fonix232

I did consider Maddy but I kinda want the other features Stalwart provides.

I've been debating between Mailcow and Stalwart (or Maddy), as well as Modoboa. The fallback isn't a cold backup though - it would be the same server with the same data (ideally) being made primary in case my own server is down.

I do have static IP and no ports blocked, so that's no trouble. I am looking for something low maintenance though, something I don't need to constantly pester beyond updates. Containers are preferred, as I already run a pretty complex Docker stack. But you seem to have completely missed the last paragraphs of my post.

Sidebar, why do you hate OpenWrt?

systemd is fine but it's trying to be so many things in so many ways that it's not optimal for a lot of purposes - embedded devices included. Keep in mind OpenWrt was designed with low end hardware (often as low as 8MB flash, 32MB RAM) in mind, where systemd would consume resources unnecessarily.

And OpenWrt is a pretty well designed OS. Simplified, single language configuration for everything, translated at runtime to the appropriate tool config, good packaging, good release cadence, the list goes on.

VLANs. You create an IoT VLAN, set it to be accessible the specific way you want, and you're done.

If you want to be extra secure you can fire up a Docker container that sits on this VLAN + your regular network, and proxies printer requests between the two, so you have perfect control over what happens and when.

Fair note, none of the apps (e.g. AirPrint) will work this way. They use Brother's cloud to connect to the printer.

Seeing the methane snow on Titan would also be an experience of a lifetime.

You're not alone, brother...

That screenshot is from ntfy - I hooked up the alerting from crowdsec (and a bunch of other things incl full logs from my servers, docker containers, APs and other network devices) into a tool I call Overseer. It is not yet public, so you can't really get a screenshot like mine.

However, CrowdSec does offer a dashboard of your instance, incl prevented attacks list etc.

Doesn't VoidAuth already provide an LDAP compatible interface for downstream devices? I recall reading about it a while back.

Authentik (and other auth systems) are super heavy for single/low-user systems. They're geared for more MSO use than SOHO. For auth, I'd really recommend something lighter, like Pocket-ID (as long as you don't mind passkeys instead of passwords - Seerr and BookOrbit support WebAuthn so you can use it directly, and Jellyfin supports it with an extension for the web interface + you can set password for a Jellyfin account for clients that need direct auth). For any service that doesn't support it, Pocket-ID has an auth gateway/wrapper you can use with your reverse proxy (I use Caddy, config is fairly straightforward).

For security, I'd recommend some automated IDP systems. You could run Suricata on your router (if it can host heavier apps), which is what Ubiquiti uses. It can talk to your firewall and set up rules on the fly to block intrusions, specific users etc.

Beyond that I'd also recommend crowdsec. One half is the detection (you hook it up as part of your reverse proxy, so it can inspect packets and full flows), and the other is the actioning (you hook it up with your router/gateway/firewall to apply blocking rules). Big benefit is that their open database (the free to access one) has all the 0-day fingerprints and CVE-specific behaviour is detected and blocked.

Here's a quick preview of what it's been doing today on my setup:

altr

Since most indirect attackers (people randomly probing your homelab instead of directly targeting you and your services) will come from various data centers (routed through a VPS or directly relying on the infrastructure), a 4h block is generally enough to not interrupt other services while blocking attackers from probing once they hit a limit.

And of course you also need proper container network setups. For example, every single container I can, I run in rootless, read-only mode. This means the container itself can't be edited - only a handful of paths (left as volume mount points) are RW: the config folder, media folders only if the container needs write access to them, and caches. Each path is mounted noexec so even if a backdoor is found into the container, the attacker can't do much as they can't execute anything they'd deliver as payload (can't write to paths that are executable, can't execute from writeable paths), and since the container is rootless, there aren't many tools to run: no ash/bash/zsh/fish, no interactive shell at all, no operating system beyond a barebones Linux kernel and the bare minimum tooling needed for the specific software.

Docker networking is also hardened, with routing strictly limited, and containers only seeing other containers they need access to.

I'd also recommend using LLMs to expand on your security. No I'm not talking about giving Claude access to your entire network and homelab... But you can ask for general hardening guidance, and most frontier models will gladly walk through your stack using basic reporting (you run a command on the homelab nodes, it returns a report, you give that report to the model), and give recommendations on making it more secure.

There really isn't one.

Trust me. I've worked for WBD for 4+ years specifically on the video playback component for Android devices - so my day job was literally testing streaming boxes and smart TVs.

