non_burglar

@non_burglar@lemmy.world

This is a remote user, information on this page may be incomplete. View at Source ↗

⁨Comment⁩ on ⁨⁩ ⁨⁨10⁩ ⁨hours⁩ ago⁩:
You said you were going to use the cloud services, so even if you self-host, using a cloud service api carries the same risk as using their apps. This is an app to unify all the remote storage things.

However, after looking at the code, I retract my comment and caution you not to use Drivebase:
[crypto]

Generate: openssl rand -base64 32

masterKeyBase64 = “<base64-encoded-32-byte-key>”
```
If this is a salt or a seed, the documentation is wrong. But it looks Luke they're using this base64 value as the actual key.

base64 values can be reversed very trivially.

Don't use this.
```
⁨Comment⁩ on ⁨⁩ ⁨⁨12⁩ ⁨hours⁩ ago⁩:
Regarding the access to cloud, it’s been done with fuse many times and it is very useful for those who need it.

You should know that many of these cloud services claim they “don’t know what’s in your files”, but have been shown to absolutely be able to access them on request from court order or law enforcement. Just saying.
⁨Comment⁩ on ⁨LiveOverflow - php situation 24h later (YouTube)⁩ ⁨⁨1⁩ ⁨day⁩ ago⁩:
The path to uptime is paved with understanding what broke and when.
⁨Comment⁩ on ⁨'My own piece of the Internet: Part 1', a blog post discussing the process of getting an ARIN ASN and a /24 IPv4 block for their home setup⁩ ⁨⁨1⁩ ⁨day⁩ ago⁩:
Ipv4 TLD exhaustion happened in 2011, but it was functionally impossible to get a public IP directly from IANA closer to 2005.

And the routing would be a nightmare because if you have multiple gateways between non-overlapping CIDR ranges, you need to tell routing equipment how the packet should return to its source.

So ignoring there being no reason to expose sonarr or radarr to the public at large in the first place, you would be working with two potential scenarios with multiple IPS: either you have two distinct subnets blocks behind your gateways, or you you have two gateways to a single subnet.

In the first case, you would have to route traffic between the two subnets, which makes the scenario not make sense, because why would you need packets between two local hosts to pass through their gateways through public space when they could just be in the same subnet. In the second case, you would have to specify to all your internal hosts two gateways so traffic know which public IP to return to.

Neither of these scenarios make sense when NAT is a much simpler (and cheaper)solution.
⁨Comment⁩ on ⁨For users with public facing services: How does the current explosion of AI-discovered vulnerabilities affect your threat model and willingness to be public facing?⁩ ⁨⁨2⁩ ⁨days⁩ ago⁩:
I don’t expose much, just an always-on VPN. My HTML only site lives on vps, from which i can cut-and-run anytime. I don’t have much need for more, really.

Back when I was working more with raw infosec stuff like packet analysis, etc, I thought surely we would see machine learning in every router to dynamically manage firewalls in such a way that they became foregone conclusions. We don’t really have that, but code has sure changed, and you’re right, we will see lots more vulns discovered and exploited at a much faster pace.
⁨Comment⁩ on ⁨'My own piece of the Internet: Part 1', a blog post discussing the process of getting an ARIN ASN and a /24 IPv4 block for their home setup⁩ ⁨⁨2⁩ ⁨days⁩ ago⁩:
Workaround to what? Why would radarr need a public-facing presence?
⁨Comment⁩ on ⁨Anybody running IncusOS here?⁩ ⁨⁨2⁩ ⁨days⁩ ago⁩:
Incus, but not incusos. Works well.
⁨Comment⁩ on ⁨⁩ ⁨⁨2⁩ ⁨days⁩ ago⁩:
What does that have to do with the PHP vulns?
⁨Comment⁩ on ⁨⁩ ⁨⁨3⁩ ⁨days⁩ ago⁩:
What do you mean “DNS exploit”? Neither 109618 nor 109619 mention dns in the exploit path…
⁨Comment⁩ on ⁨Mysterious Loop Devices in Disk manager on plex server⁩ ⁨⁨3⁩ ⁨days⁩ ago⁩:
I have limited exposure to snaps, but from my experience, the oldest eventually gets overwritten by newer ones.
⁨Comment⁩ on ⁨Mysterious Loop Devices in Disk manager on plex server⁩ ⁨⁨3⁩ ⁨days⁩ ago⁩:
Loop devices are just files mapped as block devices. Snaps cordon off an area on disk for install and config, you should probably see more than one per app if you updated, that’s how snaps can be reverted to previous versions. You can set how many versions snaps keep per app.
⁨Comment⁩ on ⁨Beginner looking for advice on open-source NAS hardware and OS for self-hosting⁩ ⁨⁨3⁩ ⁨days⁩ ago⁩:
I have the jonsbo n1 sitting in a corner, because it is a poorly-designed case with awful ventilation. I don’t know about the other iterations.
⁨Comment⁩ on ⁨⁩ ⁨⁨4⁩ ⁨days⁩ ago⁩:
No worries, and I’m glad it helped!

I’ll add that I was also mystified by the remote path option for a long time, I think the wiki should show more clearly what this does and maybe an example.
⁨Comment⁩ on ⁨⁩ ⁨⁨4⁩ ⁨days⁩ ago⁩:
1st thing to check is permissions, I have seen radarr/sonarr complain about the path “not existing”, but actually the download client process had no write permission to the destination.

From the radarr wiki:

Generally, a remote path map is only required if your download client is on Linux when *Arr is on Windows or vice versa. A remote path map is also possibly needed if mixing Docker and Native clients or if using a remote server.

Since radarr >4.x, there hasn’t been a need for remote path not sure about sonarr, but they are similar.

