K3can

I use mTLS for Home Assistant and Navidrome.

It’s very secure, the only limiting factor is that the client apps need to support them (or you use a PWA).

The hashes aren’t tied to a specific identity, they’re just a simple way to convert a set of data into a unique, fixed-length string. The hashes could be rewritten, but without access to the site’s private key to sign them, they wont validate against the public key.

The key itself is also signed, so even if an adversary tricked you into downloading a fake public key, the fake key wouldn’t be signed by my personal key.

The important point is that it’s a layered system, rather than a single point of trust.

I’ll add: mTLS would only break because the client certs are typically signed by a private CA and the host is configured to only trust that specific CA (similar to the enterprise solution I referenced in the post).

If, for some reason, the host was configured to trust all of the typical public CAs, then mTLS would theoretically share the same problem.

Not directly, but I believe mTLS would break if the traffic was intercepted/altered, so it sort of works to test the connection.

mTLS requires installing a certificate on the client device, though. If you’re able to do that, then you’re also able to pin the correct cert or install a custom CA. This would be the “enterprise” solution, as far as I know, but doesn’t work well for public sites, since you can’t always configure your end-users devices.

Really depends.

It’d be massively overkill for me, so even if it’s technically a “good value”, it doesn’t make sense to buy one if my cluster of $60 thinkcentres is chugging along without an issue (and I get HA).

On the other hand, if you need all that extra performance for something, then it’s probably a great buy (hence its popularity here).

I use beets to add synced lyrics to my library automatically.

To display them in the web browser interface, click the lyrics button (looks like a book).

Have you explored any other options?

Yeah. I briefly explored some other possibilities in the post, including a potential self-hosted option, but ultimately landed on CF as a practical compromise.

I didn’t see an obvious link to the source code, so here it is for those interested: github.com/Drop-OSS/drop

Crowdsec does it by using crowd-sourced blocklists (hence the name). So if an IP triggers a scenario on other machines, that malicious address will be proactively added to your blocklist before it ever gets a chance to impact your machine.

That is the big advantage of crowdsec over reactive-only solutions, like fail2ban.

The 3DS on the other hand…

github.com/zoeyjodon/moonlight-N3DS

What is the advantage of this over just dropping HTML files onto a USB drive?

Same experience. 🫤

Personally, whenever I need to process anything text-based, I use perl.

Read the json into a hash, parse the values if desired, then plug the values into an html template.

It’s pretty quick to write, much easier to learn than python (in my opinion), and super powerful.

I’m a bit torn on the hardware bit, myself.

On one hand, hardware is a fundamental aspect of self hosting. There’s already a portion of the community who considers self-hosting to include using commercially-hosted cloud services (as long as it’s not Google), so prohibiting hardware discussion just reinforces that concept. Plus, it can be really fun to see what creative hardware people come up. I’m pretty sure I posted about my Fediverse server running on a WiFi router here, for example. The focus was on the unusual hardware, but it was also clearly related to self-hosting.

On the other hand, looking at what is posted in other communities, I don’t think there’s a ton of value in seeing a dozen photos of a bone-stock rpi or a closed laptop sitting on a desk. Same with the nth post asking if their 30-year-old 1u would be a good choice for Jellyfin; so I see why the rule exists.

Overall, though, I think hardware should be allowed, but maybe add a rule along the lines of "if you’re posting a question, please include what resources you’ve already reviewed or troubleshooting steps you’ve already taken."

Heck, that might be a good rule for all questions, regardless of topic…

Yes, both the standalone quickstart and the quickstart section of the readme (which are both different).

Is it possible to get the static sites without spinning up a DB backend?

Can anyone figure out what the minimum process is to just use the SSG function? I’m having a really hard time trying to understand the documentation.