lemmyvore

I mean, anybody can post anything anywhere, and it will get synced. Many communities aren’t even modded. But removing vile stuff is a burden to put on people to begin with, and I think most Lemmy instances are poorly equipped to deal with this automatically.

I keep seeing “escape the container” mentioned like it’s a very common occurance. Is it really? I’ve looked up escape CVE’s and they seem to be few and far apart, they’re usually tricky to pull off, and when one comes out it’s a big deal and they get fixed right away (obv).

Actually my issue isn’t “do escape CVE’s exist”, it’s more like, should I really waste my time planning for it? It’s like planning for file permissions not to work, or logins to be bypassed.

I get that shit happens and why defense in depth is a thing but how do you defend from something so fundamental? If you operate under the assumption that containerization can be by bypassed, and virtualization can be bypassed, where do you draw the line and what do you do, run each app on a standalone physical box?

Might try for older R models. I have an R2 Arc Mini that can do 6 drives and it’s not too big.

If you think you might need more, get one with more slots up-front. Trying to add more HDD to a case that wasn’t designed for them sucks.

In Docker’s case is a non-issue because they were careful to use completely different names for all their packages. It’s only when the external repo uses the same names as the core that the dependency resolver can get confused.

Rant:

apt should either completely forbid external repos from using core package names (like Arch does), or look at both the package name and repo URL when deciding if a package is the same, not just package name.

I’m guessing that letting external repos “hijack” a package name was once upon a time seen as a feature and then they never got around to fixing it.

You say that but sometimes they come up with stuff that’s really useful and it can be very annoying to not have it. Like when they integrated compose into the main.

Also, if you later decide to switch to the official version you’ll have to handle the upgrade carefully or you risk wiping out all your images, containers, networks, volumes etc. Which can be fine if you have backups of all the relevant functional definitions and the volumes and so on, but obviously a huge pain if it catches you unprepared.

Mind you, this can also happen by tinkering with stuff in /etc/docker/daemon.json, which is how I originally learned to back up my shit.

Debian’s versions lag badly behind Docker’s. You’d always be missing the latest features. Docker introduces them at a steady pace and it can get annoying to see people talking about a new useful improvement and then months passing before it gets to you.

If you already know Debian that’s a big point in its favor. Nothing beats a distro you’re familiar with. (And I’d make the same argument if you were used to Ubuntu.)

I’ve used both Debian and Ubuntu Server on my home servers and I ended up returning to Debian.

• Debian embodies and follows the most essential Linux values. It’s open, it’s run by an open organization, it avoids proprietary stuff.
• Debian is long-lived. It’s been around for 30 years, it’s mature, self-sustaining, community-run project, and it will be around 30 years from now. Whereas I wouldn’t bet on Canonical being around in 30 years.
• The upgrade path for Debian is better than for Ubuntu Server LTS.(1) You can upgrade it in-place between major versions a lot more reliably and painlessly than Ubuntu.
• Debian is dedicated to being stable. (Please run stable, btw.)

I’m prepared to state that Ubuntu is Debian, just with more quirks. It offers nothing essential that you can’t do on Debian, and it will just complicate your life when the LTS support period eventually runs out.

(1) You can fuck up both Ubuntu and Debian’s upgrades by adding a lot of 3rd-party repos because apt doesn’t safeguard against external repos interfering with the core repos’ dependency graph.

So the trick is to keep the OS minimal, install only Docker from its repo and install anything else in Docker containers. That way you benefit the most from Debian being stable and very little from Ubuntu Server.

If you also need to run system containers and virtual machines you can add Incus later to the mix alongside Docker and still keep your host OS lean and simple.

You can also consider completely migrating to Proxmox later, which is also Debian under the hood but it’s a more turnkey solution. I wouldn’t recommend jumping straight into Proxmox unless you’re fairly sure that you’d need to run VMs. (If you’re unsure stick to plain Debian for now.)

