do what you want with IMAP too.

I use isync, it’s a CLI tool that can sync between IMAP accounts or between IMAP and local plain storage and it has the option to delete messages over a certain age after it copies them.

Is there a set up where some remote service handles email exchange, and you just sync with it

Any regular email provider can do this as long as it offers IMAP. I use email clients with my provider’s IMAP but I also use isync on the server to periodically pull all email locally and delete messages older than 30 days. I’ve also installed a local private IMAP server and a private webmail client on top of that private IMAP, which I use to search through old emails.

This way I normally use the “live” mailbox with my PC/mobile devices, and use the private webmail when I need to search for anything over 30 days old.
⁨Comment⁩ on ⁨It's self hosting Sunday! What's up?⁩ ⁨⁨1⁩ ⁨week⁩ ago⁩:
- I’ve taken the opportunity to update most of my hosted services to newer image versions.
  
  They’re all behind private access (Tailscale, mTLS, IP whitelist etc.) so I’m not usually too worried. I update images manually whenever I can find time on a slow weekend, so this wasn’t strictly speaking related to the recent vulnerabilities. Volume data and container definitions are backed up automatically once a day and I also take manual copies of the old images when I update them.
- I’ve switched to new major versions of Immich and Jellyfin in the process and I’m very pleased with the new releases, amazing great work from the developers, they’ve been killing it lately.
- I’ve been tinkering with some custom images that I use for various things like syncing specialized data (logs off FTP services, archive email over IMAP from my mail provider, grab Garmin data copies, run monitors and log parameters to Influx, run port forwarders etc.)
  
  I typically want to lock down this kind of images as much as possible, so I tweak them towards running with an unprivileged user, remove all caps and only grant strictly necessary ones, make the storage read-only inside the container etc.
- Some needs have been recurring inside this type of containers, like having a decent process manager to keep some things running and restart them, or having a decent cron service. So I’ve been toying with the idea of making a “universal” image for this kind of thing and maybe publishing it for others to use as a base too. If I get around to it I’ll be announcing it here.
⁨Comment⁩ on ⁨PSA: Update your Tailscale!⁩ ⁨⁨1⁩ ⁨week⁩ ago⁩:
Also, I’ve never been able to understand how something exposed to the entire internet (a WG server) is considered more secure than something that only connects peers privately to each other.

The attack surfaces are nothing alike.

Even if you limit access to WG with IP blocking there’s still no comparison to something you can’t access at all from outside.
⁨Comment⁩ on ⁨Container Vulnerability Management⁩ ⁨⁨2⁩ ⁨weeks⁩ ago⁩:
Why not use PHP hardened (distroless) images as a base for the final image?

Why build your own images at all? I’m not sure I understood what advantage that gives you.

Harbor looks interesting but that install procedure is ridiculous. Why would I run an installer script just to pull docker images, just give me a compose file ffs. The only way I’d ever consider it is inside an LXC container or a VM.

Also, it sounds like they’ve never heard of a reverse proxy and don’t know you can do TLS that way? That does not inspire confidence.
⁨Comment⁩ on ⁨Can you recommend me a free domain service?⁩ ⁨⁨2⁩ ⁨weeks⁩ ago⁩:
Yeah I can understand small self-hosters having maybe a handful of domains but some users were coming in with thousands. I mean if you have thousands of domains there’s obviously something else going on and maybe you should be paying someone for that.
⁨Comment⁩ on ⁨For users with public facing services: How does the current explosion of AI-discovered vulnerabilities affect your threat model and willingness to be public facing?⁩ ⁨⁨2⁩ ⁨weeks⁩ ago⁩:
If they find anything we fix it, update our services, and move on.

The chances of being hit by a zero-day as a random self-hoster are very small, but anyway if you keep backups and can restore a clean state (and patch your system) you should be good.

