stratself

Selfhosting both. Continuwuity is more straightforward to set up than ejabberd, mostly because of easier docs, less ports, and less subdomains required. It also comes with most things you need rather than a bunch of toggled-on modules, and I’d say Matrix being HTTP makes it more “conventional” for beginners.

XMPP is significantly more lightweight though, being a message passing protocol rather than state syncing.

What server are you hosting and what’s your subdomain setup? When logging in, you just enter the domain behind your username (e.g. use example.com if your username is @user:example.com)

If you choose to go with Matrix, I would strongly recommend you to give the Continuwuity server a try. It is quite simple to install, much less resource-intensive than the commonly-used Synapse, and has an active community behind it.

apparently, I need a TURN server to get this working properly

Do note, Matrix recently has a new calling stack called MatrixRTC, and for that you would be setting up LiveKit in place of a TURN server. That also opens many ports by default, but I think there is a “UDP mux” mode that listens all on one port. I’ll be looking into it soon.

The other alternative is XMPP, which is a bit more complex to set up (more ports, non-HTTP protocol, more subdomains, various opt-in features) but is generally more lightweight and fast. ejabberd is my choice, but people tend to like Prosody and Snikket as well. While they use the traditional TURN servers for calls, their clients could use a lot of improvements though…

So yeah, my Continuwuity and the XMPP server sits on a small homelab machine, and with some extra tuning and grit, they:re totally federable. LiveKit and TURN sits on a VPS for better network performance. To be honest, I do all of this mainly because I wanna talk to cool people on the internet, so the service has to be federatable.

It’s a cartel in the sense that the CA/Browser forum determines, on their own whim, which CA gets featured or revoked in your browser. And single-handedly impose technical restrictions like shorter cert lifetimes and less features. Stuff like eMudhra being able to compromise everyone shows its quite a vulnerable group of single-point failures as well, but still condoned by almost everyone.

ZeroSSL and Komodo does have free certs if I remember correctly. They’re still bound by the 90 days (soon to be 47) limit though

This seems quite offtopic for this community. If you want to selfhost your own Lemmy server though, people here may help you

Matrix, and I recommend selfhosting Continuwuity as it is lightweight and easy to spin up. Your other option could be XMPP with Snikket or proper Prosody.

Though do you have any particular features you wanna bring over from Facebook Messenger?

Gomuks and Sable

Pihole would be easy for a RPi 4. I’d also consider AdGuard Home which does the same thing, but has out-of-the-box support for encrypted upstream resolvers. I eventually moved on to Technitium for more advanced use cases (hosting my own domains, native config syncing between nodes), albeit it can use a bit more RAM.

Hi, as someone running their Matrix server on the same ware (using Continuwuity I have some thoughts:

• The bulk of the load is in federation with other homeservers. If you only run it in non-federated mode the resource usage would be minimal like a simple REST API server.
  • If you do enable federation on such a low powered device, consider performance tuning it. DNS tuning is the most essential one, and then you should allow it to use some more RAM than normal (increasing cache capacity)
  • Also if you enable federation, expect it to be the software with the most resource impact. I think usually Jellyfin and Navidrome only uses CPU when you’re streaming something, but Matrix may do a lot more background work because federation and so on.
• Calls are handled by a separate LiveKit SFU, which uses WebRTC for most of its operations rather than HTTPS. So you cannot expose it using Cloudflare Tunnels, and you may run into issues forwarding/routing a large number of UDP ports as well.
  • I usually recommend renting a VPS for Livekit instead for simpler config and networking. But if you somehow get it working on the Pi itself as well it’d be great to know.
• I used mautrix-whatsapp a long time ago for the bridge. It was good enough, but do note that it is just a stopgap solution to prevent social isolation. Its better to eventually move people to federated protocols.

I’d also like to say you’d get much more juice out of a mini PC or some other non-embedded devices like a used laptop. This is for all your apps anyways.

And yes, Continuwuity can run in docker compose. There’s a few example files for it on the site, feel free to check it out and ask in the support room.

I’d prefer Adguard Home. Does the same thing but also supports encrypted DoT/DoQ/DoH upstreams. And the UI looks a bit neater for me

Since nobody mentioned, I recommend desec.io as the DNS provider. Has a good REST API to update records, also provides a dedyn.io dynamic domain, and runs as a nonprofit. I think ddclient will also support it natively in the next release as well.

The solution of renting a VPS also works but usually incurs some cost. You might also want to look into Cloudflare Tunnels

Hi all, thanks again for the valuable insights, I really appreciate your comments. I realized I’ve overlooked a few topologies, namely that of having granular accounts for different admining purposes/different services (and using different names for them). Also, my IDP (Kanidm) also has a service accounts feature which can be delegated to real human accounts, so I think I should also be looking into that.

It’d be nice to have something like a “second password” for granting temporary privileged access to other apps’ admin commands, but OIDC doesn’t work this way sadly. Lastly I’d also need to consider managing SSH and non-app stuff as well.

Hi, I’ve been running something similar with Tailscale. Instead of traefik, you can use any other TCP proxy like nginx or caddy-l4, or even use tailscale serve on the edge VPS as well. Do note that all of your listed services except Zola will make outbound requests, so it could be better to also exit node through the VPS (like the article did), as to avoid exposing your residential IP.

As for the linked personas, you may wanna use one domain instead of two. Matrix homeservers can be resource-heavy for example, so maybe consider @persona1:example.com and @persona2:example.com on a single server instead of having two resource hubs that does essentially the same thing. The same applies to GotoSocial and Lemmy. By the way, I recommend Continuwuity for the Matrix server :)

Static sites don’t actively take up resources, so they can be on separate domains. But again you may wanna save some money, so maybe consider using persona1/persona2.example.com subdomains, or even pubnix-style example.com/~persona(1|2) paths!