Now for your case, your qbittorrent host does not know about /srv/ in its path, it only knows about /data and everything under it:
```
    volumes:  
      - /home/marighost/docker/seedbox/gluetunconfig:/gluetun  
      - /home/marighost/docker/seedbox/qbittorrentconfig:/config  
      - /srv/data/torrents:/data/torrents```

So when radarr tells
```Host: qbittorrent  
Remote Path: /srv/data/torrents/  
Local Path: /data/  ```

qbittorrent, which lives inside its docker world, has no idea what /srv means.
```
⁨Comment⁩ on ⁨Can you recommend me a free domain service?⁩ ⁨⁨5⁩ ⁨days⁩ ago⁩:
Ya, it does what it says on the tin. My domain there is nearly 17 years old now.
⁨Comment⁩ on ⁨How long do you keep your backups?⁩ ⁨⁨6⁩ ⁨days⁩ ago⁩:
I don’t need days after 10. I need days up to 10.
⁨Comment⁩ on ⁨How long do you keep your backups?⁩ ⁨⁨6⁩ ⁨days⁩ ago⁩:
Haha OK bud
⁨Comment⁩ on ⁨'My own piece of the Internet: Part 1', a blog post discussing the process of getting an ARIN ASN and a /24 IPv4 block for their home setup⁩ ⁨⁨6⁩ ⁨days⁩ ago⁩:
Not sure why most of the arr stack would even need public IPs?
⁨Comment⁩ on ⁨'My own piece of the Internet: Part 1', a blog post discussing the process of getting an ARIN ASN and a /24 IPv4 block for their home setup⁩ ⁨⁨1⁩ ⁨week⁩ ago⁩:

almost a /25 of IPs

How in the hell are you already using almost 126 public IPs?? Surely you condense some of those services? That must cost more than you like…
⁨Comment⁩ on ⁨How long do you keep your backups?⁩ ⁨⁨1⁩ ⁨week⁩ ago⁩:
How am I going to restore day 8, day 9, or day 10 backups if I only keep 7 days?
⁨Comment⁩ on ⁨How long do you keep your backups?⁩ ⁨⁨1⁩ ⁨week⁩ ago⁩:

Your doing weeklys so why not 7

They are all daily backups, those schedules I pointed out are for pruning. And I don’t understand the question… How would keeping 7 instead of 10 dailies help me?
⁨Comment⁩ on ⁨How long do you keep your backups?⁩ ⁨⁨1⁩ ⁨week⁩ ago⁩:
Daily for 10 days, 4 weekly, 4 monthly.

That covers me from broken updates, generally.
⁨Comment⁩ on ⁨⁩ ⁨⁨1⁩ ⁨week⁩ ago⁩:
I ran a linux box with two gigabit Intel NICs for years with iptables. Almost any device can do it.

Like others say, opnsense is prob your best bet unless you like the abstraction of iptables
⁨Comment⁩ on ⁨How do you sort your music?⁩ ⁨⁨1⁩ ⁨week⁩ ago⁩:
1. Obtain flac cd-ripped originals
2. Convert to 256bit center-weighted opus
3. Use Picard to tag music, save to artist - album/song file & folder pattern
4. Sync to my subsonic-compatible server
⁨Comment⁩ on ⁨Lidarr not finding release / group that exists in MusicBrains?⁩ ⁨⁨2⁩ ⁨weeks⁩ ago⁩:
Uhh… That’s a repackage of Lidarr in docker, and based on the commits only to comments and to the packager’s Discord server, I would say they probably aren’t adding any actual functional changes.

This is the actual Lidarr repo: github.com/Lidarr/Lidarr
⁨Comment⁩ on ⁨Lidarr not finding release / group that exists in MusicBrains?⁩ ⁨⁨2⁩ ⁨weeks⁩ ago⁩:
I don’t think there is anything, really.

Radarr and Sonarr work because the naming conventions for videos are more or less established.

With music, everyone has a different philosophy for tagging, renaming files, transcoding, how to handle best-of albums, compilations, etc. So what works for you probably doesn’t work for me and vice versa.

Lidarr gets very few updates, I don’t think anyone is working on it anymore. I remember the problem was keeping up with metadata handling.
⁨Comment⁩ on ⁨Lidarr not finding release / group that exists in MusicBrains?⁩ ⁨⁨2⁩ ⁨weeks⁩ ago⁩:
Lidarr is pretty much dead, just so you know. The problem became managing metadata sources and assignment to media.
⁨Comment⁩ on ⁨My *arrstack is setup properly but downloading is not working⁩ ⁨⁨2⁩ ⁨weeks⁩ ago⁩:

telling me what’s wrong

How do you verify the accuracy?
⁨Comment⁩ on ⁨Dedicated admin account or normal privileged users?⁩ ⁨⁨2⁩ ⁨weeks⁩ ago⁩:
I have been in IT for 30 years, and in security for the last 16.

You’ll find lots of arguments from a productivity and removing barriers point of view that say don’t bother with strict user access controls, just layer on other security measures. Others (usually older-school sysadmins) preach “doing the work”, meaning secure your users well and audit access often. There are advantages and disadvantages to both approaches.

I personally do a bit of both. The old way of being meticulous with access works, but not without diligence and self-audit. The newer devops way if doing things with secrets management and treating everyone as untrusted works too, as long as you document the automation.

Maybe one suggestion about user control in a homelab setting is not to use the same username across multiple services, but rather name your users something like name.of.service.admin so that you a) don’t forget where you are and b) if you start collecting logs centrally, you can easily identify which system the logs came from.
⁨Comment⁩ on ⁨What do you use for alerting?⁩ ⁨⁨2⁩ ⁨weeks⁩ ago⁩:
It’s not super difficult. They provide setup instructions and then you just connect to your new instance instead of the public one.

non_burglar

Generate: openssl rand -base64 32