irotsoma

I use a vlan for certain isolated devices that only certain personal devices have access to via their IP static addresses set in my firewall. That VLAN has no WAN access either. Sure the devices could technically talk to each other, but that doesn’t seem like a big deal since they can’t go external and only my phone and laptop and a few other trusted devices can even connect into the VLAN.

SMTP proxy will have that trust for you and help you on setting up things at the domain level like reverse DNS, DKIM, etc., that are needed to combat forged “from” addresses and many selfhosters miss.

Only difference is you need a full email stack on your side. Only SMTP traffic (in and out) would go through the proxy and to your local SMTP server. It solves the IP trust issue in many cases (though not all as some places do block the proxies on purpose as well), but nothing can really solve the domain trust issues when they come up except directly contacting the companies who have those policies and often resolving it isn’t really possible since they often don’t have external tech support for that stuff. It’s so annoying when they only whitelist gmail, outlook, and a few other big company domains.

There are then various ways to view the emails and compose and send. If you want to have clients accessing the email via IMAP/POP then you need that server in addition to the SMTP server, but all of that traffic could then be kept local. If you want to only have a web client there are clients that access the email directly without need for IMAP/POP.

But this way, although your email does pass through the proxy so you need to trust them, at least the data at rest is not stored there which increase the likelihood they’ll change policies on reading your email like gmail did, or charge you for storage, which is expensive these days.

Personally I use mailcow which is a pretty nice stack, but it would probably be overkill for many people. And I have a good understanding of the issues with both IP and domain white-/black-listing. So it works decently for my needs.

Ah got it, so is that a hack to prevent a specific user from logging in rather than something like:

Match User <username> PasswordAuthentication no

People use * as an account password, or sysadmins allow that? I’d never allow that on any system or service of mine. No surprise, like most of these LLM discovered issues in the media lately, it hasn’t come up before. 💯 Good they’re getting fixed, but nothing so far has really been that urgent to fix for me.

Same I switched from rsync to borg for my QNAP NAS since my offsite rsync host didn’t support file ACLs, and it’s finally working for the most part. Just need to figure out how to trigger zfs snapshots and backup from there in the docker container that has Borg and Borg UI in it instead of directly backing up from the mounted share which sometimes things like DB files are changing constantly. But at least the backup is running and most shares don’t have files changing all that often like the DB server’s share. It’s a big step in moving some stuff from VPSs to local servers and setting up some of the more private stuff and stuff that needs too much storage to host remotely like Jellyfin and Immich.

Biggest issue with LLM “AI” that most people like to ignore is that all current models are created with extremely unethically practices like using unauthorized data, pollution, causing people to go without power for heat/cooling/food refrigeration/etc. due to power demands, etc. Regardless of how ethically/responsibly you might use the technology, the models are not ethical to use. Sure most software has a lot of ethics issues, but LLM model generation is extreme.

Pop is download only (and optionally delete on server when downloaded), IMAP is sync so read states, moves, deletes, etc., will sync to the server and between all clients.

But both exist still, just most email providers want you to leave your email on their servers so they can charge you for storage, scan it for advertising, etc., and most people want the state to sync across devices, so a lot of places just don’t implement it anymore and just allow either web-only or IMAP-only (usually paid since they don’t get to show you ads).

And yes you can set up a local software to download email from another server offering POP or IMAP and then either use a client application or self hosted web application to view them. This is not too common so it might be harder to find instructions, but it’s doable.

Which part are you concerned with. The biggest issue with email servers is trust. Many companies will refuse to connect to your SMTP server to send you emails or reject your emails your SMTP server is sending to them if you aren’t on a whitelist or if your IP address has been used for spamming in the past and it’s on a black list. The easiest way to get around this is to subscribe to an SMTP proxy service.

The other issue you may find will happen no matter if you selfhost or not. When using a custom domain, some servers have whitelists of domains in addition to IP addresses and if you aren’t on it they will silently reject emails you send or that they were supposed to send to you. I have a couple of places (health care and financial companies mostly) who do this, so I have to use gmail, which ironically means the email is less secure, especially with Google’s recent changes in policy about reading your emails.

Definitely agree on that part, if only the tools themselves weren’t so unethically created and a continual heavy drain on so many aspects of society I might consider using them outside of work where I’m forced to.

Also, they don’t do much to aid my work and actively slow me down quite often since I don’t think in words, so I have to translate my logic into a conversational essay for the AI to understand and then debug code someone else wrote. It’s so much faster for me to translate my logic into programming languages directly which follow logic, not conversational norms. I see how it’s useful for people who can’t think in logical steps, though.

I think I tried that one when I was evaluating a few. I really like that Keycloak makes it really easy to configure custom workflows inside the web UI. I have custom user/group permissions flows and some other more complex logic for assigning specific permissions for specific apps built into workflows over the years. So I definitely don’t want to switch, but yeah, I’d like a read-only LDAP system that just generates LDAP responses using the existing user data basically like Authentik does. But Authentik was too unstable for my tastes when I tried it for a few months so I ended up back on Keycloak. It was down way more often than it was working and that was without any real major customizing. Plus it wasn’t well documented with examples for more complex setups.