I would recommend reconsidering how you obtain LE certs. I ended up on Certbot too because it lets you own what is a critical part of your selfhosted identity. Plus Certbot works well and it’s maintained by the EFF who also see it as a critical project. As a local script (basically) sky’s the limit regarding automation.

This is personal preference but I strongly prefer to locally control critical automations about my setup (certs, DDNS etc.)

The certs produced by Certbot are portable and you can use them with CF, local reverse proxies, or whatever other infrastructure you may need. Just need to get a copy to the proper place (securely).

I guess in the bigger scheme of things the question is whether you’re ok being tied to a particular service (like CF). I don’t, and I also don’t want to depend on the LE implementation of any particular reverse proxy (or their plugins).

PS: Oh and another tip: if you do end up using a CLI tool for certs, stick to Certbot. I’ve tried pretty much everything else and they all suck. It’s actually unbelievable how much they suck. Arcane and opaque, the lot of them, which is not something you want from a critical tool.

I’ve just started using GarminDB to fetch .fit and .json files from my Garmin account.

Can I simply tell Dreeve to watch the directory where GarminDB dumps the files and it will pick them up?

Does Dreeve do something with the Garmin .json files too? Sleep data for example is in those kind of files, but since Dreeve has a Strava background I suspect it only deals with sports activities?

I’ve just stumbled across this post and it’s serendipitous because I just finished setting up GarminDB in a Docker container. It’s a Python CLI app you can use to download your Garmin stuff locally (which happens to be a bunch of FIT and JSON files).

You don’t have to use Docker ofc, you can also use a venv/pip to set it up somewhere and automate the backup command in any way you want.

It’s a happy coincidence because I was now wondering how to visualize the files. GarminDB also has some –import and –analyze options that parse the data into SQLite but they’re a bit buggy. Then you can use Jupyter notebook templates to produce something you can look at, but Dreeve might also be interesting (especially if it can monitor the folder where GarminDB dumps the files in read-only mode).

Last time I looked at Paperless-NGX it insisted on taking the source files and moving/renaming them so it could manage them itself. In fact IIRC the only way to add files was to give them to the app (or upload via web UI) so it could take them over.

Does it still do that?

I don’t like tools that demand to take over the original files. I’d prefer it if it could watch a read-only folder for new files. Immich for example or Jellyfin can do that.

You can use imapsync to sync all you mails from GMail to your new email provider

Or sync to a local directory and slap Dovecot+Roundcube on top, and you have your own private searchable email archive you can use indefinitely/securely/remotely. Just update imapsync to pull from the new provider when you switch.

I never understood why they don’t support the subsonic protocol.

I mean… you might as well ask why the DLNA plugin has been broken for years. Or why they don’t add a custom HTTP header to the client app so people can lock access in their reverse proxy.

As usual it’s a mix of not enough developer manpower and “I don’t use that so it’s not a priority” i.e. the whimsies of FOSS.

I think the confusion is that this isn’t a CalDAV concern. A CalDAV server only hosts event/task definitions. It doesn’t do anything with them, only offers an API for managing them.

It’s the client apps that use those definitions to work out occurances, do notifications, send emails etc.

So what you want is a capable calendar app with CalDAV support and email support, that can send email invites using different email addresses for different calendars.

Yes, and also by trying common subdomains under the main domain (like jellyfin., home. etc.) (They also scan the entire IPv4 address space, all TCP ports, over and over, but that’s a different discussion.)

If you’re using DDNS you have to also be careful where you put the A and AAAA records. Some people put them on the main domain and then do a wildcard CNAME pointing to it for all the subdomains, or individual subdomain CNAMEs. But since the main domain is known from TLS cert logs it’s trivial for bots to also check to see if there’s A/AAAA records on it.

It’s better to put the A/AAAA on a dedicated subdomain, obfuscate the name beyond trivial guesses (eg. maybe don’t use ip.), and make an individual CNAME for each services that points to the IP subdomain, and obfuscate those service subdomains similarly.

