lemmyvore

I’ve just started using GarminDB to fetch .fit and .json files from my Garmin account.

Can I simply tell Dreeve to watch the directory where GarminDB dumps the files and it will pick them up?

Does Dreeve do something with the Garmin .json files too? Sleep data for example is in those kind of files, but since Dreeve has a Strava background I suspect it only deals with sports activities?

I’ve just stumbled across this post and it’s serendipitous because I just finished setting up GarminDB in a Docker container. It’s a Python CLI app you can use to download your Garmin stuff locally (which happens to be a bunch of FIT and JSON files).

You don’t have to use Docker ofc, you can also use a venv/pip to set it up somewhere and automate the backup command in any way you want.

It’s a happy coincidence because I was now wondering how to visualize the files. GarminDB also has some –import and –analyze options that parse the data into SQLite but they’re a bit buggy. Then you can use Jupyter notebook templates to produce something you can look at, but Dreeve might also be interesting (especially if it can monitor the folder where GarminDB dumps the files in read-only mode).

Last time I looked at Paperless-NGX it insisted on taking the source files and moving/renaming them so it could manage them itself. In fact IIRC the only way to add files was to give them to the app (or upload via web UI) so it could take them over.

Does it still do that?

I don’t like tools that demand to take over the original files. I’d prefer it if it could watch a read-only folder for new files. Immich for example or Jellyfin can do that.

You can use imapsync to sync all you mails from GMail to your new email provider

Or sync to a local directory and slap Dovecot+Roundcube on top, and you have your own private searchable email archive you can use indefinitely/securely/remotely. Just update imapsync to pull from the new provider when you switch.

I never understood why they don’t support the subsonic protocol.

I mean… you might as well ask why the DLNA plugin has been broken for years. Or why they don’t add a custom HTTP header to the client app so people can lock access in their reverse proxy.

As usual it’s a mix of not enough developer manpower and “I don’t use that so it’s not a priority” i.e. the whimsies of FOSS.

I think the confusion is that this isn’t a CalDAV concern. A CalDAV server only hosts event/task definitions. It doesn’t do anything with them, only offers an API for managing them.

It’s the client apps that use those definitions to work out occurances, do notifications, send emails etc.

So what you want is a capable calendar app with CalDAV support and email support, that can send email invites using different email addresses for different calendars.

Yes, and also by trying common subdomains under the main domain (like jellyfin., home. etc.) (They also scan the entire IPv4 address space, all TCP ports, over and over, but that’s a different discussion.)

If you’re using DDNS you have to also be careful where you put the A and AAAA records. Some people put them on the main domain and then do a wildcard CNAME pointing to it for all the subdomains, or individual subdomain CNAMEs. But since the main domain is known from TLS cert logs it’s trivial for bots to also check to see if there’s A/AAAA records on it.

It’s better to put the A/AAAA on a dedicated subdomain, obfuscate the name beyond trivial guesses (eg. maybe don’t use ip.), and make an individual CNAME for each services that points to the IP subdomain, and obfuscate those service subdomains similarly.

For those who aren’t familiar with DNS, the information in it is publicly available to anybody who can name a [sub]domain and record type explicitly, but they refuse to do “list all the records for all the subdomains of this domain”. So bots are limited to asking for the most commonly used record types on the main domain but can’t guess subdomain names. (For completion, asking for a list of all records is possible, but nowadays due to abuse that function is restricted on all the public servers to just the known IPs of their fellow redundant servers.)

Even after taking these measures you have to keep in mind that this is not security, it’s obscurity. It cuts down on bot scans which is great but don’t assume it means nobody knows your service domains. Your ISP probably knows them, there are DNS servers out there that know them, your mobile carrier can see them, and if you ever connect to WiFi when away from home the owners of those WiFi can see them (think hotels, airports, coffee shops etc.) It’s not out of the question for a coffee shop WiFi to have been compromised and to collect URLs and attempt attacks against them. Use VPN or a SSH tunnel to connect to services whenever possible, rather than exposing them publicly.

In the Yggdrasil network any node can act as relay for other nodes. So you can get to unreachable nodes via reachable nodes, as long as there’s a possible path through the network graph.

The community also maintains a few nodes with static public addresses, specifically so they can be used as entry points into the network.

Each node has two addresses, one used for communications inside the network and one used for peering. The inner address is IPv6 allocated randomly from the reserved 0200::/7 range and never changes (unless you wipe and re-configure the node). The peering address needs to be public and static, yes, but can be either IPv4 or IPv6 fwiw.

You only need to peer with one such public and static address to be able to reach other nodes, as long as there’s a path to them among all the peers in the graph. If you’re taking advantage of the larger Yggdrasil network that is taken care of by the public community nodes. If you want to set up your own separate network then you need to set up at least one node with a public static address. But you can also use a domain name and do DDNS for example.

f you’re using ipv6 supposedly you don’t need to forward ports.

You don’t need to forward ports but you still need to maintain network rules for each port so you can get through the firewall. And those rules need to know IPs. And if your public IPv6 prefix changes you need to update the rules.