I like Keycloak. It is very configurable, has lots of available examples of configs out there, and has been the most stable for me of any I’ve tried.

I have one from Evatek, (Taiwanese company) that was less expensive but has lasted for my home PC and work laptop dock, but it seems they are no longer making anything, not sure if they finally died off or what, but even the photo on the Amazon page of the device I have shows different branding (Greathtek) though the particular one I have is out of stock. Not sure if Greathtek, which seems to be a Chinese company, bought their KVM product business or what but seems that’s all they make and the company seems to be deeply connected with Amazon somehow. So I’m definitely not convinced the quality will have transfered over.

I’ve been getting exe’s and such since I’ve been using the tech for a decade or more, though it does seem to be more common lately. I only wish sonarr would have an option to automatically blacklist and search. But at least now it does have an option to fail the download before even attempting to import it.

Even ignoring all of the functional issues with LLMs/"AI” related to their design to never admit to not knowing and preferring to make stuff up instead (hallucinate), I have an ethical qualms about the way they are trained. Two primary issues are that they aggressively scrape data from sources that explicitly do not consent to sharing their work and the data centers which have made hardware impossibly expensive for everyone but them and are so impactful to our underfunded electrical grids that they cause brown outs that keep people from heating their homes among other things, cause major spikes that cause house fires and destroy home appliances, and create an excuse to generate power using the worst polluting generators that we had finally gotten shut down to slow climate change (personally I’m tired of the wildfires and extreme storms from climate change).

So, I personally consider it extremely unethical to use the technology for that and several other reasons which are hard to touch on exhaustively in a post like this.

Pay for the unbranded version, or set it up and replace the image with whatever you want. It’s open source and is trivial just to replace the image. I see it with different images all the time on other sites. Name and other branding is a little more work to replace, but can be done and that’s what the paid version provides.

I mean, yeah, that’s what I was saying. I want a truly free and thus FOSS version of the apps. Vaultwarden is a FOSS version of Bitwarden back end, but there aren’t really any totally FOSS apps for it. That’s what I’d like to see more of.

Sure, it’s no change for self hosters currently, but it’s one more step in moving towards a more closed platform overall. I do hope more FOSS client apps end up getting made sometime soon. I’ve been using Keyguard on Android for some time, which means the recent several breaking changes in the Bitwarden apps to the Vaultwarden backend haven’t hit me as hard, but I do still use the official apps for my laptop and desktop and Keyguard isnt fully FOSS, of course. I’d love to see some forks or brand new apps one of these days that are actually fully FOSS for both mobile and browsers. I’ve thought about doing some myself, but I have too many other projects and I also don’t have a MAC or want to pay the fees to make an iPhone version. And I abandoned my Android Developer account when they started the identity nonsense, so none of my apps are on the official store anymore and Fdroid and similar may not be viable soon, so it would only really be for myself and a few others who use alternate Android OS’s.

Sucks that it requires a Reddit account which I’ve long since abandoned along with most other social media after most embraced harmful policies and hate speech in addition to the profit-seeking through tracking. But I suppose that’s how corporate blobs support eachother.

I don’t like the idea of a third party doing MitM type intercepts. I want control over anything that sees my unencrypted data whether it’s web services or chat services, etc. So for me the VPS is worth it. But I do also use my VPS for some other services that use apps or other APIs that don’t allow for presenting the Pangolin/SSO login step, and aren’t too risky to have a bit exposed rather than the responsiveness and battery cost of the separate VPN connection. One day I need to find a better way to handle those but for now it’s fine.

I use VPS’s for things that need to be more internet facing as well as Pangolin for then connecting to a few of my home based services securely. IMHO, it’s not as good for things that require storing lots of data like video, though, since storage costs have exploded. And any private data I prefer to only have on servers I own, not a VPS. Only encrypted backups of critical data go to online storage.

I use netcup for most things though I still have one server on Hetzner that I haven’t migrated. Hetzner’s prices went up and server responsiveness went down, so I started moving away, though I also still have the storage box server there for backups as well as the one VPS.

That sucks. It was one of the few GUIs that did a good job with most aspects of Docker Swarm. I knew it was heading in a shitty direction, but I was hoping something else would come along to fill the gap in the mean time.

Yeah, but you can also use file level technology like par files for rar compressed files or file system level or hardware level tech that allows for repairing some level of corruption. This often uses a little more space depending on how much corruption you want it to be tolerant of, but again, unless you have a ton of data, even using 1.25x the space needed for the data itself might still be cost effective for most home users.

If the tape drive attaches with SATA like a regular DVD drive or HDD then just get an adapter that connects USB to SATA. USB is unlikely to be a bottleneck with how slow tape is anyway, so having it internal isn’t that important.