The goal is not to have perfect security, it’s to mitigate the risks and to handle fallout correctly.
⁨Comment⁩ on ⁨Which domain registry or specific TLD do you prefer, and why?⁩ ⁨⁨2⁩ ⁨weeks⁩ ago⁩:
Get a .nl and call it a day?
⁨Comment⁩ on ⁨⁩ ⁨⁨2⁩ ⁨weeks⁩ ago⁩:

the exploit has been out for over 10 hours

According to the PHP Foundation the OOM vulnerability was originally found by the security audit they commissioned back in 2024.

They never fixed it because there was no working exploit at the time and also because all the fixes had important downsides and they went into decision paralysis.

I do believe that two years is plenty of time for someone to figure out a working exploit, especially with AI assists.

Bottom line, the timing of this recent debacle is centered around the moment that the PHP Foundation decided to finally eat crow, not around when the exploit was actually available. The embargo was just for spectacle. PHP circles are already spinning it as “see how important PHP is, how much of the internet runs on it, how it’s critical infrastructure”.
⁨Comment⁩ on ⁨Can you recommend me a free domain service?⁩ ⁨⁨2⁩ ⁨weeks⁩ ago⁩:
Yeah, they still host for free. I think they’ve limited the amount of domains you can host per account though, again due to abuse because there were actors that were bringing in thousands of domains I believe. But if you just want to host one domain it’s fine.

The API makes the difference (vs DNS services at the registrar), DeSEC is well supported by most tools so you can do DDNS and DNS-01 with it without problems.
⁨Comment⁩ on ⁨PSA: eMudhra Intermediate CA Compromise⁩ ⁨⁨2⁩ ⁨weeks⁩ ago⁩:
Image
⁨Comment⁩ on ⁨Beginner looking for advice on open-source NAS hardware and OS for self-hosting⁩ ⁨⁨2⁩ ⁨weeks⁩ ago⁩:

want to move away from US-based and other non-EU cloud providers

european-alternatives.eu

Which operating system would you recommend? I’ve been looking into TrueNAS Community Edition and OpenMediaVault, but I’m open to other suggestions.

Unraid is a very solid choice. You need to pay a yearly fee for the upgrades but it’s very easy to use and suited for more than just storage (but also makes storage very easy).

I’d prefer a compact, reasonably power-efficient, ready-made NAS rather than building a full PC, mostly due to limited space.

This goes against your preference for open software, because all ready-made compact NAS appliances will come with proprietary software and proprietary hardware… because that’s their business model, tying you to their products.

Regarding power, you’re not saving as much as you think when you consider that the HDDs will take the lion’s share. It doesn’t really matter if the base system consumes 4W or 20W in idle if the HDDs consume 15W/drive.

If you’re an experienced PC builder this is a no-brainer. Building a PC lets you replace components separately and get away with buying used and off-the-shelf.

Choose a case with the right amount of (dampened) HDD cages (I prefer Fractal Design but there are others) and a quality power supply. The motherboard should also have an appropriate amount of SATA connectors. The CPU is not terribly important and can be a decade old. In fact you can get away with buying a used kit. You don’t need a lot of RAM, even 8 GB will do (but if you can get 16 or 32 that’s nice too). Same for the system SSD, it can be as low as 64 GB or even lower.

How much hardware performance do I actually need?

Depends if you have specialized usage. For example if you want to do AI on the CPU. Or if you want to do video transcoding. If you don’t, anything will do.

Which software stack would you recommend?

A dedicated CalDAV/CardDAV server for contacts and calendar/tasks. Radicale and Baikal are the most popular.

Immich for photo organization (albums, sharing, face recog, semantic search) and photo backup. Basically it was designed to be a great Google Photos replacement.

Personally I would avoid Nextcloud, it’s a beast. I would definitely not tie important stuff like calendars into it. Strictly for files may wanna look at alternatives like Seafile or OpenCloud.

For file sync most people use Syncthing but I don’t like their mobile (non-official) support. Personally I prefer FolderSync + SSH.

If you get into media libraries then Jellyfin can cover video, audio and books too, but there are also other specialized ones for music and books.

What should I consider regarding backups and remote access?

Not sure why you’re conflating these two.

For remote access if you’re not behind CGNAT at the ISP then VPN (Wireguard or OpenVPN) and/or SSH is the most secure.

