nibbler
@nibbler@discuss.tchncs.de
- Comment on ISP won't set up static IP - Services keep going down 1 week ago:
Didn’t catch that in the other post, nice :)
- Comment on ISP won't set up static IP - Services keep going down 1 week ago:
The simple way is using some bullshit free domain of the ddns provider, and cname to that from your domain
- Comment on ISP won't set up static IP - Services keep going down 1 week ago:
Recurring unconditional pushes, awesome :)
- Comment on 'My own piece of the Internet: Part 1', a blog post discussing the process of getting an ARIN ASN and a /24 IPv4 block for their home setup 1 week ago:
Can’t announce </24 :(
- Comment on Any DDNS recommendations? 1 week ago:
I run PowerDNS as my DNS server. This supports rfc2136 (iirc) which can be configured via the dnsupdate tool for example. and then a webpage that allows to register new names. i added two columns to the powerdns databse “dyndns” as a flag if this domain can be used for ddns and “webkey” as an alternative update mechanism via wget. some small php script that does the sign-up and update in the powerdns database.
- Comment on Any DDNS recommendations? 1 week ago:
As a selfhoster, I host my own dyndns :)
- Comment on I’m looking for the best remote access solution that works for me 1 week ago:
I’d argue it’s even more secure, as it reduces the amount of attacks you are exposed to. For targeted attacks it changes absolutely nothing. But it keeps you our of a few DBs and spares some brute force attacks.
- Comment on 1 week ago:
Nice. I recently migrated from bind/isc-dhcp to dnsmasq, which has a cleaner 1-line per reservation syntax. PowerDNS is what I manage my domains with, but not in my home-homelab.
- Comment on 1 week ago:
I run some china box with 5 integrated 2.5GBe NICs, 48GB RAM and 2x 500GB SSD/NVMe. CPU is Celeron® 6305 @ 1.80GHz, two cores or HT, who knows…
On this I run Proxmox. I didn’t like Proxmox integrated firewall, so I rolled my own.
all containers unprivileged
one container is the firewall. it has all up+down stream NICs mapped via bridges, cable internet, backup 5g internet on dedicated ports. one port to the switch with a few VLANs, and one bridge that is local to the Proxmox for the local VLANs.
Every service I operate sits in its own network/segment, usually with a /30 netmask. VMs/containers have a eth0 device in this and the firewall defined as default gw. On the firewall the VLAN interfaces are named as the container/service. So the interfaces are not eth0 but wan, wan5g, frigate etc. Great for readability.
Some networks like “family” or “guest” or the one with the APs/WLAN-controller are /24. Bit big, but what ever.
I have a structured netfilter firewall script, fw.sh calling it’s parts under fw.d/*fw. Each service is managed individually, sometimes widely open (
iptables -A FORWARD -i frigate -o wan* -j ACCEPT) but usually down to the required ports. Database, reverse proxy etc all on separate containers.There is also like 30 VPN configs from 2 VPN providers. I have a home assistant dashboard where I can direct specific devices to use specifig VPNs. My webradio is routed via UK so I can enjoy BBC2.
root@mercury:~# ip rule show 0: from all lookup local 20: from all lookup main suppress_prefixlength 1 300: from XXX lookup wan_table 310: from xx.xx.0.254 lookup wan5g_table 1000: from all fwmark 0x1 lookup bbc-ss-lon 1001: from all fwmark 0x1 lookup bbc-ss-man 3000: from xx.xx.11.18 lookup pm-gb 4000: from all lookup wan_table 5000: from all lookup wan_table 5100: from all lookup wan5g_table 32766: from all lookup main 32767: from all lookup default
ip rule also does the fail over to wan5g if required. There are some rules where I tried to auto-filter BBC traffic with marked connections via dnsmasq, but BBC knows all my VPNs (not BBC radio it seems).
IPSec VPNs and other OpenVPNs (dialup, site2site) are handled via a dedicated LXC. There is a tor entry node container, for a few services and one of the public WLANs. Firewall makes sure certain traffic can only exit via certain upstream interfaces, vpn*, wan, wan*… very helpful
I didn’t like opensense… don’t know why. Work a lot with firewalls in my job (mainly check point, fortigate) so have some professional background.
- Comment on What's your weirdest or most unique self-hosted use case and solution? 2 weeks ago:
dang, suddenly Magnum shows up :D
- Comment on Bitwarden Switches to Commercial License 2 weeks ago:
License is: all rights reserved.
That’s free like in beer, and open like ‘allowed to inspect’ that’s not what most people mean when they talk of Foss.
- Comment on Bitwarden Switches to Commercial License 2 weeks ago:
There will be… Some fork at least
- Comment on Bitwarden Switches to Commercial License 2 weeks ago:
But that’s not Foss, so u didn’t consider it
- Comment on Bitwarden Switches to Commercial License 2 weeks ago:
why not vaultwarden?
- Comment on What's your weirdest or most unique self-hosted use case and solution? 2 weeks ago:
Never heard of it. Schafkopf is quite popular here…
- Comment on What's your weirdest or most unique self-hosted use case and solution? 2 weeks ago:
I play Schafkopf, a card game usually played by 4 players. It was always a burden, especially before group chats existed on mobile, to figure out if we’ll be four players coming Friday.
So for 20 years I host a webpage for the 5-6 of us. It shows a calendar, user clicks the dates they want to play. Days with already registered players show in different colors. If a 4th player registers, all 4 are notified via email.
Afterwards the page asks players for the monetary result, generates stats and graphs about money, game nights over time, individual player participation etc.
In 288 game days I made 1278 EUR. I missed 53 game days.
- Comment on Can't access some services behind reverse proxy 3 weeks ago:
tcpdump -nlpiany port 8080
Will show if caddy actually tries to connect the back end.