For those who aren’t familiar with DNS, the information in it is publicly available to anybody who can name a [sub]domain and record type explicitly, but they refuse to do “list all the records for all the subdomains of this domain”. So bots are limited to asking for the most commonly used record types on the main domain but can’t guess subdomain names. (For completion, asking for a list of all records is possible, but nowadays due to abuse that function is restricted on all the public servers to just the known IPs of their fellow redundant servers.)

Even after taking these measures you have to keep in mind that this is not security, it’s obscurity. It cuts down on bot scans which is great but don’t assume it means nobody knows your service domains. Your ISP probably knows them, there are DNS servers out there that know them, your mobile carrier can see them, and if you ever connect to WiFi when away from home the owners of those WiFi can see them (think hotels, airports, coffee shops etc.) It’s not out of the question for a coffee shop WiFi to have been compromised and to collect URLs and attempt attacks against them. Use VPN or a SSH tunnel to connect to services whenever possible, rather than exposing them publicly.

In the Yggdrasil network any node can act as relay for other nodes. So you can get to unreachable nodes via reachable nodes, as long as there’s a possible path through the network graph.

The community also maintains a few nodes with static public addresses, specifically so they can be used as entry points into the network.

Each node has two addresses, one used for communications inside the network and one used for peering. The inner address is IPv6 allocated randomly from the reserved 0200::/7 range and never changes (unless you wipe and re-configure the node). The peering address needs to be public and static, yes, but can be either IPv4 or IPv6 fwiw.

You only need to peer with one such public and static address to be able to reach other nodes, as long as there’s a path to them among all the peers in the graph. If you’re taking advantage of the larger Yggdrasil network that is taken care of by the public community nodes. If you want to set up your own separate network then you need to set up at least one node with a public static address. But you can also use a domain name and do DDNS for example.

f you’re using ipv6 supposedly you don’t need to forward ports.

You don’t need to forward ports but you still need to maintain network rules for each port so you can get through the firewall. And those rules need to know IPs. And if your public IPv6 prefix changes you need to update the rules.

So, really, there’s no advantage over forwarding, on the contrary, since forwarding uses private IPs which you can make static so they never change.

Some router software like OpenWRT attempts to work around this issue by using a special “minus netmask” shorthand syntax for the network rules, for example ::2/-64 means you want to reach [whatever the dynamic prefix is right now]::2. Which assumes you’ve set things up so that a certain machine always gets static suffix ::2, which means that machine does not do MAC anonymization and can use DHCPv6, which excludes all Android and iOS devices. So it can be used with Linux servers for example but with a lot of caveats.

Keep in mind they can only “traverse NAT” if you have a publicly reachable node available, otherwise peering can’t complete. The Yggdrasil network maintains a handful of public nodes for this purpose, or you can set one up yourself on a VPS etc. But you still need to deal with this.

It’s a mesh VPN using exclusively IPv6 addresses in the reserved 0200::/7 range.

By default a new node connects to nothing. You add other nodes explicitly, typically they’d be your own devices, but the network also maintains a few public nodes that are used to facilitate communications across the entire Yggdrasil network.

When a node is connected it raises a tunnel network interface and routes 0200::/7 through it. With the usual caveats (it will pick up any service that binds to all interfaces etc.)

Each node can act as relay to reach nodes that aren’t directly connected – the network will compute the shortest path in that case – and this can be used to reach nodes behind CGNAT as long as there’s a path that contains at least one publicly reachable node.

All connections are end-to-end encrypted with the keys of the two end-nodes involved in it, so the relay nodes cannot eavesdrop.

That’s about it. Anything else (DNS, routing, firewalls) is the responsibility of each node.

While I also started with Nginx Proxy Manager, I would urge anybody to look into Caddy eventually. Especially someone who happens to be comfortable editing their own compose files. Very flexible and simple configuration.

