Appoxo

The user can just edit the wg conf file and remove the restriction where it can and cannot connect to.
The file is not a baked immutable binary

Or yours to own.

I’d say do it.
If the amount of episodes are daunting you:

• Skip the recap (1-4min)
• Skip intro (1-2min)
• Skip preciew (~1min)
  This already saves you 3-7min on a 24min episode.

Remove filler/recap episodes and this will cut down the amount of episodes by the 50s to 100s.

Great…
I was wondering why no new releases and when new were coming.

Yes. Split-tunneling…
But if you are really hardcore about restrictions and would need to update the profiles it will be a pita…
Scheduling stuff is annoying ;-;

Agreed.
Secure it properly and you wont be pwned instantly.
My setup:
WAN -> OPNsense -> CrowdSec on FW and docker server -> Traefik -> Authelia middleware -> Jellyfin.

Yes, first party apps are broken but the browser works good enough and if I meed it, I have a VPN for myself.
Relatives get web browser or I’ll consider a S2S VPN setup.

Issue:
Most clients we instruct on homeoffice usage with vpns are already unablebto remember the workflow: VPN -> (wait until green for connected) -> open work app -> Do work -> close work app -> disconnect vpn.

Now you also may not want to tunnel all traffic (if you don’t have a VPS with symmetric Gbit and unlimited traffic) so you’d need to set up split-tunneling and/or limit the apps allowed for the tunnel (works in android).

Honestly? It would be easier to set up a S2S split-tunnel VPN with wireguard on the relatives router.

Very cool. Thanks for the pictures!

How are you doing HA? Have you passed through the NIC or are you just doing a NIC bridge (or whatever networking proxmox offers)?

Very complicated problem to have?
I just back mine up via Veeam. The VM is running on proxmox.

May I ask with what you initiate the connection?
Are you using some kind of STUN server/service?

The german router “FritzBox” recently did implement this.
A very rudimentary version of it but still.

No I mean why would the attacker even attempt to attack your outside if they can just figure out what sits behind it, follow it through the NAT and then exploit it from there.

Same energy:
youtu.be/Jpuqmjd12lg

Title: I Got My Own AS Number. Here’s: What It Took

I skimmed over your posted blog. Reads like a somewhat same process.

Literally “Same, same but different” ^^

  jellyfin:
    container_name: jellyfin
    image: linuxserver/jellyfin:amd64-version-12.1ubu2604
    expose:
      - 8096
    networks:
      - media
    volumes:
      - ${DIR_LOCALTIME}:/etc/localtime:ro
      - ${DIR_container}/jellyfin/config:/config
      - ${DIR_media}/data:/media/data
    devices:
      # IntelQuickSync für TigerLake GT2 [Iris Xe Graphics]
      - /dev/dri/renderD128:/dev/dri/renderD128
      - /dev/dri/card0:/dev/dri/card0
    environment:
      PUID: 1200
      PGID: 1300
      #UMASK: 022
      TZ: ${TZ}
      DOCKER_MODS: linuxserver/mods:jellyfin-opencl-intel
      JELLYFIN_PublishedServerUrl: "https://jellyfin/.${DOMAIN_EXTERNAL}"
    deploy:
      resources:
        limits:
          memory: 10G
    group_add:
      - '44'
      - '992'
    labels:
      # Traefik:
      traefik.enable: true # Enable Traefik reverse proxy for the Traefik dashboard.
      traefik.http.services.jellyfin.loadbalancer.server.port: 8096
      traefik.http.routers.jellyfin-public.entrypoints: 'https'
      traefik.http.routers.jellyfin-public.rule: 'Host(`jellyfin.${DOMAIN_EXTERNAL}`)'
      # Secondary domain
      traefik.http.routers.jellyfin-public2.entrypoints: 'https'
      traefik.http.routers.jellyfin-public2.rule: 'Host(`jellyfin.${DOMAIN_EXTERNAL2}`)'
    restart: unless-stopped

Afaik the card0 is only used for rendering to a desktop/monitor and for this purpose you should actually use the renderD128 path.
But not sure either about this stuff. Sort of works for me. At least intel_gpu_top shows activity when transcoding :p

Why should they take over the outer router if they can just take over the destination they were routed to?

The indexer option is a thing in prowlarr?
If so, I havent seen it.

Bruh mate.
Mine changes daily so stop complaining that hard xD

Honest suggestion: Just set up a dyndns with any dns peovider that supports automations.

I think this isnt a thing with prowlarr, is it?

HP Prodesk with some i5 8th gen running proxmox and with a 4x 1gb pcie nic on which a opnsense vm runs.

My DNS was done through pihole. Transitioned now to technitium-dns.

My personal blocklist(s):
github.com/Appoxo/Ad-Spam-Blocklist
Contains a list for opnsense (IPs) and technitium-dns (but pihole should be compatible).
Anything else should be mentioned in the readme.

In case of questions, feel free to ask.

And not having to do R&D

Not quite what you want.
But HortusFox does some of it.
Maybe take a look and see if it fits your needs.

If you mean torrent?
Prowlarr/Jackett

Or just read all rules and then check what the min. visit rules say.

Mihon to download, then ingest it somewhere that can understand mamga chapter/volumes.

Whaaat?
I have auto renewing certs on my traefik instance and never had to renew my config except if I modified the config.yml…

Backijg up linux is cheating as it can be compressed heavily.
I can backup my whole linux install on Veeam Backup and Replication about 2-3x for the full backup on optimal.

As always, comedy or humor is not universal.
Andyour opinion ain’t a universal thing. Because it’s your personal taste. And, well, your opinion.

I lightly exhaled at the quip. Not a knee slapper or anything.

Also you can spin up a new server side by side to test for issues without having to restore backups.
Try running two jellyfin containers side by side.

I’d do red/write and enable nfo files alongside the media files.
Then I’d use an admin account for admin stuff and a regular user without any edit permissions.

Dependency hell