There was nothing in the question about jellyfin.

I’m on the jellyfin side, but you people have to chill, this is becoming Ford vs Chevy in here.

Migrated my storage from an old xeon-d to an arm SBC w 4GB ram and a sata hat. Performance is great, ZFS keeps up with all tasks, and less than a third of the power consumed. Backup scripts are running nightly without issue.

I am continually astounded by how well ZFS performs, even 15 years after I starting working with it. 4GB is enough for a mirror.

Apt v3 comes with some quality-of-life stuff that apt has been direly missing for years, and one of those is apt sources that make sense to a human.

So the new apt source files have local key location, components, suites, and Uris.

The sources from the before-time just had a one-liner with a uri and some components.

Most of my infra is Debian, and I did it without serious incident:

#Update everything to latest
apt update && apt upgrade && apt full-upgrade && apt --purge autoremove
reboot

#Verify that debian_version is 12.x (STOP IF NOT 12!)
cat /etc/debian_version

#Check for any pinned or held packages
apt list '?narrow(?installed, ?not(?origin(Debian)))'
apt-mark showhold

#Swap bookworm for trixie in repo files
sed -i 's/bookworm/trixie/g' /etc/apt/sources.list
sed -i 's/bookworm/trixie/g' /etc/apt/sources.list.d/*

#Carry out update
apt update
apt upgrade --without-new-pkgs -y
apt full-upgrade -y
reboot

#Verify that debian_version is 13.x
cat /etc/debian_version

#Modernize apt sources to v3
apt modernize-sources -y

And then maybe apt update to make sure the updates still work OK.

Sometimes you have to make changes to certain repos that don’t have Trixie manifests, but that’s easy enough to roll back.

There are two kinds of self-hosters: those who backup, and those who will start testing em after their first failed restore.

Congrats on becoming one of the 5% of ppl who backup, but actually also test them.

• I personally wouldn’t be touching /etc/crontab, but adding or editing a tab in /var/cron/tabs.
• I would use ~test~ or just a bash eval instead of mkdir to check for the existence of a directory. Mkdir has backfired on me spectacularly in bash and sh scripts.
• always grep, then sort, then awk. Just as a habit, any other order can make run time long and cause globbing problems.
• good job

You said you were going to use the cloud services, so even if you self-host, using a cloud service api carries the same risk as using their apps. This is an app to unify all the remote storage things.

However, after looking at the code, I retract my comment and caution you not to use Drivebase:

[crypto]

Generate: openssl rand -base64 32

masterKeyBase64 = “<base64-encoded-32-byte-key>”

If this is a salt or a seed, the documentation is wrong. But it looks Luke they're using this base64 value as the actual key.

base64 values can be reversed very trivially.

Don't use this.

Regarding the access to cloud, it’s been done with fuse many times and it is very useful for those who need it.

You should know that many of these cloud services claim they “don’t know what’s in your files”, but have been shown to absolutely be able to access them on request from court order or law enforcement. Just saying.

The path to uptime is paved with understanding what broke and when.

Ipv4 TLD exhaustion happened in 2011, but it was functionally impossible to get a public IP directly from IANA closer to 2005.

And the routing would be a nightmare because if you have multiple gateways between non-overlapping CIDR ranges, you need to tell routing equipment how the packet should return to its source.

So ignoring there being no reason to expose sonarr or radarr to the public at large in the first place, you would be working with two potential scenarios with multiple IPS: either you have two distinct subnets blocks behind your gateways, or you you have two gateways to a single subnet.

In the first case, you would have to route traffic between the two subnets, which makes the scenario not make sense, because why would you need packets between two local hosts to pass through their gateways through public space when they could just be in the same subnet. In the second case, you would have to specify to all your internal hosts two gateways so traffic know which public IP to return to.

Neither of these scenarios make sense when NAT is a much simpler (and cheaper)solution.

I don’t expose much, just an always-on VPN. My HTML only site lives on vps, from which i can cut-and-run anytime. I don’t have much need for more, really.

Back when I was working more with raw infosec stuff like packet analysis, etc, I thought surely we would see machine learning in every router to dynamically manage firewalls in such a way that they became foregone conclusions. We don’t really have that, but code has sure changed, and you’re right, we will see lots more vulns discovered and exploited at a much faster pace.

Workaround to what? Why would radarr need a public-facing presence?

Incus, but not incusos. Works well.

What does that have to do with the PHP vulns?

What do you mean “DNS exploit”? Neither 109618 nor 109619 mention dns in the exploit path…

I have limited exposure to snaps, but from my experience, the oldest eventually gets overwritten by newer ones.

Loop devices are just files mapped as block devices. Snaps cordon off an area on disk for install and config, you should probably see more than one per app if you updated, that’s how snaps can be reverted to previous versions. You can set how many versions snaps keep per app.

I have the jonsbo n1 sitting in a corner, because it is a poorly-designed case with awful ventilation. I don’t know about the other iterations.

No worries, and I’m glad it helped!

I’ll add that I was also mystified by the remote path option for a long time, I think the wiki should show more clearly what this does and maybe an example.

1st thing to check is permissions, I have seen radarr/sonarr complain about the path “not existing”, but actually the download client process had no write permission to the destination.

From the radarr wiki:

Generally, a remote path map is only required if your download client is on Linux when *Arr is on Windows or vice versa. A remote path map is also possibly needed if mixing Docker and Native clients or if using a remote server.

Since radarr >4.x, there hasn’t been a need for remote path not sure about sonarr, but they are similar.

Now for your case, your qbittorrent host does not know about /srv/ in its path, it only knows about /data and everything under it:

    volumes:  
      - /home/marighost/docker/seedbox/gluetunconfig:/gluetun  
      - /home/marighost/docker/seedbox/qbittorrentconfig:/config  
      - /srv/data/torrents:/data/torrents```

So when radarr tells
```Host: qbittorrent  
Remote Path: /srv/data/torrents/  
Local Path: /data/  ```

qbittorrent, which lives inside its docker world, has no idea what /srv means.

Ya, it does what it says on the tin. My domain there is nearly 17 years old now.

Putting everything in one folder/directory and let the metadata speak for itself is just calling for a nightmare later one (same goes for folder/directory structure without metadata!).

I am not doing that. I’ll guess here that you aren’t familiar with the way calibre Web and CWA work?

I don’t need days after 10. I need days up to 10.

I use calibre Web automated (CWA). I don’t concern myself much with the filesystem level structure, but it’s author/work + metadata for other details.

If you start making the fs the sorting mechanism, you end up with books that don’t belong anywhere or have too ma y categories. I"be been down that road.

Haha OK bud

Not sure why most of the arr stack would even need public IPs?

almost a /25 of IPs

How in the hell are you already using almost 126 public IPs?? Surely you condense some of those services? That must cost more than you like…

How am I going to restore day 8, day 9, or day 10 backups if I only keep 7 days?

Your doing weeklys so why not 7

They are all daily backups, those schedules I pointed out are for pruning. And I don’t understand the question… How would keeping 7 instead of 10 dailies help me?