So, really, there’s no advantage over forwarding, on the contrary, since forwarding uses private IPs which you can make static so they never change.

Some router software like OpenWRT attempts to work around this issue by using a special “minus netmask” shorthand syntax for the network rules, for example ::2/-64 means you want to reach [whatever the dynamic prefix is right now]::2. Which assumes you’ve set things up so that a certain machine always gets static suffix ::2, which means that machine does not do MAC anonymization and can use DHCPv6, which excludes all Android and iOS devices. So it can be used with Linux servers for example but with a lot of caveats.

Keep in mind they can only “traverse NAT” if you have a publicly reachable node available, otherwise peering can’t complete. The Yggdrasil network maintains a handful of public nodes for this purpose, or you can set one up yourself on a VPS etc. But you still need to deal with this.

It’s a mesh VPN using exclusively IPv6 addresses in the reserved 0200::/7 range.

By default a new node connects to nothing. You add other nodes explicitly, typically they’d be your own devices, but the network also maintains a few public nodes that are used to facilitate communications across the entire Yggdrasil network.

When a node is connected it raises a tunnel network interface and routes 0200::/7 through it. With the usual caveats (it will pick up any service that binds to all interfaces etc.)

Each node can act as relay to reach nodes that aren’t directly connected – the network will compute the shortest path in that case – and this can be used to reach nodes behind CGNAT as long as there’s a path that contains at least one publicly reachable node.

All connections are end-to-end encrypted with the keys of the two end-nodes involved in it, so the relay nodes cannot eavesdrop.

That’s about it. Anything else (DNS, routing, firewalls) is the responsibility of each node.

While I also started with Nginx Proxy Manager, I would urge anybody to look into Caddy eventually. Especially someone who happens to be comfortable editing their own compose files. Very flexible and simple configuration.

Also, to create the reverse proxy, the most simple setup is to install Caddy and write something like this to its config file (Caddyfile):

a.example.com {  reverse_proxy 10.0.0.1:1000}
b.example.com {  reverse_proxy 10.0.0.2:2000}

All DNS servers have “fast record changes”. They publish the records instantly on their own servers (if they don’t they’re a crappy service). But they can’t force other DNS server to update, each server does that at its own pace. In theory they have to obey the TTL for each record but in practice many cache the information and update much slower than the TTL.

You need to have “address or nationality in one of European Union states or Island, Liechtenstein or Norway” to buy an .eu domain.

There are other EU ccTLDs that are fairly cheap and have no restrictions of purchase, like .nl, or .ro.

Yes. If a TLD has the so called “premium domains” feature then it can unilaterally decide that certain domains are worth more, based on their popularity. Then they’ll ask you to pay tens, hundreds or even thousands at renewal time, and if you can’t pay they will auction it away.

This isn’t something that registrars do, this is something that the entity that manages the TLD itself is doing.

For TLD’s without “premium domains” the TLD sets a single base price for all their domains. Registrars can demand more but there’s competition so someone will always sell it for closer to the base price, and if they change their price at renewal you can transfer to a different registrar.

You can’t do this with a premium TLD once they’re targeted your domain because the TLD forces all registrars to raise the price for your specific domain.

Bottom line, never buy from a TLD with premium domains.

I’ve spent a few years at the height of the blog trend doing WordPress work. It’s a very poorly designed app that has always put reliability/performance/security last and prioritized extensibility and low barrier of entry. Which is why they absolutely dominated the blog world but also why it’s such a big fat juicy target.

With WordPress (or any CMS) keep in mind that if you don’t really need visitor-facing dynamic features (like comments), then you can self-host the admin and content editing completely privately, and only export a static “dump” of the finished website pages as plain HTML/CSS/JS and images.

You can serve these static files fairly efficiently yourself with a small HTTP server, or upload to a CDN service which will take care of things like redundancy, availability, replicated content for faster access from certain geographic areas, you won’t care about denial of service or bots etc.

Meanwhile your CMS software is completely isolated from break-ins or drive-by bot attacks. As a perk, you can experiment with different CMS freely without fundamentally changing your approach, because they all produce static files one way or another. You can try for example Hugo, or a fediverse-enabled microblogging app like Pleroma, Misskey or even Mastodon.

You’re right I don’t think it can, can only advertise explicit labels.

Please note that to use “bcrypt” for htpasswd_encryption you need the bcrypt python module installed. Some distributions of radicale (eg. some docker images) don’t have it.

It’s fairly safe to set it to “md5” instead. It does not mean plain MD5 (one iteration), it does several hundred rounds of MD5 plus a salt.

For the curious, the advantage of bcrypt over a single-iteration, fast hash like MD5 is that bcrypt lets you set the hashing effort, while MD5’s goal is to do it as fast as possible.

This becomes relevant when someone steals your password file and tries to brute force it by hashing a bunch of dictionary words and random strings (plus a bunch of salts) until something matches. A fast single-iteration hash like MD5 will let them do that much faster than a bcrypt hash set to a higher effort; it can mean the difference between finding a password in one week vs finding one in 100 years. That’s what the hundreds-of-iterations MD5 is trying to achieve, it’s a “poor man’s bcrypt”.

