moonpiedumplings

The trick is to get wordpress from debian’s repos itself. That way your wordpress is managed by debian and receives automatic security updates.

ssh is probably fine for 99% of things. I use ssh exclusively mostly

The features I load cockpit up for is:

• easier viewing of systemd/journalctl logs. You can click on services and see logs, search them, and so on.
• Partitioning a disk. Nothing too crazy, but I can format a disk, wipe them, via the GUI
• Networking configuration. If you are using networkmanager, cockpit will test the changes, attempt to connect, and then revert the changes if the connection fails (in like 15-30 seconds). This is legitimately insanely useful, I can change the ip address or something, connect via cockpit again, and only have the change stick if it’s actually good. (See also, netplan try from the netplan configuration framework.)

Cockpit also offers a GUI for managing virtual machines (via libvirt) or podman contaniers. So someone else might want that, although I don’t really use that. (virtual machines can be managed remotely via virt-manager over ssh by connecting to qemu+ssh://user@remote-host/system, I manage podman via the terminal).

I use cockpit, but via the client. They have a flatpak client that gives you cockpit’s features, connects over ssh (and reuses your ssh config), and doesn’t require anything else on the host/server you are managing.

I like Authentik, although I really like:

• Support for every auth protocol, particularly OIDC and LDAP
• Invites that can invite multiple people, letting me onboard a room of people at once
• Python based scripting that lets me script some integrations and do API calls when users authenticate

But at the same time, Authentik is very, very complex.

If you just want LDAP and OIDC in the same app, I would probably recommend KanIDM. KanIDM also does invites (although only one user at a time).

If you just want OIDC itself, pocket ID (passwordless /passkey only) and void auth both are really simple OIDC providers (that also support sign ups/invite links.

I am also paying attention to (some less popular options):

• Rauthy: Fairly minimal, supporting OIDC… but also supports PAM for Linux/Unix integrations
• Casdoor: seems to be feature rich like authentik, but perhaps not as difficult to deploy and configure
• Univention Nubus: An open source, European auth software, that is feature rich, but has an appliance virtual machine that might make it easier to install.

I only wish it had mock-LDAP so I could use it with things that don’t do OIDC like OpnSense

KanIDM is probably the simplest auth server that does both OIDC and LDAP in one app.

Hmmm, games / game servers are a bit different since, they are rarely ARM and mostly x86.

You can use tools like muvm or fex to run the x86 version of wine, and then use that to run game servers: docs.fedoraproject.org/en-US/…/x86-support/

People have been able to game on the M1 since it has hardware acceleration, although I never gamed.

When I had Asahi, I just used it as a daily driver laptop. It worked perfectly fine for all of the stuff I wanted to do on my M1.

For a server, it will probably work fine as well. You have to ensure that say, the apps/docker containers you use support ARM, but ARM is fairly popular and well supported nowadays.

I did have one issue with podman, where apparently the memory is organized differently on the M1, which causes some docker containers, even if they are built for ARM, to be incompatible. I had to use podman machine, which is podman’s built in virtual machine that lets you run containers in their instead. It is designed for Mac OS, which is kind of ironic since the whole point of using Linux was that I wouldn’t have to run a virtual machine just to run podman/docker containers.

You might be interested in: github.com/project-copacetic/copacetic

Is incus-compose a part of the base system, or an add-on

it’s a program you install on your client machine. It just connects to the Incus API (probably using the Incus cli).

How does it work on IncusOS if it’s a command-line tool and there’s neither a remote nor a local shell, only a web API?

The Incus cli connects to the API.

Does it provide a built-in way to automate container updates

For the most part, Incus containers are system containers, similar to lightweight virtual machines. They run a full distro, including systemd and all that. For keeping those updating, you would want to use the auto update methods that Linux distros provide.

There are also OCI containers that Incus can run, but I don’t think there is any form of auto update for those. You might be better off just running docker/podman/kubes in a VM for that.

Incus somewhat recently added support for gpu acceleration for VM’s via virtualgl/virgl: linuxcontainers.org/incus/news/#gpu-sharing-for-v…

This does only support OpenGL, but it’s way, way better than no hardware accel for many things.

In addition to that, there is potential of windows virtual machines getting support for OpenGL hardware acceleration, as well: github.com/virtio-win/…/943 . Unfortunately that looks like it stalled. I have seen other projects, like this or this, but even if people get something working, one big barrier is the drivers have to be signed (by Microsoft) before they can easily be included into Windows.

I use Incus on Debian 13. Debian 13 packages Incus, and that version only does security updates and focuses on stability. To be clear, Debian’s model is to not do bugfixes or feature updates, to prevent any update from being breaking in any way. This ensures users can automatically get security updates.

I get it from zabbly’s repos: github.com/zabbly/incus , in order to get newer versions of Incus, and to get, however. There is a risk of breaking updates but I’ll live and fixing the occasional thing on my one server is okay. The Zabbly incus repos also come with the UI, although the UI is just a static site you can put in the right spot. I like that design, because it means that only the API can do anything, which lessens the attack surface.

I also use Incus personally on my laptop on Arch Linux. It’s nice to have the same UI/UX for vm management, and being able to download the premade images from their docker like repository is pretty nice as well.

No, you can install Incus on any linux distro. I use it on a Debian server.

It’s IncuOS that is immutable.

