IsoKiero

@IsoKiero@sopuli.xyz

• ⁨Comment⁩ on ⁨How do you solve email?⁩ ⁨⁨51⁩ ⁨minutes⁩ ago⁩:

  I do excactly this too. My personal domain has been around since 2008 and my setup has a few domains from friends too. I’m running ispconfig to manage the whole mess and it’s really not that difficult. Getting your server removed from blocklists every now and then is annoying but at least my emails aren’t feeding some marketing machine and, at least for the last 24 hours, my service availability is better than Microsoft can do.

• ⁨Comment⁩ on ⁨Postfix and friends against Stalwart, tested side by side⁩ ⁨⁨2⁩ ⁨days⁩ ago⁩:

  Stalwart and other similar projects might be decent to use, but they lack one detail which is a deal-breaker for me: maildir format for storage. It’s really easy to move between installations and even between different servers, easy and efficient to back up, doesn’t require any fancy databases or anything to be in order and it just works. Sure, it might need few megabytes more memory and search times might be couple milliseconds longer but it just works. My personal maildir has been around from at least 2008 and it’s moved around between servers multiple times without any hiccups ever.

• ⁨Comment⁩ on ⁨Do I need https on everything⁩ ⁨⁨4⁩ ⁨days⁩ ago⁩:

  Is this a problem or does it not matter

  It’s not a problem, but it does matter. With plain HTTP traffic everything you send and receive from a given site is unencrypted, so anyone in the chain delivering your package can read what you’re doing, collect your passwords and do all kinds of shenanigans. If it’s just your local network which is secured from the public internet then it’s pretty much just you who can intercept that traffic and it’s generally fine, as you already have all the passwords and such. And if you connect to the services via VPN that takes care of ‘secured from public interenet’ -part of the equation.

  HTTPS is the same traffic, but encrypted with certificates. To achieve that you’ll need to have a server certificate and then browsers can use the public part of certificate to encrypt your traffic. With docker that’s commonly achieved either with docker-proxy or external proxy like nginx. Your computer already has a bunch of certificate authorities which it trusts and they are bundled in your operating system and/or browser. Without a trusted certificate your browser throws a warning about it, but if you proceed with ‘untrusted’ certificate the traffic will still be just as strongly encrypted as it would be with a ‘known’ certificate. The catch is that anyone can create their own certificates, so there’s no guarantee if the server actually is what it claims to be. For example I could sign my own certificate for gmail.com and offer that to users and steal their passwords. That would of course be trivial to figure out as the browser wouldn’t show the “good” lock symbol on address bar, but the certificate would be technically speaking a working certificate.

  Now, to get a certificate for your own services you need to either build your own certificate authority and add that to trusted list of your devices or obtain a certificate from a already known authority like letsencrypt. With letsencrypt (and other similar services) you need to provide a proof that you own a domain which you’re obtaining the certificate for, so with those you can’t get a certificate for gmail.com or any other random domain name. Letsencrypt uses ‘certbot’ tool to validate certs, other services ask for spesific DNS entry or something else for proof that the domain is actually yours. But the main part is that all the ‘commonly known’ certificate authorities work only on publicly available services and domains (a bit simplified explanation, but that’s roughly it).

  But once you have the certificate you’ll need to configure something on your network to use it. Actual best practice and configuration depends on the service you’re running. If your services run only on your local network and they are never allowed to public internet you’re likely fine to run everything without HTTPS encryption, but it’s still good to understand the differences and effects between unencrypted and encrypted traffic.

• ⁨Comment⁩ on ⁨[deleted]⁩ ⁨⁨1⁩ ⁨week⁩ ago⁩:

  Um what are these things and who should care? That info would help a post like this.

  Absolutely. For anyone else wondering: they are some kind of monitoring tools for your servers. No idea how good/useful they are, I’ve never head any of those before.

• ⁨Comment⁩ on ⁨How Many Users Can a 1 vCPU / 2 GB RAM Server Actually Handle?⁩ ⁨⁨5⁩ ⁨weeks⁩ ago⁩:

  Just for comparison, my VPS server has ~20 active email boxes (postfix,dovecot,spamassassin,clamav), a few small-ish active wordpress sites (apahce,php-fpm,mariadb), radicale and some other smaller services running with 2 cores and 4GB RAM and it’s mostly just fine. Occasionally, specially during heavier updates on wordpress-sites, memory tends to get pretty full, but it’s still just fine. Tweaking memory cache for php (or running something else than php) would increase performance by a lot, but even without optimization the 5€/month VPS is quite capable to keep your internet presence around and on your own hands.