As for the Docker management frontend, I have no idea which one’s the best right now 😅 but do make use of Tailscale SSH feature to troubleshoot other parts of your machines as well. And as for updates, I just subscribe to RSS feeds to keep the important software updated. Highly recommend you do that too to check out changelogs yourself.

Thanks for the link to go-sendxmpp. It’s nice to have an xmpp-native way to send notifications

I think they encourage that increased frequency by offering shortlived certs to begin with…

Although do note that normal certificates will reduce its lifetime to 45 days over the next few years

You can use caddy reload -c /path/to/Caddyfile to reload the config midway through

For TLS I am looking into using CertBot and it appears there’s a module (github.com/desec-io/certbot-dns-desec) I can use that works for desec.io to handle my certs.

You can consider using lego-acme as well. It’s not too different, just that it comes prepackaged with a bunch of DNS providers including desec, so you don’t need to install an additional module.

Since Caddy is handling my certs automatically, how often would I want to renew my certs?

By default, certs are valid for 90 days so you’d wanna renew a bit earlier than that. There’s also the option to use 45-day certs or 6-day certs, depending on the profile chosen.

Would I be required to run the same command periodically to renew my cert?

Yes, but it’s better if you automate them, like Caddy did, and both Certbot and lego can do this well. I run lego via a cronjob which checks for the certs’ expiry, and renew it when it passes a certain deadline.

I am looking to hear any suggestions or experiences about different reverse proxies that are preferably free of AI

Not sure I can recommend anything from that list because I’m not familiar with them, but I’ve heard haproxy to be very performant.

You can consider selfhosting maubot + RSS plugin if you wanna keep using Matrix

I wrote this by myself using anectodal sources from the community, and no, it never passed through any LLMs. Perhaps I should approach things with a less upbeat and more cynically curt tone.

Hello,

I believe Matrix would be the most suitable candidate for your use case. The protocol supports both public and private (invite-only) rooms. It also has spaces, which are collections of rooms that helps with organisation (and yes they do exist in the sidebar). Voice/video calls can be done through Element Call which is integrated in many clients, and are usually quite performant. Pinned messages and polls are natively supported, and there exist various bots for reminders and other little neat features (see the Maubot plugins).

Matrix is also federatable like email, so you can extend your community to people on other servers in the network, too. Be sure to employ moderation tooling though, of which the ecosystem has plenty of and are improving every day. I also recommend testing out non-Element clients (such as Sable, Cinny, or SchildiNext) to see which one fits best with your organisation.

In another comment, you have mentioned the limit of 100 users. I believe this only applies for the Element Server Suite freemium solution, and so I ask, why not use another open source solution? My suggestion would be Continuwuity, a homeserver written in Rust with a very active community behind it. Continuwuity is generally considered much more lightweight than alternatives, and have been seen supporting sub-500 users just fine on a machine with 8 gigs of memory.

There’s some other QoL features you may be interested in, like auto-joining to a room after account creation, and . and it can also integrate with your favorite single-sign-on solution via OIDC as well. So yeah, feel free to ask more here about it, or take the next steps in the support room!

There exists other solutions as well, but I think they are not the best candidates for few reasons. XMPP (i.e. the protocol behind Snikket) is more lightweight, but its clients still generally lack support for group calls, pinned messages, and polls. Fluxer may have a better UI, but it is not federated from the ground up which can lead to problems. I don’t think Nextcloud Talk offers federation either(?), but I believe Nextcloud to be a quite heavy, “bells and whistles included” software suite in general which may be too much for your use case.

Caddy does certs by responding to ACME challenges on port 80 and 443. You need to forward those ports from the public internet back to Caddy, have you done that?

It bundles WireGuard transport layer and a SNI reverse proxy natively, along with optional authentication. Good enough for beginners or people who need quick deployments.

Hi, the sourcehut seems to be pretty interesting. If I understand it correctly, this DANE-without-root provides a TOFU model as an alternative to the normal case of verifying up all the parts of the domain levels, right? If feasible, maybe that could be nice to extend with other methods for OOB verification and key rollover

If you are running a conduit fork, what is your reason for leaving conduit, and if you are running conduit, why didn’t you switch?

Conduwuit (predecessor of Continuwuity and Tuwunel) hard-forked fron Conduit and introduced breaking database changes. That is a significant people don’t easily “switch over”

It may be slow in development, taking a bit longer to implement a new feature, but not too much longer.

I would say its pace of development is very slow compared to the pace of Matrix in general. But if you only want the barebones features, you can use it.

Or am I missing something the others have to offer?

Feature-wise, Continuwuity offers email support, single-use registration token, policy server integration, user suspending, a ton more of admin commands, and some extra endpoints for Element Call. It is also actively working on OIDC-OAuth (so you can login with your IDP), and an ecosystem-wide Admin API. It also has an active community. I can’t speak for the other fork.

Lastly, I don’t think anyone “hate” conduit, the project is alright. It’s just not the topmost option.

As to answer your questions, threaded conversations are mostly a client issue. The UX for them are still not very good so not a lot of people use it.

SSO/Auth is actually quite hard to support. There’s the “legacy SSO” option which is deprecated in favor of native OIDC, and afaict only Synapse supports it for now. But Continuwuity is activeltly working on it.

Taildrop if you use Tailscale.

<offtopic> It’d be nice if there’s a Syncthing built into Tailscale or some of the mesh VPN solutions. Taildrop is good but it’s not entire directory sync with proper conflict resolution.

Surely I can use Syncthing inside Tailscale but 1. I have to depend on their public discoservers, or 2. I have to host and configure the discoserv myself for every client which is tedious to do </offtopic>