That job made me switch from EVERY single other TV smart box, to Apple. Why, you might ask? Well, it's because ALL streaming oriented boxes suck ass. Apple is the only one who puts appropriate hardware into their products.

Lets start with Android, my field. The ONLY usable box is the Nvidia Shield, which, to date, costs upwards of £200. For hardware that was already kinda dated in 2019, when it released 7 years ago. Even Google's options lack RAM, and focus too much on the codec of the SoC instead power. This means nice playback, but awful user experience in menus and any other non-video functionality.

Your best bet, if you want to hand-roll a solution, is to buy a more expensive, high end SBC and hope for good support. You'll lose DRM, though, which means no official streaming apps (or, for the ones that do work, low resolution/fidelity playback only).

If it's Steam Link you want, get dedicated hardware for that. Even a Pi4/5 will do. Use it for Steam Link only, and keep the Apple TV for media.

To be perfectly fair, we've come a long, long way from 20-30 years ago when most firewalls were static or at best heuristic.

Today you can integrate solutions like CrowdSec into your reverse proxy setup (which, let's be fair, most people hosting things will be using to some extent), and transparently scans all requests for known exploit fingerprints.

Basically, if you've done the bare minimum of opsec, most likely your setup will be safe from being compromised, even if you're running an exploitable version of the problem software/stack.

And that's just a free and open source solution to securing your hosting - you can further deploy DPI based IDPs, analytics that spots irregular traffic patterns, especially in commercial environments, to protect against such attacks. It's not a guarantee, but such layered security at the very least adds some deterrence.

Random website: your password must include lower and upper case characters, numbers, special characters, emojis, invisible UTF-16 characters, be at least 32 digits long, contain no repeating sequences, mathematical sequences, musical sequences, a random episode number of Friends, parts of your username, email, mother's name, father's name, address, social security number, childhood address street name, first pet's name, any date between 32 March 1928 and 1 Feb 2077, or the special character ë̷̡̡̨̡̬̜̲̫̼̠̙̱̝̖̝̞͕͉͎̿́̂͗͂̉͐͑͐̀͗̔̊̈́̅̑͘͠ͅ.

---

CA private key security: "Pick a number between 0 and 10443888814131525066917527107166243825799642490473837803842334832839539079715574568488268119349975583408901067144392628379875734381857936072632360
8785136527794595697654370999834036159013438371831442807001185594622637631883939771274567233468434458661749680790870580370407128404874011860911446797778359802900668693897688178778594690563019026094059957945343282346930302669644305902501597239986771421554169383555988529148631823791443449673408781187263949647510018904134900841706167509366833385055103297208826955076998361636941193301521379682583718809183365675122131849284636812555022599830041234478486259567449219461702380650591324561082573183538008760862210283427019769820231316901767800667519548507992163641937028537512478401490715913545998279051339961155179427110683113409058427288427979155484978295432353451706522326906139490598769300212296339568778287894844061600741294567491
9823050571642377154816321380631045902916136926708342856440730447899971901781465763473223850267253059899795996090799469201774624817718449867455659250178329070473119433165550807568221846571746373296884912819520317457002440926616910874148385078411929804522981857338977648103126085903001302413467189726673216491511131602920781738033436090243804708340403154190335"

User: guess 4 will do

What the fuck are you on about?

1. Docker doesn't require podman at all
2. Learning the basics of Docker isn't that complex. Certainly isn't as complex as learning how to run VMs on a dedicated headless server.
3. If you look up "install docker", the first hit is, 9 out of 10 times, Docker Engine. NOT the desktop app...
4. No, I am aguing that if you were capable of setting up Cisco BGPs in the mid-90s, when documentation was ass, network gear management was ass, and you didn't have forums and Reddit and Wikipedia and websites hosting manuals, tech blogs and guides and so on.... Then setting up Jellyfin, which is a fraction of the complexity of your job 30 years ago, should be straightforward. I am arguing that if you were capable of configuring complex services and devices 30 years ago, then today, with a million times more information readily available at your fingertips, you should be able to set up a simple service.

First it's a VM because I'm not going mess around with stuff on bare metal.

Containerisation method doesn't matter, the point is to have an untrusted container (VM, thin container, LXC, whatever) that a process cannot exit, has no root user rights, and can be limited externally for what resources it sees.

The entire point is to be able to say "here's your config folder where you can write shit, but not execute; here's the data folder where you can neither write or execute shit; and here's the read-only executable layer of the image/VM/container".

