nibbler

I upgraded 50 boxes from 9 to 13 last week.

The two dovecot were the most work. Some guacd had trouble with file permissions and I had to manually install and enable a few php8.4 packages and manually apply powerdns db migration scripts.

I disagree.

Yes, it inherently is. Authentication/encryption happens as the very first thing at the network level, before anything resembling a service becomes accessible.

VPN service is… a service. Of course it is. Tailscale has been around for a few years, Apache was there since shortly after the dinosaurs roamed earth. It survived a bunch more battles than any VPN. The only authentication happening at the network level would be 802.1x or such, but this connects to radius (clearly a classic service) and other components. Auth in VPNs is just the same.

So no, a properly secured reverse proxy is all the same. I recommend mtls for ease of use and brute-force resistance. Chose a proper private key :p

Didn’t catch that in the other post, nice :)

The simple way is using some bullshit free domain of the ddns provider, and cname to that from your domain

Recurring unconditional pushes, awesome :)

Can’t announce </24 :(

I run PowerDNS as my DNS server. This supports rfc2136 (iirc) which can be configured via the dnsupdate tool for example. and then a webpage that allows to register new names. i added two columns to the powerdns databse “dyndns” as a flag if this domain can be used for ddns and “webkey” as an alternative update mechanism via wget. some small php script that does the sign-up and update in the powerdns database.

As a selfhoster, I host my own dyndns :)

I’d argue it’s even more secure, as it reduces the amount of attacks you are exposed to. For targeted attacks it changes absolutely nothing. But it keeps you our of a few DBs and spares some brute force attacks.

Nice. I recently migrated from bind/isc-dhcp to dnsmasq, which has a cleaner 1-line per reservation syntax. PowerDNS is what I manage my domains with, but not in my home-homelab.

I run some china box with 5 integrated 2.5GBe NICs, 48GB RAM and 2x 500GB SSD/NVMe. CPU is Celeron® 6305 @ 1.80GHz, two cores or HT, who knows…

On this I run Proxmox. I didn’t like Proxmox integrated firewall, so I rolled my own.

all containers unprivileged

one container is the firewall. it has all up+down stream NICs mapped via bridges, cable internet, backup 5g internet on dedicated ports. one port to the switch with a few VLANs, and one bridge that is local to the Proxmox for the local VLANs.

Every service I operate sits in its own network/segment, usually with a /30 netmask. VMs/containers have a eth0 device in this and the firewall defined as default gw. On the firewall the VLAN interfaces are named as the container/service. So the interfaces are not eth0 but wan, wan5g, frigate etc. Great for readability.

Some networks like “family” or “guest” or the one with the APs/WLAN-controller are /24. Bit big, but what ever.

I have a structured netfilter firewall script, fw.sh calling it’s parts under fw.d/*fw. Each service is managed individually, sometimes widely open (iptables -A FORWARD -i frigate -o wan* -j ACCEPT) but usually down to the required ports. Database, reverse proxy etc all on separate containers.

There is also like 30 VPN configs from 2 VPN providers. I have a home assistant dashboard where I can direct specific devices to use specifig VPNs. My webradio is routed via UK so I can enjoy BBC2.

root@mercury:~# ip rule show
0:      from all lookup local
20:     from all lookup main suppress_prefixlength 1
300:    from XXX lookup wan_table
310:    from xx.xx.0.254 lookup wan5g_table
1000:   from all fwmark 0x1 lookup bbc-ss-lon
1001:   from all fwmark 0x1 lookup bbc-ss-man
3000:   from xx.xx.11.18 lookup pm-gb
4000:   from all lookup wan_table
5000:   from all lookup wan_table
5100:   from all lookup wan5g_table
32766:  from all lookup main
32767:  from all lookup default

ip rule also does the fail over to wan5g if required. There are some rules where I tried to auto-filter BBC traffic with marked connections via dnsmasq, but BBC knows all my VPNs (not BBC radio it seems).

IPSec VPNs and other OpenVPNs (dialup, site2site) are handled via a dedicated LXC. There is a tor entry node container, for a few services and one of the public WLANs. Firewall makes sure certain traffic can only exit via certain upstream interfaces, vpn*, wan, wan*… very helpful

I didn’t like opensense… don’t know why. Work a lot with firewalls in my job (mainly check point, fortigate) so have some professional background.

dang, suddenly Magnum shows up :D

I’d totally see the risk if the clients were not available as open source. But they are. So I’m not.

They might diverge, but vaultwarden users will just fork. Nobody who is using official clients with vaulwarden will be “oh dang, now I have to buy bitwarden, so long vaulwarden, was fun…”

What is “the API”?

The API is implemented by the bitwarden back end.

The API is also implemented by the vaultwarden back end.

The open source bitwarden client does talk the current version of this API. The open source client can be forked, so there is without much effort a version speaking this protocol in this version and is FOSS. Just the name will be different. I guess “vaultwarden client” would be fitting, but what ever.

The api is implemented in Foss front&back end… I don’t know what you are talking about

The back end is already solved by vaultwarden, so I’m not sure what you mean

There is certainty that the Foss version won’t be worse than current bitwarden client. Then those will diverge. So?

License is: all rights reserved.

That’s free like in beer, and open like ‘allowed to inspect’ that’s not what most people mean when they talk of Foss.

There will be… Some fork at least

But that’s not Foss, so u didn’t consider it

But this is the post by bitwarden, defending their decision. AKA marketing.

Can you explain how bitwarden can be “repackaged and resold”, that would be stopped by that change?

Everybody can still fork/rename/publish the FOSS version which is continued to be available. Everybody can connect to vaultwarden…?

why not vaultwarden?

Never heard of it. Schafkopf is quite popular here…

I play Schafkopf, a card game usually played by 4 players. It was always a burden, especially before group chats existed on mobile, to figure out if we’ll be four players coming Friday.

So for 20 years I host a webpage for the 5-6 of us. It shows a calendar, user clicks the dates they want to play. Days with already registered players show in different colors. If a 4th player registers, all 4 are notified via email.

Afterwards the page asks players for the monetary result, generates stats and graphs about money, game nights over time, individual player participation etc.

In 288 game days I made 1278 EUR. I missed 53 game days.

tcpdump -nlpiany port 8080

Will show if caddy actually tries to connect the back end.

Total noob, xtools software was OK. While the whole 3d tool chain is great on Linux, for laser it sucks

xTool user here. Support was okay when a cable was DOA. Software is okay, but running it in Linux requires 2 versions for me. One allows me to design, the other can communicate with the s1.

Fixed by enabling accessibility. Thanks anyway!

I’ll keep this in my head as plan B, thanks for the suggestion.

yes. I run Projectivity on my other TV and it works like a charm!