Tailscale is a good alternative, it works behind CGNAT too, and it has a bunch of other interesting features like exit nodes. Look into it. It’s a “mesh VPN” that uses open source clients with a central server that facilitates the pairing from behind NAT. The connections themselves are always private.

If you have to expose HTTP services over the Internet you must get a domain, reverse proxy, HTTPS certificates (with auto-renewal, most reverse proxies will help with this) and mTLS is the best security option. But keep in mind very few mobile apps support mTLS (Immich, DAVx5, Ntfy do).

For backups, first of all use a proper backup tool like Borg or Restic, not sync tools like Rsync. You want your backup tool to offer integrity checks, recovery, encryption, deduplication and compression, sync tools offer almost none of these.

Secondly, look into 3-2-1 backup strategy. Affordable backup methods for home use include backup “cold” HDDs, Blu Ray optical discs, and online storage subscriptions. Borg/Restic include support for transparent online backups too.

You don’t have to backup everything. Categorize your data and figure out some priorities. Usually the truly important data is not very large.

RAID and other forms of storage redundancy are NOT backup, they’re mostly about keeping services going during drive failures. If you have to work with limited amount of drives I would prioritize backup over redundancy.

Email:

You don’t have to self-host the sending and receiving of email to retain control over it. It’s in fact very hard to do that.

What you need is to choose a good domain for your @ addresses, on a long-lasting TLD (preferably an EU ccTLD, perhaps your own country’s), and an email provider (see the link at the top) that offers SMTP and IMAP without any shenanigans.

You can use IMAP to sync your online mailboxes constantly at home, and also use IMAP to check your online mailbox with any email client, and use the provider’s SMTP to send mail. Any decent provider will supply you with the DNS records that need to go into your domain setup so you can use them.

If you ever want to switch provider it’s as simple as signing up with another and changing your DNS records.

You can if you want self-host an IMAP server and a webmail client at home on top of your local email archive, so you can search through old emails, and so you can delete them from the online mailbox so you can reduce your online mailbox size (and perhaps pay less). Just as long as you don’t try to self-host the ability to send and receive.

Other things you might want to look for at a provider is alias capability, or at least a catch-all. Helps a lot if you give each different online account its own different email address, and never give out your real address (the one you use to login to the email server).

Most email providers will tax you per mailbox and for things like aliases. IMO that’s bullcrap. Personally I prefer a provider that allows for unlimited mailboxes and aliases and taxes for tiers of storage space and emails sent/received. Migadu is one such European example. For two people YMMV, either model might be ok. When you have more than two accounts the unlimited model can become much cheaper very fast.

Things you may not have considered:

Look into a reverse proxy and getting a domain + HTTPS certificates for it, and putting your services behind it at addresses such as https://cal.example.com/. It will make your service consumption 100x better.

Also consider your home router. Is it a capable one? Most people overlook this completely, but a good router can help immensely with self-hosting for things like DNS, VLANs, port forwarding, having stable IPs for servers etc.

If you need notifications, or sending messages+attachments across devices, or action buttons, Ntfy can either be self-hosted or used through their public service.
⁨Comment⁩ on ⁨PSA: PHP warns it plans to release 2 emergency patches imminently (today 14:00 UTC)⁩ ⁨⁨2⁩ ⁨weeks⁩ ago⁩:
They took a lot longer than that on some past vulnerabilities, some of them sat unpatched for weeks or months. But it depends on the severity. A remote exploit of severity 9 will probably get expedited.
⁨Comment⁩ on ⁨Can you recommend me a free domain service?⁩ ⁨⁨3⁩ ⁨weeks⁩ ago⁩:
Yeah use the “Registry” link on their sidebar and sort by age. The oldest domains on there are not going anywhere.
⁨Comment⁩ on ⁨Can you recommend me a free domain service?⁩ ⁨⁨3⁩ ⁨weeks⁩ ago⁩:
*.dedyn.io registrations are discontinued right now unfortunately, following a wave of abusive registrations.