Also, to create the reverse proxy, the most simple setup is to install Caddy and write something like this to its config file (Caddyfile):

a.example.com {  reverse_proxy 10.0.0.1:1000}
b.example.com {  reverse_proxy 10.0.0.2:2000}

All DNS servers have “fast record changes”. They publish the records instantly on their own servers (if they don’t they’re a crappy service). But they can’t force other DNS server to update, each server does that at its own pace. In theory they have to obey the TTL for each record but in practice many cache the information and update much slower than the TTL.

You need to have “address or nationality in one of European Union states or Island, Liechtenstein or Norway” to buy an .eu domain.

There are other EU ccTLDs that are fairly cheap and have no restrictions of purchase, like .nl, or .ro.

Yes. If a TLD has the so called “premium domains” feature then it can unilaterally decide that certain domains are worth more, based on their popularity. Then they’ll ask you to pay tens, hundreds or even thousands at renewal time, and if you can’t pay they will auction it away.

This isn’t something that registrars do, this is something that the entity that manages the TLD itself is doing.

For TLD’s without “premium domains” the TLD sets a single base price for all their domains. Registrars can demand more but there’s competition so someone will always sell it for closer to the base price, and if they change their price at renewal you can transfer to a different registrar.

You can’t do this with a premium TLD once they’re targeted your domain because the TLD forces all registrars to raise the price for your specific domain.

Bottom line, never buy from a TLD with premium domains.

I’ve spent a few years at the height of the blog trend doing WordPress work. It’s a very poorly designed app that has always put reliability/performance/security last and prioritized extensibility and low barrier of entry. Which is why they absolutely dominated the blog world but also why it’s such a big fat juicy target.

With WordPress (or any CMS) keep in mind that if you don’t really need visitor-facing dynamic features (like comments), then you can self-host the admin and content editing completely privately, and only export a static “dump” of the finished website pages as plain HTML/CSS/JS and images.

You can serve these static files fairly efficiently yourself with a small HTTP server, or upload to a CDN service which will take care of things like redundancy, availability, replicated content for faster access from certain geographic areas, you won’t care about denial of service or bots etc.

Meanwhile your CMS software is completely isolated from break-ins or drive-by bot attacks. As a perk, you can experiment with different CMS freely without fundamentally changing your approach, because they all produce static files one way or another. You can try for example Hugo, or a fediverse-enabled microblogging app like Pleroma, Misskey or even Mastodon.

You’re right I don’t think it can, can only advertise explicit labels.

Please note that to use “bcrypt” for htpasswd_encryption you need the bcrypt python module installed. Some distributions of radicale (eg. some docker images) don’t have it.

It’s fairly safe to set it to “md5” instead. It does not mean plain MD5 (one iteration), it does several hundred rounds of MD5 plus a salt.

For the curious, the advantage of bcrypt over a single-iteration, fast hash like MD5 is that bcrypt lets you set the hashing effort, while MD5’s goal is to do it as fast as possible.

This becomes relevant when someone steals your password file and tries to brute force it by hashing a bunch of dictionary words and random strings (plus a bunch of salts) until something matches. A fast single-iteration hash like MD5 will let them do that much faster than a bcrypt hash set to a higher effort; it can mean the difference between finding a password in one week vs finding one in 100 years. That’s what the hundreds-of-iterations MD5 is trying to achieve, it’s a “poor man’s bcrypt”.

Add mTLS to the reverse proxy and to the Immich client app and forbid access without it.

The mTLS certs can be self-generated. There are tutorials for generating your own CA and individual mTLS certs for each device. Then you put the ca.pem file in a place accessable by NPM and add a couple of commands to the “Advanced” tab of the Immich proxy host, and you put the mTLS cert on the phone and load it into the Immich app.

mTLS is a super strong method, not only does it serve as great authentication for that particular device, it also checks the TLS connection for tampering so it can’t be hijacked even if somehow you get rogue certificates loaded on your phone, you can revoke certs if your phone gets lost or stolen etc.