Jason2357

Thanks. I have spent the day reading about M-disc and optical formats. Lemmy is great for starting rabbit holes! I think I may swap a blu-ray burner into one of my machines and I am actually thinking dual layer blu ray is a decent trade-off: simmiliar chemistry to m-disc (unlike the clear superiority of m disc over DVDs -which I was literally burned on the other week with some yellowed DVDs), and yet still cheap, reasonable amount of disc shuffling, and in the future, nearly any blu ray drive will work with the 50gb discs (unlike 100gb disks). Still might grab a blu ray m disc burner if I see a good deal but they seem rarer than a hens tooth. Lol.

I have less than a TB of truly irreplacable stuff, so 20 discs isnt bad to suffle, and aiming for maybe 20 years of electrically safe cold storage* zero maintenance off-site seems pretty reasonable for a $50 drive and about that in discs.

*This is overkill anyway - already have zfs snapshots going to an external drive in another room and restic backups to b2. But the threat model is some combination of losing b2 (credit card fail or my own incompetence) plus housefire/robbery/electrical surge taking out everything. Also, if I get hit by a bus and my CC is cancelled, a box of transparrently readable discs are significantly safer bet for my survivors than my note about how to get the data off the NAS/backup drive. They could leave it 5+ years and come back to it no problem.

I have wondered about how to manage a 100 spool of DVDs as long term cold storage of the most important data. Would need some way of splitting the data up automatically and building a straightforward burning workflow, with redundancy incase a disk is destroyed, and a way to find a given file.

Seems like a lot of work for 400-ish Gb, but 1. Its very cheap, 2. Archival disks could last a lot longer in cold storage than anything else affordable, and 3. Anyone could recover it in the future because DVD drives have been manufactured by the billion and are still being put in some office PCs. 100gb blurays are also an option but that means sourcing a burner and at least a few drives capable of reading them to store alongside.

I just restored from some 20 year old dvds and they had visible yellowing at the edges and lost data at the end. A few videos were unrecouverable, not many.

Use a gell cell lead acid battery (the kind that go in regular UPSs). No fire hazzard, ans bonus, they can survive freezing temperatures just fine if outdoors. Downside is replacing a cheap battery every 3 years.

Security by obscurity is when the design or archetecture of the system is obscure enough to supposedly styme attackers (it doesnt), and as soon as people understand the design, your security is broken.

A hard to guess unpublished subdomain is a transparent and standard archetecture - nothing obscure about it and publishing that you use such a scheme doesnt break the security.

The subdomain is a bearer token that serves as an access control and just like a key or passphrase, has a security value proportional to the bits of information an attacker has to guess.

The real limitation is that browsers and humans are not great at not leaking domain names, so its very possible it will get leaked eventually and hard to rotate. Thats the reason they are weak. Still, they can be usefull to stop scanners just trolling for unpatched services.

Indeed, I log in pretty rarely.

Their admin interface is slow and awkward, but otherwise happy. Their deals are always changing and I currently have good specs for the money. EU company and my machine is in Montreal, so I was happy with non-American hosting and green electricity.

There are constant scanners on any site and scrapers on websites, but it is far less of a problem than you would imagine unless you have a big wiki or software forge with hundreds of nested commit history pages for them to spider into.

I also run private servers on hidden subdomains (with wildcard certs and DNS entries), so the low effort scanners never bother them.

DDOS attacks take money, so they aren’t typically going to go after some random homelabber. If it did happen, I would either just shut it off for a while or change the VPs IP. Ovh also has some of its own ddos protection.

Keep in mind that you wouldn’t route local traffic through it, so everything watched at home would be direct and not count.

I have a $5/mo VPS with OVH and they allow unlimited bandwidth within reason. Unless you have multiple households streaming from your server all the time, likely totally fine. If you do end up with one relative streaming 24x7, then I would look at installing the tailscale app on their TV and configuring things to connect that one user direct to your home server.

A VPS takes some learning, but IMHO, it is the “correct” answer and worthile learning.

Really a long time coming pain point is comfortably sharing between family. I think the new workflows will be the way eventually. You I plan on using it to auto add pictures with the recognised faces of family members to a “Family Photos” album as they are uploaded, and allow everything else to stay unshared by default for each user.

