pHr34kY

They will never comprehend the amount of work they have created for everyone else.

Same. I just stopped apache and let everything else run.

If you don’t have ports open, you’re not an internet participant. You’re just spectating.

Oh, you can tear it down as soon as you get the certification.

Mine still runs decades later though.

If your domain registrar doesn’t do DDNS, and you don’t want to pay extra for one that does, you can get free DNS for life at Hurricane Electric:

dns.he.net

All you need to do is finish their little online IPv6 course. TBH the “course” is just setting up your own server properly and proving it.

When I retire my desktop PC, the old parts become my router. If you have two network ports, it can do it.

To warrant the power bill, it’s also a NAS, NVR, mail server, print server and web server.

It’s running the private DNS for my phone. If it goes down, I realise quite quickly.

Nope. I don’t use them.

It’s because people keep finding ways around them and they evolve in nonsensical ways.

I’ve been on IPv6 years before Google turned it on. My ISP gave me a /48 and I’ve got different subnets for my WAN, LAN and guest LAN. I have a 4-port NIC so I could put a different subnet on each port.

I didn’t mention it in my first post, but I only made AAAA DNS entries for my internal stuff. I just enable IPv4 for the few services that actually need it.

Nope. SSL certs are pinned to the hostname, not the IP address. I can change the IP address in DNS and it will still work.

That’s exactly what I’m doing.

I’ve also got a completely different DNS config for WAN and LAN traffic. WAN devices can only resolve PTR records for my mail server. My LAN devices have DDNS so internally they a get allocated DNS entries by hostname. Even my guest network has a different config for isolation.

They definitely all need to be kept separate.

Routing between two interfaces on the same NIC takes nanoseconds. You wouldn’t notice a performance difference.

When I first set it up, I didn’t have a static IP address, so it would not be great when it changed. I also want my server to remain reachable locally if my internet goes down. I had different firewall/ACL rules for wifi too. For example, some of my internal websites only prompt for a login if you’re outside the network.

IPv6 has been awesome here. I have my server and clients on different /64 subnets in the same /48 block. The nearby devices on Android assumes only the same /64 is local.

Native apps all have a backwards-compatible setting so it’s allowed by default. That will surely get dropped when Google bumps the minimum Android target API so newly published apps need to explicitly configure it.

I actually went through my apps list and disabled nearby devices for all the apps that don’t need it. It’s a good security measure. I just don’t like how it was rolled out.

I self-host a DoH/DoT server and my local DHCP advertises it to local clients. It’s kinda cool because android phones on my wifi will use DoT when private DNS is set to “automatic”.

Private DNS sort-of broke while I was tinkering with internal/external IP addresses for nearby devices. It wouldn’t always connect when I specified my external IP (despite being available externally). I made it IPv6-only too. It wouldn’t be the first time something couldn’t handle it.

I’m actually on GrapheneOS.

I’ve found that you can deny “Network” permissions and permit “Nearby devices”. The app becomes LAN-only this way.

I’m actually using GrapheneOS.

It would be annoying to do that for everyone who uses my wifi.

I found that “Conversations” (XMPP) was blocking a connections even when the permission was enabled. I suspect Android no longer allows connections on port 5xxx on a local network. It works fine when the IP is external.

I did this once with a router. I just bought a 12V SLA battery (a UPS battery) and a trickle charger. The charger was always connected to the battery, so it was pumping about 13V into the router. The router could withstand it. It’s easy enough to get a voltage regulator if it’s an issue, but most hardware already does it to an extent. It was DC all the way.

I don’t think anyone is gonna solve that problem until it’s actually a problem.

Mozilla has their Nothing Personal online magazine with product reviews. It’s only a small handful of product at this point. This started out as “Privacy Not Included”, which is now defunct.

Run nft list ruleset and make sure that the final result matches your config. Maybe it’s misinterpreting or discarding something?

My server has this to allow ICMP in nftables:

ip protocol icmp accept
meta l4proto ipv6-icmp accept

There’s a hundred ways to do the same thing, and I haven’t found online guides to be consistent.

I’m using bcache, and I’m using btrfs as the filesystem on top of it. I’m not sure that the way I’ve done it is considered best practice anymore. The discourse online is a mess because the landscape keeps evolving.

evilpiepirate.org/git/…/bcache.txt

2 of my 4x 4TB spinning drives are portable. 2 in mirrored raid, and on-site backup, and an off-site backup. If you don’t have it on 3 drives across two sites, you don’t have it.

The other specs seems fine, but I personally upgrade my desktop then take the old CPU, RAM and motherboard to use for my server.

Make it a subdomain on a wildcard cert if you’re concerned about that.

Just expose it on single-stack IPv6. Nobody ever knocks. The address space is not scannable.