Create docker is a can of worms because you have to pick a reverse proxy software like nginx, traefik, caddy. Which means you need to understand all three to know which to pick.

Regardless how you're hosting it, a reverse proxy is necessary. Even with a VM.

Here's a fun fact: Caddy and Traefik both come with ways to easily configure all the necessary things via Docker container labels. I need about 3-4 labels per container to set up the subdomain I need, the port I want to forward to it, and the security level (auth, crowdsec, etc.)

Then there's setting up the certificate with the dns provider.

Uh what? ACME makes it a literal one line configuration. Two if you include the DNS host scoped token.

So I got nginx working with a certificate but gave up after the VM running Jellyfin couldn't see it. Googling showed someone on Reddit with the same problem but no answer other than others saying "works for me".

So the problem wasn't Jellyfin but you not being able to follow a dead simple guide. And to think you were running a whole ass ISP...

Beside, that wasn't even the topic. We were discussing - or rather, I was proving to the above commenter - that setting up Jellyfin in a way that does not allow an intruder to crypto mine or host CSAM or use your device as a proxy, is incredibly easy.

Port setup and it's perceived impossibility by you has naught to do with that topic.

It's literally just:

• create docker container
• forward FOUR ports: 8096, 8920, 7359(udp) for discovery, and 1900(UDP) for DLNA to local network
• forward a SINGLE port via reverse proxy: 8096 if your proxy handles HTTPS, 8920 if you want Jellyfin to handle HTTPS

I highly doubt that if somehow you were setting up BGPs at Cisco, this incredibly straightforward port setup somehow got the best of you.

Not if your Jellyfin is set up correctly.

Read-only, rootless container with only the cache/transcode/config folders mounted RW+noexec - ideally both with a volume size limit.

Reverse proxy only the absolutely minimal ports needed, with some security measures (e.g. crowdsec transparent proxy, hooked up to both your firewall and reverse proxy to block malicious actors.

Hopefully with a firewall

And if you run a reverse proxy, put crowdsec on it. The free options for filters are pretty well maintained.

I have tablets in my home, with batteries (as fallback in case of power loss - my HA instance and router/APs are on UPS).

I'm using older (thus cheaper) Samsung tablets. Fully Kiosk works well, but recently I've started adding kiosk features to the HA Android app (no public PRs yet so it's a few months away) to add some features (mostly sleep/wake via audio/camera motion, sleep screens, default pages for the specific instances etc.), so I can ditch FK.

Battery bloat is an issue - my Tab S6 is on its third battery (though admittedly it is nearly 7 years old now, got it January 2020), and my Tab S5e lasted 3.5 years until its battery started getting spicy. I've switched both to LineageOS to reduce heating + have more control over charging/discharging, and that so far seems to have helped. Unfortunately Samsung tablets don't support running off of USB without a battery (they bootloop if no cell is detected), so pulling the battery and running them off a wall outlet isn't really an option.

To me, a Pi or similar SBC with a touchscreen just seemed like a very hacky solution. I rent so I can't add a box in the wall for the board and PSU, and tablets are just more elegant. Throw in a 3D printed enclosure/mount, and you're golden.

I use mine regularly, especially since they wake whenever I walk past them.

Nice.

It is a shame that Volante Design closed down right when I got to a point in my life that I could spend a few thou on specialty clothing... They had some amazing Trek inspired stuff. The Disco uniform based denim jackets looked awesome.

Which would be perfectly acceptable if they didn't market features that are half-working, half-assed, and will be delivered over 1-2 years of the product's lifetime.

It's a bit like ST:Generations - every key component won't be delivered until Tuesday.

While I see why Sisko had to make that choice, political pressure notwithstanding, I disagree with it.

In any case of deciding the guardianship of a child, the first and foremost factor is the child's benefit - aka where and with whom does the child have the best chance of upbringing, including how the child feels where they should be.

In this case, Rugal wanted to stay with his foster parents. His benefit would've been to stay with them, and Sisko should've seen this. While yes, Rugal's father was indeed screwed over by Dukat's aide, his claim to guardianship was questionable at best. Would he provide for the boy to the best of his abilities? Sure. Would the boy have a happy, fulfilling life? Given his upbringing, no.

Unfortunately, politics played into it, and the Federation needed to score a gold star or two with the Cardassian government, and as such, the boy was handed over.

Wish I could do that. My brain also deserves the same study, because I constantly make (made) the worst possible investment decisions. Main difference is, I never failed upwards. if I did, I would be the owner of an incredibly successful investment firm.