There was something special about col. Carter reverse engineering some alien tech using just an oscilloscope and pentium computer with a CRT monitor in a bunker that I think might not be possible to recreate in trek. I’d love to see them try.

Works fine… Most of the time. As long as the file gets saved at an instant in time (e.g. zfs snapshot), postgres sees it like a power failure and restores. You want to have several recent backups if you do this because it will occasionally fail.

Yeah, I bind mount the config inside a config directory just below the compose file, and the state (databases, files, etc) to a seperate storage location that makes sense. The compose and config gets added to git and pushed to a forge, while the storage directories are backed up like normal (in my case, zfs snapshots pushed to another computer and then restic backs up those cold files to b2. The volumes are ephemeral.

I ain’t your bro, pal. ;)

New weekend project! Lol

I absolutely agree, to the point where I thought you were agreeing with a different post I made. This is the way!

There are lots of free or nearly free ways to host a static site with your domain, and basically walk away from it for years at a time just fine. I wouldn’t use Cloudflare just on principal for just static site hosting, but its fine I guess. All the software forges host pages for free, and a bunch of smaller outfits like Neocities. Even a static site on a VPS is nearly zero maintenance. When was the last time there was a CVE for remote code execution that would effect a Linux VPS hosting only a static webpage via Caddy or Ngnix and key-based SSH? (I don’t actually think there has been one).

Absolutely, I use a VPN for self hosted services I can’t be bothered to secure properly and don’t need exposed to all that mess. Wireguard is amazing. I used OpenVPN for years and it was such a pain in the ass mobile. I remember when it first came out, I set it up and made a SIP VoIP call with my phone. I could toggle between WiFi and cellular networks without the audio even glitching, let alone a call dropping. That was honestly like black magic back then.

Sorry to have made you upset. I consider Cloudflare to be the “gatekeeper” here.

I have seen all the walkthroughs and it looks like the worst of both worlds -false sense of security and more complexity and weird non-transferrable knowledge than first glance. I suggest they use a VPN to connect to anything you can’t secure easily, as there are lots of options, and far smaller attack surface than a Cloudflare “protected” (hint: its not protected from anything but the lazyest automated attacks) proxy.

Note: I understand moderate sized businesses using Cloudflare because DDOS attacks for ransom are a thing and a days outage can cost a lot of money. But its a protection racket and I don’t blame victims.

At the moment, every time I want to access my server, I have to turn off my VPN so I can turn on tailscale.

Yes, mobile devices typically cannot run two VPNs at once. There are two issues here, when at home and when out on other networks.

At home, the solution is not to round-trip out to your VPN provider and then back into your network via the public Internet using your domain. Unfortunately. That creates a huge latency and bandwidth penalty when you are physically at home and unnecessary complexity.

Instead, if you must use your VPN service while at home, you need to find the split tunnel settings to allow your phone to access the local network while connected to the VPN service. They usually hide that setting because it opens up the security of said services and allows some leaks, but it should be there.

When out on other networks, it gets harder. If you get creative with networking, you could connect a computer to your commercial VPN service and have all your tailnet devices use it as an exit node, which has the nice benefit of paying the VPN service for “one device” and using as many as you want, but is dependent on your home network speed and a PITA to set up.

Tailscale does integrate with one VPN provider so you can use one app for both tasks, but it may not be the provider you want. I don’t know If their direct competitors do the same, maybe shop around a bit. One VPN app for both use cases is what you want, not two different VPN apps.

Finally, if none of the above works for you, then yes, you are back to accessing your self-hosted services via the public internet and your domain name while travelling and using your commercial VPN. You will have to secure the service, and that will take some learning to do safely. That will be a journey and not something you want to just throw together quickly. You might be able to restrict incoming connections to just your commercial VPN IP address range (in addition to all of the other proper config required) to further reduce the attack surface. Sorry, that is a bit of bad news.

My understanding was tailscale is to connect different machines across the internet, but that a traditional VPN hides your information

You got it! When you google VPN services, you get all these companies selling products for encrypting your internet traffic (90% snake oil IMHO). Main usecase nowadays seems to be making your browsing appear like you are in a different country. This is not what people are referring to in this thread by “VPN”, even though it is the exact same underlying technology.

