plateee

Would you make someone you love a home server?

No. Especially no for a non-technical, remote person.

Troubleshooting my lab in the basement is hard enough without having to try some weird screen share app, or telling the person, “press the blinky light button. NO NOT THAT ONE”.

If you want to share the joys of a home lab, do what I did for my technologically impaired in laws - get a wireguard VPN client on a laptop and walk them through (several times) the process of connecting to the VPN, browsing to your services, logging into the services, doing the thing, then disconnecting from the VPN.

• Show them the process while they take notes on the process.
• Let them follow their own notes with minimal help (except to correct the notes) while they do the process end to end.
• Repeat that last step a few times with zero feedback so they build confidence in the process.
• The next day, have them do it again based exclusively on their notes and memory.
• If you’re still in town, wait a full day and repeat the last step a few days later.

My in-laws are now experts at VPN’ing in and interacting with my services.

At work, I used ssh-signed certificates for Linux server access - those certs are only valid for about 15 minutes.

The whole idea of shorter lifetime certificates is to address if a certificate is compromised. (Especially for client certificates which, iirc, Let’s Encrypt no longer offers).

For a home lab? With no externally accessible services? Short-lived certs aren’t really a big deal. Nobody is going to be hacking your homelab, stealing your private keys, poisoning your internal DNS, and pointing you to a different, malicious service.

The only reason why I hesitate to recommend Ubiquiti cameras is even their cheapest offerings are kind of expensive.

And although you can run isolated from the Internet, managing updates is a bit painful. (Ask me how I know)

They gave POE cameras that will just work with an Ethernet cable (although they gave weird POE requirements). Their USB powered ones are wifi connected.

Source: I’ve had them for years and am happy with the setup.

Money doesn’t corrupt, it just exposes.

You could either set up DNS overrides on your inwards facing DNS server, leaving external resolution to something like cloudflare (with DDNS), or you have a second internal domain for internal resolution.

I chose the latter for my homelab - it’s service.lan.fqdn inside and service.fqdn on the outside. Since I use a wildcard cert, it’s still protected with TLS if I access it internally or externally.

Hey, apropos of nothing, if you’re interested in wireless propagation like Bluetooth or regular ol’ wifi, you might be interested in this oss project that helps identify sources of such signals!

https://github.com/colonelpanichacks/flock-you

Just in case you want to make sure you know what’s watching so you can be on your best behavior, fellow citizen.

For me, I have multiple OIDC compatible systems (Proxmox, Netbox, Synology, Zabbix, Vault, etc).

So keycloak offers a SSO option to make my life easier with a single account to worry about instead of individual ones.

Plus MFA because it’s cool?

This one is bad - unauthenticated user account take over.

If you’re like me and only using it internally on a homelab, the risks are lessened, but if you expose keycloak to by the Internet - boy howdy

As others have said, cap charging at ~80%. Unless you have a spare $150 for a nice UPS, I would use the built-in battery.