non_burglar

I’ll say again, I love this.

I think you should keep posting these, I’d like to see more guerrilla servers.

I moved away from proxmox about 3 years ago to incus, primarily because Proxmox has a lot going on that I don’t need, but also incus is much more amenable to configuration with ansible. Also, and maybe this has changed recently, but passing through PCI devices to incus is much easier.

jumbo frames (mtu 9000) to get the most out of it

On dedicated network segments where only jumbo frames are configured at broadcast points, like a dedicated SAN, sure.

Not the best for multi-mode networks like most home labs.

iSCSI is already good at shoveling frames. The tiny benefit one can get from using jumbo frames isn’t really worth the problems it causes in multi mode networks.

I mean, you say contradictory things in your post: you don’t want to manage a db, but you want to assign tags and categorize the photos, which would need a db of some kind.

If you really, really don’t want a db but you want web access to your pics, just rename them so they sort alphabetically the way you want and drop them in the doc root of a www server, apache or nginx would work. Do note that you will have no sorting or tagging options, but it will be dead simple. This is what the copyparty option would give you.

Not sure what you mean about “a whole Linux container”, the majority of my alpine images run in under 100MB memory and use less than 0.1% CPU, so it’s not clear to me what your objection is.

The idea would be to put something like postmarketos or armbian on it so it actually is a supported platform.

OK? By all means, use what works for you.

I personally wouldn’t go around using copy party’s initials liberally like that.

It does nothing but serve photo. Background tasks are minimal and many of them only run once on new photos.

Yeah, I keep a oneplus 6t to test Linux images, but maybe it can do other things for a bit…

Postmarketos runs well on it.

I love this.

As I get older, I realize that the miriad of lower-power devices I have a perfectly suitable to fill roles in my infra in this way.

Be aware that there are still some bugs to workout, the menu options break some of the yaml configs if you had those already.

I’ve been down this rabbit hole and it’s not a good option for standard matx or mini itx. Best I did was get a supermicro board and a supermicro 1u half-depth chassis. It was OK for a while, but the HDDs did not cool off very well.

I’ve now not got a nas just as fast with a radxa rock 2a, a penta sata hat, some FPC cables between them and some cable bodging in a jonsbo n1 case. Drives are happy, less power consumed.

Do you mean we Lemmy users shouldn’t do this, or IaC shouldn’t be done in homelab? I don’t understand your objection.

Ansible with incus, be still my heart!

Sure, but that WAF solution is not for us, it’s aimed at clients who can measure their web presence in millions of requests per second.

Cloudflare is a CDN first and foremost, their success competing with Fastly and Akamai has been good to them, but they don’t care if you get pwned unless you have a ton of money.

On my setup crowdsec has been more effective than cloudflare at stopping scanners and bots from overloading things

Cloudflare is in the business of keeping infrastructure up and working. Any security benefits of CF are secondary.

Thanks for the write up.

Lemmy prefers markdown, so you can make code blocks on Lemmy with backticks, this is inline code with single backticks, and this is a code block, with three backticks at each end in their own lines:

Block of code
2nd line
3rd line

I think you might be misunderstanding the role of a firewall.

Put your camera in another subnet, add rules at the convergence point (the router, in this case), done.

That is effectively what you’re doing with VLANs anyway.

or ones proxmox could make

In proxmox, ACME is a service for the root CA of the cluster. It does use letsencrypt, but it does not provide certs for clients.

Sounds like you are probably conflating DNS and PKI certificates.

Oops, you’re right. Still the QuickShnc GPU doing the detector work, though.

docs.frigate.video/frigate/hardware/

QuickSync is the GPU hardware used to infer from vino models.

docs.frigate.video/…/hardware_acceleration_video/…

Inference from GPU, even QuickSync, is better now than what TensorFlow was able to do on a Google Coral TPU.

Plus, the Coral drivers are untouched for the last 4 years.

I use a local ntfy server and uptimekuma, which has built-in support for a ton of notification services, including ntfy.

You can also use the public ntfy server and create a topic there.

With multiple DNS servers and zone transfers.

Already a bunch of really good answers here, but I’ll add that I’ve wrestled with getting DBs to work well over NFS, and it’s doable, but you really, really have to know the particulars of sync on NFS and block settings on the filesystems and the db client/server at each end.

I collect GPS tracks (whenever I go somewhere I haven’t been, hiking included), and I also use wanderer for basic editing.

However, Wanderer has been trouble to upgrade and recently I’ve decided to just back up my Comaps tracks and export individual ones for editing on something like gpx.studio. What I really need is a local version of comaps for big-screen visualization and planning.

How is Wanderer helping you?

Classless interdomain routing is not the point of this post, but basically we started giving people more options for network sizes, and while complex in implementation, it was philosophically virtually uncontroversial.

You’re talking about 2 different things here. Bit masking part of what is now CIDR was implementable since the mid 90s on network segments, it’s the logic to route packets based on CIDR that was integrated into RIP, GRIP, and BGP.

Also, CIDR can’t alleviate multi-hop routing address exhaustion.

They are saying wireguard alone, no reverse proxy. No exposing any services at all to the outside, just tunnel in with WG and access locally.

Radicale was easy enough for me. Davx5 on android to connect to it, and that’s it.

There is.

when it clearly should not be doing it.

No, sorry. We don’t know enough to say this. What were the options when configuring ext4? What record size is grafana using? Mariadb or postgres? Is there contention with another db? Is there a mounted NFS path in the same ext4 partition with weird block settings? There are lots of legitimate config reasons for op’s problem, but there are so many parts of op’s setup we don’t know, we similarly can’t possibly know what the issue is.

Swappiness works as intended in most default scheduler configurations and seeing high swap is a symptom, not an issue. It is almost always more productive to find out why the swapping is happening.