Reannlegge

Nextcloud was not my first selfhosted thing, I was paying a service provider for it when I started self hosting everything else I was already frustrated with how nextcloud did not play well with my homelab so I thought why the heck am I paying for it. I have never had good luck with Nextcloud.

Thanks for saying that, I have been loving immich on one of my pi 5’s now I am going to need to replace it. I am thinking Ente, just cause it is FOSS with paid tears just like vaultwarden/bitwarden.

I have stopped using Nextcloud because I can never get things tuned right, and I feel it is trying to do more than it should.

I have a 2014 mac mini running Debian (just the CLI although I did use the GUI to set it up just removed the GUI later) and it hosts my Jellyfin and *arr stack. I just installed rEFInd on it and booted it to a USB drive with Debian on it, knowing it worked enough to do that much I ran some tests, every thing excluding the HDD said it was working ok. So I stuck an external drive to it and installed Debian on it. In a few weeks I am hoping to inherate a 2018 Mac mini but as I understand it it will be a little more difficult because of a T2 chip or something, not impossible just not as easy.

Sounds neat but I would be worried about the no shell stuff, I run my things headless for the most part and like SSH and occasionally VNC access.

Thank you for coming my nerves, I have been seeing a lot of things on this some sensationalizing this as a big issue and some saying it was not really a big deal. I broke and went to see what of my homelab that really touched the WAN had php, I removed somethings and decided to risk it for someother things.

If it is for backup I will give you that.

Pihole is runs on pi zero’s I am sure you would not have any problemswith running it on your pi 4’s. I have my primary pihole instance running on a pi 5 with a bunch of other things, my secondary pihole instance is running on another pi 5 that used to run ghost which hosts my webpage.

I would say put pihole on both, also put unbound onto whatever one you decide is your main pihole. If you are going to get pihole and setup Matrix with the Whatsapp bridge may I suggest you get a firewall as well, something that you can flash OpenWRT onto. I have a Flint 2 that I have multiple vLANs setup on for security, but also a VPN so that I can have the benefit of all my services away from home. It is something that I wish I had setup a lot sooner.

Of course you will need a static IP address for this, for me my ISP gives them out for free but I understand that it is expensive elsewhere. I do however hear there are apps that emulate static IP’s for things like wireguard to use.

Don’t be stressing the pi out to much, maybe look into investing in more than 1 pi! I personally have had Jellyfin running on a pi 4, a pi 5, but it is currently running on a 2014 Mac mini (with Debian installed).

I have 3 pi 5’s, one pi 4, and a pi 0 2, an old Mac mini running in my LAN, and a VPS running my simple blog and encrypted backups. Shuffling things around is a thing you do as your homelab and services expand.

This hobby becomes an adventure.

They are just pluged in, with battery saving features turned on.

But why? If it is backup I personally have a VPS that backs up stuff and runs a few services. In a few weeks I am hoping to have a second off site backup as well.

I personally use retired devices around the home, they are put on my IoT vLAN and wam bam thank you man I have a kiosk.

My passwords for OS and all admin dashboards are extremely long, unique, random strings managed by Bitwarden.

If you are paying for Bitwarden, or using their free tier, stop and and start hosting vaultwarden. You can still use the Bitwarden app, with vaultwarden but with all the premium features.

Get a firewall you can either install OpenWRT or opnSense on, when making my decision I went with OpenWRT because opnSense has a webpage that tries to upsell you. vLAN the heck out of your place, and set up a VPN to access your services like vaultwarden out side of your home. On a vLAN that cannot access your WAN or anything else put your IoT things, on a vLAN that cannot access anything else setup crowdsec. On the topic of crowdsec it should be your only device that port 22 is ssh!

For your IoT things set up home assistant, which should be on a different vLAN that can reach out to the WAN and into the IoT vLAN to control stuff. I wish I could say I have completly degoogled and deappled, but I am waiting for a year for my iPhone to stop getting updates and whenever for my iPad to stop getting updates. I should probably replace my homepod minis sooner rather than later with the Naebu things for HA. The only thing I still have a Google account for is youtube but once I get a hand me down Mac mini I will install Debian and get a youtube replacement with sponsor block.

One of the things that finally got me off of cPanel was the host I was using decided to rape me over the coals without letting me have a wildcard email address so I got a business plan that I could have unlimited email addresses so if one got spammy I could just turn it off and if I still used the service I just changed the email, or if I wanted to extend a free trial I could just spin up a new address. So I recently moved to a new host that offers wild card addresses.

Get a whole LAN adblocker, let it be pihole or adguard home, there was recently that spyware ad pixel so expect more of those in the future. Me personally use pihole and have it very finally tuned to block a lot. I tried adguard once but liked pihole better, this was years ago even before I had pihole finaly tuned so don’t ask me why I liked pihole more.

What I have done to harden SSH is:

• set up pubkey authentication and disable password authentication
• disable root login
• not expose my SSH port publicly; it is accessible only from my LAN and through Wireguard

I have done those things as well, but I have also

• changed my port, to some four digit number.
• port forwarded port 22 to its own vLAN that goes to a pi 0 2 that runs crowdsec as a honey pot.
• I am looking for additional things to run on either that pi or vLAN for security.

If it was just for backup backblaze is probably less expensive but my LAN consists mostly of pi’s and hand me down computers. I am slowly moving things around on my LAN so to each their own I guess. I like the idea of having more control over my stuff so having a whole Debian system on the other end feels right for me.

My flint2, came with OpenWRT, but I installed a vanilla OpenWRT onto it it handles my many different wifi APs, all my vLANs, and a couple VPNs. I have a finally tuned pihole setup, I could not imagine changing it, I was watching this video by SomOrdinaryGamer so I went to the site he made an example of and I got no ads with just my pihole.