But tape drives are only worth it if you need a heck of a lot of cartridges or absolutely need 30 year storage rather than maybe 10 years for an offline physical hard drive (assuming they’re both stored properly). Though I have drives decades old that still have readable data. But even if you copy out the data every 5-10 years to a new HDD, you’re likely to spend less than just the tape drive itself. And drives get larger over time so you’ll need fewer of them whereas the tape drive will have a set maximum storage space. And what if the tape drive dies and the company is out of business? You may end up not being able to read your tapes. SATA on HHDs has continued backward compatibility for decades.

Anwyay, for a home user with a few hundred TB to store, I’d be surprised if the cost would be better for tape. It’s really useful for places that store a few hundred TB per day, though. That’s where tape can be a boon. The primary advantages are it takes up a lot less physical space per TB and lasts longer. And once you do get past the cost of the drives, it does eventually start to be cheaper.

Also, remember it’s way slower than a physical HDD much less an SSD. Even an HDD connected via USB.

Should specify, I need it exposed to the internet as well so I can sync it to those multiple devices when I’m at my partner’s place or traveling and so my partner can use it from her place.

And I’d prefer something that allows some type of SSO or external authentication mechanism so it can handle multiple logins with different calendars and I can put some layers of security in front of it. Radicale requires addon applications to do that and most aren’t maintained.

Supposedly Radicale can do it with a WSGI server, but I never found one I got working.

Only one that came close was Baikal, but it had some issues and development has been really slow on it. It’s been quite a few years though, maybe I will try that one again.

Definitely easy, but not really a relevant response given the community we’re in. Plus there’s a lot of use in having your calendar synced to multiple places, not just your phone.

I never found an easy solution to set up for caldav and carddav yet personally. Most are either very complex to set up or they are no longer maintained which is bad for security vulnerabilities. So, I’m still stuck with Google because I need my reminders everywhere I go…ADHD.

Yeah getting rid of windows solves many issues, LOL. I have always refused to run any server with windows, outside of being forced to at work. 😁

True, I was oversimplifying a bit. It’s not a full VM, but often it is a full OS depending on how the container was created. I’ve seen crappy containers that start with a full desktop version of Ubuntu for instance. They are often optimized installations for running virtually, but more for things like the base for VDIs, not individual application containers.

Based on a quick read it sounds like the issue will be that the bad actors won’t get dropped immediately. Meaning whatever servers and services are in front of the firewall that fail2ban configures, will still receive the performance hits. But your backend services will still be protected.

I have a server specifically set up as the ingress server. That runs fail2ban and Traefik and I have crowdsec set up with a Traefik bouncer plugin. So fail2ban runs in front of everything to catch the worst, most obviously bad stuff and drop the traffic very quickly and efficiently so it doesn’t get any further including things trying to access services other than the web services. Then crowdsec is focused on more complex threats as they flow through the reverse proxy. Seems to work the most efficiently for me, but I haven’t had a chance tondo any real analysis on how much improvement it might be over any other configuration.

I didn’t look too closely at details, but generally that’s relatively normal the more individual applications you have running, especially with the overhead of them all being virtualized. Often the overhead of running that many virtualized operating systems can be problematic depending on how the container author chose and configured the container’s OS. A lot of people seem to just randomly pick an OS for their containers just so they can distribute their application with docker as easily as possible, without considering the consequences.

Here are the options off the top of my head if disk wear is your primary concern:

1. Turn swap off at the host level. Note, though, that you may end up in bottlenecks if multiple of them do very memory intensive tasks at the same time, like image and video processing, and docker can’t swap out the VMs that are idle to the disk and be able to use the RAM fully for those active tasks. For some of those apps you can configure when they do maintenance tasks and reduce the likelihood.

2. Look at each individual VM in docker and see which are using the most swap and force docker to limit their allowed resources. You can even tell docker to make an application not use swap by setting the memory and memory-swap values to the same value or reduce their swap usage by setting memory-swapiness to a low number, or you can install those applications to the host system and configure the host to reduce swap or disallow swap usage through systemd or whatever rather than running them in docker. You may also find one of the applications you’re running has a memory leak issue. Good OSs often handle that, but who knows what IS the container is running and the docker layer is concealing from the host kernel and not handling quite as well as it being installed on “bare metal” might. Virtualization adds a lot of variables for these kinds of low level resource control scenarios. So just trying it on the host directly might reveal something if you’re interested in digging like I usually am, lol.

3. Get a second, small, inexpensive drive and set that up as the swap partition for the host.

4. Look into what database systems these are using. Often if they each are running their own separate DBMS containers, the DBMS maintenance overhead can cause some additional churn. I have a single instance of PostgreSQL and one of MariaDB running on a separate server that all of my applications connect to. Some of these applications may be not only spinning up a whole VM for the application, but an entirely other VM for their database server. Though I think some of these probably use sqlite which is just a file, I think manynof these use PostgreSQL and/or MySQL/MariaDB by default. This also helps because I only need a single backup for all of my databases. The negative is that if that DB server goes down, then all the apps go down too, but if you already have everything on one server that might not be as big of a deal. I have a lot of smaller servers running smaller subsets of applications based on their resource needs. Helps me conserve electricity rather than running one or two big servers that are almost always highly active. But I enjoy optimizing that kind of stuff, it’s tedious.