Add mTLS to the reverse proxy and to the Immich client app and forbid access without it.

The mTLS certs can be self-generated. There are tutorials for generating your own CA and individual mTLS certs for each device. Then you put the ca.pem file in a place accessable by NPM and add a couple of commands to the “Advanced” tab of the Immich proxy host, and you put the mTLS cert on the phone and load it into the Immich app.

mTLS is a super strong method, not only does it serve as great authentication for that particular device, it also checks the TLS connection for tampering so it can’t be hijacked even if somehow you get rogue certificates loaded on your phone, you can revoke certs if your phone gets lost or stolen etc.

DAVx5 also includes good security, like the ability to use mTLS to secure your access to Radicale adequately even if you expose it over the open Internet. It’s also being actively developed, with updates coming out every few weeks.

InfCloud is the last and only functional, standalone, web-based CalDAV frontend currently in existence. It doesn’t really matter how crap it is because there’s no alternative. And besides CalDAV/CardDAV are not exactly rapidly-evolving anymore.

There are a handful of alternative frontends bundled with other webapps, for example Nextcloud includes one, but if you don’t want to install Nextcloud just for that you’re stuck with InfCloud.

I really wish someone would make a modern standalone webapp for this but no luck so far.

Having worked at some point on some calendar interfaces I can appreciate why, because they’re super intricate and difficult.

Start by using a 3rd party contacts app (or dialer+contacts as they usually come, at least on Android). Google’s Contacts app only works with Google.

The 3rd party app should let you explicitly select which sources of contacts you want to use. After you set up DAVx5 you should see it available as a source.

The app I use (True Phone, com.hb.dialer.free) shows a list of all sources under “Settings > Contacts > Contacts to show” and you can check/uncheck the ones you want.

I guess this can be useful when you can’t change DNS on the local router.

But wouldn’t announcing *.local.domain for the server that Traefik runs on accomplish the same?

Isn’t this what I just did? mydomain.eu.cc

I mean the second part from the end (.eu.). That’s not yours, and that means that the mydomain. part can dissapear at any time. The owner can also do all kinds of unpleasant things that can affect your online presence.

By “your own” domain I mean getting something of your own in that 2nd spot instead of “eu”. It doesn’t have to be on the .cc registry, it can be any established TLD like .com, .net, .org, it can be a country TLD aka ccTLD like .cc, .nl, .de and so on, or it can be a so-called “novelty” domain like .dev.

Having your own domain means you can own it in perpetuity (well… old, established TLDs are better at this than novely TLDs) and have much better control over it.

Visit a domain registrar like Porkbun and have a look through their TLDs, check some prices, the privacy of your personal data etc.

Avoid registries that allow “premium” domains, it means that the registry can suddenly decide that the domain you own is very cool and force you to pay hundreds or thousands for the next renewal or lose it.

Wouldn’t connecting through an existing fedi server also enforce its blocklist down to me?

I’m not entirely sure on how you propose to use your server: if you just want to read stuff or also want to be able to post.

Your server can do things with another server in two ways, by exposing an open port and allowing the other server to do stuff locally through that port, or by connecting to a port opened on the other server and doing stuff there.

If the fediverse protocol mandates having a local port open to do stuff like posting, it may be impossible to avoid doing it.

First of all I would suggest getting your own domain. There’s many TLDs and ccTLDs that will let you get a domain for $10/year or much less.

If you don’t want to pay then at least get a subdomain from somewhere reliable. Preferably a DNS service because you also get DNS management this way. My recommendation is DeSEC because it’s a German, privacy-oriented non-profit and it has a modern interface and modern features like an API, security tokens, support for recent record types, DNSSEC etc. And if you later decide to get a paid domain you can keep using DeSEC for it very easily.

Secondly, does your fediverse single-user server really need to be exposed to the internet to get updates? Can’t it pull them from other servers? That way you would reduce your risk a lot.

An unauthenticated tunnel is still an ingress path same as an open port, just with more steps.

Worth noting that FreeDNS domains can be a mixed bag. Anybody can add or remove the base domains at any time because they’re lended freely. The owner can also arbitrarily decide to delete your subdomain, or reserve it for themselves, or even hijack its use, its TLS certs etc.

The top 7 domains listed there (including mooo.com) as owned by “josh” are somewhat better than the others because Josh is the owner of FreeDNS. So those domains will be around for as long as FreeDNS will, and you know Josh is not gonna hijack your subdomain. But be wary of using any other domain there (or putting your own domain up for use).

Should probably note that “DMZ” in this context means a separate VLAN. Because the term is also commonly used to mean “DMZ host” where a router exposes a machine directly to the Internet. You want the former, not the latter.

But, more to the point, a beginner really shouldn’t be exposing anything to the Internet. 🙂 Running a public service as a person who doesn’t know how domains work will not end well.