Thank you for formalising what I've been thinking of Prusa in the past ~4-5 years.

Pretty much since Bambu blew up, they've been... hard to recommend. Even prior to that there were issues, but at the time they were the best option, even if expensive.

Bambu, Creality, Elegoo, Anycubic and the other Chinese brands have shown that you CAN deliver working new technologies without charging an arm and a leg for them.

Meanwhile Prusa manages two things really well: coming up with new ideas, and marketing them. Everything else seems secondary, and the whole pricing is just iffy for me - how are you going to deliver a product that costs 1.5-2x as much as competitors, promises the same features, but doesn't deliver on it?

Honestly, all the magic of Prusa went out the window the moment they decided to not be FOSS/OSH anymore.

Bambu is a double edged sword.

On one hand, their printers are really plug and play. Or, their most recent printers are plug, plug and play (talking about the "security key" they added to the X2/H2 series because of laser). You plug it in, and it works. And it works well. Fast, indeed Apple-style handholding, and generally very few issues when it comes to the higher end models.

The downside is, they're a Chinese company, with the usual Chinese business mindset: anything they take from others is fair game (copyright be damned), anything they do must be super secretive (to the point of breaking A/GPL licensing). They're also not too keen on admitting mistakes.

If you're in the EU or Europe in general, consumer protection laws will protect you from their shittery, most of the time. Otherwise you're SOL.

There's also the moral side of things. Bambu did rip off multiple companies, and recently lost lawsuits against Stratasys (honestly, this lawsuit was 💩 against 💩). They also went after open source devs with fraudulent DMCA takedown requests and C&D's, and have been pretty much Apple level anti-consumer-freedom.

But then again their printers are probably the most beginner-friendly, and the cheapest when it comes to multi-material handling. I mean the H2C, a 330x320x300 volume printer with 7 toolheads is £1900, whereas the closest to this (without AMS, without smart track switching for filaments, etc.) from other manufacturers will set you back 50-70% more (Prusa XL+ with 5 toolheads and no enclosure is £3600, for comparison).

But that's about it, if you want to go off the beaten path, do funky things and hope for open source integration... That won't happen with Bambu that easily. I've made my own changes to e.g. Bambuddy and OrcaSlicer to host the entire print stack "in the cloud" (on my own homelab I have remote access to, so I don't need a computer for full slicer support), but it's a hacky solution that's prone to break any time. Their entire stack is closed source (Bambu Srudio is FOSS because the base, Prusa Slicer and Slic3r, are GPL licensed, but their network plugin that allows direct comms to the printer, isn't), and you're at their mercy for firmware updates, features, bugfixes and whatnot. The X1 series had some custom firmware progress but it's mostly stalled nowadays.

My other main issue with going non-Bambu is that there aren't other companies really that are better AND aren't overpriced AF. Prusa constantly prices their machines 30-50% higher than their real market value, aiming at semi-professionals/businesses instead of consumers (plus they've been going non-FOSS for a while now). Creality, Elegoo, and all the other Chinese brands will have the same issues as Bambu - often even worse because they don't have the capacity for fully custom software thus end up violating GPL even more - so if your main qualm with Bambu is their non-openness, these are out the window too.

Anycubic might be the best choice, but they had their fair share of hardware troubles too - on the other hand, installing open software on their hardware is generally quite straightforward (at least compared to other brands).

And beyond these, you only have the big industrial players that focus on B2B sales and products... which isn't the best choice for home printers.

Ultimately you have the fully open printer options, like Voron. They aren't ready-made, at best you get all the parts in a kit and have to assemble it yourself, at worst you need to buy the individual parts yourself and have the printed parts printed by someone else. Much more work, but you're getting the most flexible printer out of it. If you check some of the hardcore 3D printing demos on Instagram/TikTok, you'll find that most use a Voron base with some heavy modifications to achieve some super funky results. I've seen some of these plastic-punks print things in 6-10 minutes that would take 2-3 hours on a Bambu printer! Plus if you want exotic material support (PEEK for example), you'd need a custom build anyway as Bambu's hotends/chambers only go to a certain temperature.

TBF I was going all out 😂but yeah the fact that my build essentially tripled in price is insane.

I built my PC in 2024. Okay specs - 7950X3D, 2x 48GB DDR5-6400, 4090, 1+4TB Samsung 990, all watercooled. About £4k total.

Today I could sell that PC for about 10-12k. RAM was originally £300, now it's £1800 IF you can buy it. The storage also cost me around £400, today, easily £1500.