BlueEther

I have AdGuard Home running on OPNSense as a local DNS with a wild card for for the ‘local domain’ pointing to Caddy

in Caddy I have this section:

*.<domain>.net {
#header X-Frame-Options "SAMEORIGIN"
        tls internal
        encode gzip
        import sec-headers
        @sub1 host pve.<domain>.net
        @sub2 host kasm.<domain>.net
       ...
       handle @sub1 {
                import sec-headers
                reverse_proxy * https://10.1.1.11:8006/ {
                        transport http {
                                tls_insecure_skip_verify
                        }
                #       header_up Host {host}
                       header_up X-Real-IP {remote}
                       header_up X-Forwarded-For {remote}
                       header_up X-Forwarded-Port {server_port}
                       header_up X-Forwarded-Proto {scheme}
                }
        }
        handle @sub2 {
                import sec-headers
                reverse_proxy  https://10.1.1.119/ {
                        transport http {
                                tls_insecure_skip_verify
                        }
                #       header_up Host {host}
                       header_up X-Real-IP {remote}
                       header_up X-Forwarded-For {remote}
                       header_up X-Forwarded-Port {server_port}
                       header_up X-Forwarded-Proto {scheme}
                }
        }
...

Back up the server then work through:

Just follow the guide iocaine.madhouse-project.org/…/getting-started/ Bind the iocaine service to 0.0.0.0:42069

cat /opt/iocaine/etc/iocaine/config.d/00-server.txt.kdl 
http-server default {
  bind "0.0.0.0:42069"
  use handler-from=default
}

expose interface to Docker (make sure not to expose it to the world).

sudo iptables -I INPUT 4 \
  -s 172.18.0.0/16 \
  -d 172.18.0.1 \
  -p tcp --dport 42069 \
  -j ACCEPT

add the interface to the proxy service in a custom/docker-compose.yml.template

proxy:
    {{COMPOSE_CADDY_IMAGE}}
    env_file:
      - ./caddy.env
      - {{ CADDY_EXTRA_ENV }}
    volumes:
      - ./caddy/Caddyfile:/etc/caddy/Caddyfile:ro
      - caddy_data:/data
      - caddy_config:/config
    extra_hosts:
      - "host.docker.internal:172.18.0.1"
...

add iocaine to caddy in a custom/Caddyfile.template

{$LEMMY_HOSTNAME} {
        import caddy-common

        ######################################
        ########## log files        ##########
        log cn_blocked {
                output file /data/cn-blocked.log
                format json
                no_hostname
        }

        ########## iocaine  code ##########
        @read method GET HEAD
                reverse_proxy @read host.docker.internal:42069 {
                @fallback status 421
                handle_response @fallback
        }
...

rebuild all the docler images (at least the caddy one ./deploy.sh -f) and test

I think that should work

Well done on getting it up and running, federation seems to be working moplemmy.fyi/instances

You shouldn’t have to put instances in the Allowed Instances, just use blocked list for stuff you dont want to see

Yes email is a pain in the arse. More so if you are having to deal with dynamic IPs

Now just wait for the scrapers to turn up. Both Dave (lemmy.nz) and I are getting well in excess of 500k requests from content scrapers per day atm and they are tyring to pull in whole comment trees and walk through all posters.

Have a look at Iocaine to help tarpit some of them if you dont want to route through something like cloudflare.

those ~2000 blocks were in the hour after turning on the full proxy, still getting a fair few from china hitting the real IP address that they must have cached.

Grep’d the logs and had 250,000 requests from china in the last 20 hours asking for full threads via the api

up untill now I’ve not had too much bot traffic, but I’m betting hammered atm. Make sure to have some good firewall rules for when it happens: Image

Yes you are mad, I know as I did that over 3 years ago. Went from at home => a cheep VPS => paid for Oracle VPS.

If you go down the lemmy route (vs piefed) then I would deply with Lemmy-Easy-Deploy by @ubergeek77. this makes setting Caddy and mail simple

And yes - I’m running DSM (Arc Loader) in a VM with PCIe passthrough for the NAS. It’s a bit overkill, but I wanted proper storage virtualization with direct hardware access.

Whats this like, I’m running TrueNAS (the BSD version) with PCIe pass-through for my HBA and a couple of SATA ports.

This is my best guess at the moment, working through it atm but not working

Have a look at www.navidrome.org/docs/usage/…/options/#%3A~%3Ate…

and maybe the plugin github.com/J0R6IT0/navidrome-lyrics-plugin

at the moment it relies on google services, I want to migrate it to an open db then federation should be easy - it already has scope for users and shared recipes and brew log.

It is geared towards mead/wine as I’ve not made beers yet

I wrote my own software, this is lemmy - what else should I do?

I often do a lemon and/or ginger sparkling mead for summer

Dawarich and Reitti are the two I know of. tested both around a year ago, but not used really since then

I would say start with Samba (or other NAS network FS), then try something like Immch image storage, move on to Jellyfin and a arr stack and then the world is your oyster

oh, I also have a cold brew coffee mead bulk aging

goldendrop.blueether.net/…/coffee-with-a-punch

I have just finished a small batch of rhubarb mead - my first time using rhubarb for brewing. turned out well, but a little cloudy.

goldendrop.blueether.net/recipes/…/rhubarb-mead

I have ~30L of Luisa mead, this had just a hint of Luisa, and on early tasting is going to be very nice

goldendrop.blueether.net/…/larissa-and-pear

• No where on the network page does it say to use app.plex.tv when you have a custom domain with ssl certs
• I wanted to cast to a dumb TV with a chromecast, the macos app doesn’t seem to support that
• if it was my network it would still not work, but it is again with no changes to the local network or to plex settings
• Plex is seeing a local IP in the logs when accessed via a FQDN

how is using a FQDN user error when the logs show the access is from a 10.1.1.x address?

I looked back at jellyfin’s history. I have had it installed for over 3 years, just not transitioned to uisinf it as up until last night plex had worked just fine (even with remote access)

I have always connected via a FQDN, for some reason last night it decided to shit it’s self. Resolved by accessing via local IP, then the FQDN worked again

I have always connected via a FQDN, for some reason last night it decided to shit it’s self. Resolved by accessing via local IP, then the FQDN worked again

because like 10 years of use, maybe more?

the thing is I always use the network name. Once I used the IP I couls go back to using plex.<mylastname>.TLD

well everythig has been working fine for years as is, and still works fine on firefox (I wanted to cast to chromecast tonight, it worked fine 2 days ago)

I did try and preempt that in my comment - but it’s hard to switch from plex when there are 5 other people with everything all configured and history etc