But proxmox is actually just a set of packages on top of debian, and proxmox is not immutable either. You aren’s supposed to tinker with the host, but if you are doing things like jailbreaking consuner gpu’s to unlock the server gpu only features, then it becomes nice to have that option.

The problem is that if that is your threat model, then the VPS provider, ISP, and literally everything between you and letsencrypt can pull a conpromised key fro letsencrypt.

This actually happened btw, an xmpp server was attacked this way, they compromised not the server itself, but the VPS provider MITMed their traffic: www.devever.net/~hl/xmpp-incident

If your threat model involves this, then the only solution is Tor, which eliminates these requirements of trust.

I would like to avoid paying for a VPS

Oracle cloud free tier, but it does have a history of randomly killing the VPS’s created.

Public ipv4 addresses are scarce, and becoming more expensive now. You are probably going to have to shell out some cash if you don’t already get one as part of your internet plan.

What reverse proxy are you using?

Tailscale works great, but their free tier is limited to a total of 8 users, which is enough for a tiny minecraft server, but doesn’t seem to be enough for your usecase.

For 10-15+ users, you probably want to self host a VPN on your own VPS. Like, you can self host headscale, which is tailscale but self hosted. : github.com/juanfont/headscale [1]

I wouldn’t port forward game servers, because they often lack authentication (login and stuff), and then they also have security issues due to not receiving updates. If your game server isn’t truly public, then it’s easier to just have people use the tailscale client to connect to your VPN.

[1] Although I would recommend headscale to OP for it’s simplicity, it is very barebones, and software like netbird or netmaker is more close to a truly self hosted tailscale, with things like more advanced accounts, OIDC integration, authorization, and so on. But they are more annoying to host and set up.

Nix is also packaged in debian as nix-bin.

A common distribution method involves multi-party signing, that is, multiple developers use keys to sign off on reviewed changes.

Multiple developers review the changes, before signing the git commit after review. Then they build the package, either locally or on CI servers, but again, multiple parties/servers sign and review, doing a reproducible build to verify across machines.

In an ideal architecture, there is never a single point of failure. You would have to compromise the computers of multiple devs, or multiple build servers that are building signed reproducible builds, in order to do it.

Although in theory, you could compromise all of them. But it’s extremely difficult.

Anyway I was gonna write a rant about it but I’m too tired. But basically the docker ecosystem is kinda fucked in this regard, and trades security in many aspects for convenience of development and distribution. This is one of the most notable examples of this.

Also what are you building? You might be able to replace docker with nix for example.

I think the most popular solution is locally building and registry.

Is your comment supposed to say “native pf or nftables”?

One thing I read about is that Ubuntu provides unattended updates, so it can automatically update packages and restart the server (that seems a bit too far ;) ). It’s probably possible on Debian but not out of the box.

Ubuntu automatically has unattended upgrades, which makes I think makes it a popular choice for VPS providers to push (beyond being popular in corporate/institutions overall), since they don’t have to worry about users forgetting security updates. However, it doesn’t enable automatic reboots. But, it does look like automatic restarts of services updated via unattended upgrades is done, but only as of Ubuntu 24.

Another thing to note is that Ubuntu has updates that are explicitly for security, and then everything else, including more general bugfixes and program updates with additional features. By default, unattended upgrades on Ubuntu only do security updates.

Of course, both a unattended upgrades and automatic reboots are possible on Debian (same software, Ubuntu just preconfigures it), although default configurations can vary. I wouldn’t be suprised if a VPS provider was shipping a default Debian configuration that enabled automatic upgrades.

On Debian, for the most part, ALL updates are only for security issues or severe bugfixes (program crashes or the like). Debian, for the most part, doesn’t do minor bugfixes at all, or do program feature updates. I prefer this model, since it’s easier to manage than having separate types of package updates. It ensures absolute stability, a guarantee that the system tomorrow will behave the same as it did yesterday, while still enabling automatic security updates. This model is ideal for a server I don’t want to babysit, or for your grandpa who loses his mind when the button he is supposed to click was moved one spot over.

In addition to that, I like the policy of automatic reboots. With the stable, slow moving nature of both distros, it’s safe to automatically reboot to ensure that kernel vulnerabilities, or vulnerabilities in other critical systems are fixed. Automatic updates and reboots can be the difference between someone being able to escape a docker container or someone not being able to.

There is one thing to note, is that adding additional repos (or PPA’s which technically you aren’t supposed to work on Debian), can be dangerous, and you have to be careful: wiki.debian.org/DontBreakDebian/#Don.27t_make_a_F…

The main problem is that if a third party repo and Debian provide the same package, and the system is configured to prefer the third party repo, then you can be installing a potential dependency to the rest of your system that isn’t actually tested against your system, or compatible.

You have to be really careful to ensure that the programs in the repo are actually built and designed for your system, and also that the your system does not default to installing them.

Third party repos also break the guarantee of stability that automatic updates depend on. Third party repos don’t have a separate security channel, so Ubuntu will probably avoid touching them, even if critical security fixes are needed. Debian will update them, but unlike Debian’s packages, the overall program updates won’t be guaranteed to be behave the same due to potential major/minor version changes.

For example, if you get Docker from docker’s repo instead of Debian’s/Ubuntu’s, now your version of docker can no longer auto update and receive potential security fixes safely.