Tailscale is actually trying to simplify the original VPN idea, which is to create a secure private “network” over the internet, so your devices can securely talk to one another, no matter where they are physically (over the internet). When you are out on the road, your phone can see your home server just like they were on the same home network, and there’s no way for an attacker to see the traffic or get access to those machines. You might also read about Wireguard or Zerotier -same idea, the first is more rudimentary but is used by Tailscale, the second is their main compeditor. Tailscale is pretty good at being easy to get going because it takes care of authentication, routing, and port forwarding for you. They even helpfully proxy your encrypted traffic if the machines fully cannot p2p we each other (slow, but can save your butt). The apps are pretty decent too. I used Tailscale for a long time then eventually self-hosted it once I knew what I was doing sufficiently. I still use their apps.

Sounds like you may be really starting from scratch on your learning. It would be best to work entirely inside a VPN like tailscale for complex apps like jellyfin if you want them. You can set up https, but there’s no harm either way. You might not use your own domain right away inside your VPN, but you will a little down the road. You will get annoyed with using IP addresses for your services and set up an internal DNS server eventually. You can safely experiment and make mistakes inside your tailnet.

For learning to set up an open Internet exposed service, use a completely isolated, dedicated computer (maybe a raspberry pi on a demilitarised zone of your internet router or better yet a $5 VPS on someone else’s network). Then read up on hosting a “static website” with either ngnix or Caddy. I prefer the latter because one short config file can set everything up for https and take care of the certificates for you. This can eventually become the gateway into your other services from the open Internet, but do not do that from the start, just a simple personal website. This will require learning a little Linux system admin, SSH (read up on key based authentication so you can disable password authentication in SSH), remote file management, and configuring a webserver, DNS, and certificates. Lots to learn.

Because it is just hosting static webpages, theres almost no risk of it being hacked and used maliciously if you misconfigrure something or forget to patch it. Static sites are awesome nowadays anyway, though, you don’t even really need a fancy site generator to get started, just some simple HTML files. A fun and easy project is a hand written list of your favourite web links and then set your browser’s new tab page to it. Instantly useful and fully under your control.

I actually envy your spot on your learning journey. It was such a rewarding experience for me to do all the above.

For a personal website, just point the main domain or one subdomain at something like github pages or another static site hoster to start forwarding email to their regular email. Zero maintenance to start and cost.

Step 1: buy a couple extra years and set an annual reminder in your calendar. If you are happy with it, you will be together a long time and don’t want it to expire on you while on a vacation or something.

I just don’t get this take of getting your own domain and seld-hosting, but run it all through cloudflare. Its sad.

Of course. But when you have a storage requirement and it can be met with fewer HDDs than SSDs, the difference becomes less and less.

An i7 doesn’t really use much more power for bursty usage, as it gets back to sleep states faster. Same issue with ssds vs HDDs, per GB, there’s not much difference in power consumption, only when you look at per drive does it matter.

You can’t really optimize for both power efficiency AND upgradability while choosing second hand USFF computers. Sort of have to pick a priority. I realized that electricity is relatively cheap where I am, and so older thinkstations with i5 or i7s are a great frugal option. Not so in, say, Europe.

A well labeled sealed envelope in a small fire safe with short, clear instructions on how to get into everything you want them to. Ideally, simple enough for them to follow, but expect they will ask someone for help. Open it and update it every few years.

Serving headscale is basically a webserver plus a couple of ports. Super minimal hardware requirement but the typical difficulty of needing those ports on a publicly addressable static IP or dynamic DNS.

I run head scale on a Vps and it has been 100% reliable and provides an exit node for me via that VPS. But you are going to have the exact same issue, I think with your VPN.

You want your default route from the exit node to go over mullivard’s interface, but you need wireguard or tailscale to talk to the other clients directly, via their clearnet IP. You can tell the exit nodes tailscale/wireguard client to bind the clearnet interface, but that may or may not help. Mullivard probably takes the default gateway, which will likely cut off the clients. You could set dedicated routes to the IP addresses of the clients, but they can change if those clients are mobile. You will need to maintain a routing table somehow or keep the pre-existing connection active (fragile).

I am sure its well trodden ground, just be aware that head scale probably won’t solve your problem automatically. Its a routing and or firewall config issue.

Head scale is actually a simpler implementation rather than the heart of what tailscale uses directly. It is perfectly complete for a single persons homelab application IMHO. Would be easy for the community to maintain a fork, but its also good to see other approaches that solve the same problem.