I meant no shade, I know it takes a lot of work to do everything I have done for security/ad blocking.

I was backing up multiple places on my LAN but than half of my place flooded, so lamenat and carpet was ripped up, one of my pi 5’s was misplaced with a NVMe drive and another was lost. Than just down the street 3 house went up in flames had the wind been blowing just a little south my condo complex would have been burnt to the ground. After the fire fighters were telling us to get back further and further I had my main pi 5 that had all the backups of everything important on another NVMe drive and a few other things ready to go if the firefighters started banging on my door telling me it was time to leave. I wish I could honestly say that was the day I decided to get a VPS and start my back up, but I was still hoping my father would let me set up a pi with a drive big enough to do back ups at his place. It sounds like he will but he is concerned about security risks about my VPN, funny thing is my back up pi would be the most secure thing hooked up to his modem/router and I wouldn’t want his stuff touching my stuff and with how my LAN and VPN are set up they would have a hard time doing it. Anywho I have a domain hosted by EasyDNS, and just went and looked at their VPS options and got some year long plan and set up cron jobs to take the stuff I want to backup and use age to encrypt it and than it is sent to my VPS each age container is than deleted after there is something of the same name but 3 days iterations older and deletes it.

Yes, from what I understand. They are using ad services from the big ad companies, and because capitalism sucks they are completely fine with selling the spots.

if you do not have a system to VPN into your home I would suggest get a firewall (preferably one you can install openWRT of opnSense on) and VPN into your LAN when away from home.

I have a finally tuned pihole that offers different blocking for different vLANs on my home network and VPNs, I would not trust a third party for ad blocking. However you do you.

I was watching SomeOrdanryGamers video on this and his pihole did not block all the ads on an ad infected site, but mine could. I have used canyoublockit many times to stress test my system, wish there was something newer though.

Wow they gave you a time to come back, they have just said I have surpassed my 5 free articles for years now, I think it is because I am using a “DNS sink hole”/adblocker I do not care enough to turn my pihole off just to try and read it.

I have gotten a static IP, and clear my cache regularly since my last attempt to read a wired article so it is not that they are using anything to see that I have tried them before.

Yeah I do know a little bit of networking and I would have definitely looked up opening 0.0.0.0/0. Not saying you did a bad or anything dergatory but I do double check things I am uncomfortable with.

I respect what you said about your own firewall, however I disagree with it! ISP modem/firewall’s are rarely if ever updated/upgraded. I thought I was fine without a hardware firewall until I started getting into some of my more darring adventures into home labbing. I was using DuckDNS for things, but decided I wanted to be able to do more so I needed a static IP. Luckily my ISP offers two static IPs for free so I got those.

I hope part of your hardening SSH is changing the port number! If you want to keep your LAN safer with a firewall, and something small like a pi zero (I use a pi zero 2), you can setup a honey pot vLAN. Again I realize you said not interested in a firewall, but I am saying a honepot helps.

I was never really against AI, and used the free things for most of the time. I moved to paying for AI once I started homelabbing, I have saved so much money with being able to move my things to my LAN. If I could afford a computer with a strong enough GPU it would be great.

I was able to setup a firewall running OpenWRT that I had tried searching the internet for help but it was always way over my head.

That was years ago so I do not remember. Maybe it was that I was just used to pihole? If I tried now I think the answer would be the same, but it would be because I have a finally curated list and regex.

Prior to me having my static IP I used duckDNS and a cron script on a pi. My ISP offers two free static IPs so I got those now. Sorry to hear you don’t even have one.

I have a Flint 2 with OpenWRT installed, it handles all my home networking. I have a handful of vLANs and I think the count is still 5 APs. I am currently considering adding a 6th for HA to TV vLAN, one that cannot access the WAN just HA. People have disagreements over OpenWRT and pfsense, or opensense not sure which is the “FOSS” version, but OpenWRT is not going to try and upsell you.

I am sure OpenWRT offers some ad blocking but I already had two finally tuned piholes. There are arguments between pihole and adguard home. I started with pihole I have tried adguard but went back to pihole.

I heard that recently reddit decided to shoot themselves in the foot, people needing to pay at minimum $10 000 a month or something like that for bots to do the scrapping or something like that. It is a big Fuck you to mods of the groups and small creators looking for news. Capitalism is a horrible thing, they are not making enough money from advertisments hopefully because people where leaving to Lemmy, I do not know but a girl can dream.

I am curious as to how much the Mods are being paid to offer this stuff, what self respecting selfhoster would want a licenses to anything? Especially those three things, there are FOSS alternatives to all three.

Why would you use paid for Adguard; it is good for some devices and even at that it is not good for the whole device, you can use Adguard Home or my choice Pi-Hole where you are doing a whole LAN ad blocker. You can even set up a VPN or two and use the pihole away from your LAN.

I was unaware of what PhotoPrism was so I went and looked, and thought ok it is like immich but you pay for it?

Why would any self respecting homelabber pay for Emby, all they are doing is trying to get money out of you when Jellyfin is right there mocking the other paid for home lab video streamers like Plex and Emby when their prices go up.

I have a script that reads over one of the Canada Lemmy groups I am in (Canada@Lemmy.ca) and sees if a petition has been posted from ourcommons.ca than shares it in the Lemmy group if it has not been shared yet.

I recently found out that this is not always true.

The only place that I use port 22, is my crowdsec pi. I use some other port than the traditional port for HA. I am slowly moving all my things out of the Apple ecosystem once I do I will setup some other blocking system for outgoing stuff, kinda like pihole but in reverse.

Would highly recommend using an alternative port other than the default one for HA and 22.