MangoPenguin

I’m re-thinking a few things, mostly moving exposed services onto a VM or two that are on their own VLAN, and don’t contain any important data (it would be my website, gameservers like Minecraft, etc…).

I already use a VPN via Wireguard on my router for access to my private services when out of the house, so my changes are just separating the public from the private as much as possible on the server side of things…

I generally stick with the main TLDs. Like com or net.

.com is fairly cheap and won’t be on any blocklists, where some other TLDs can be.

There have been a few major ones this year, I’m sure they are fixed at this point though. app.opencve.io/cve/?vendor=jellyfin

Plex uses a code signin system where you open the app on your phone or just a browser, and enter the code there.

So there’s no typing/entering anything on the TV at all.

Jellyfin has plenty of issues with public instances too. It’s just the reality of exposing to the public internet, unless it’s something that has a lot of dedicated work going into security it’s going to have problems.

If it breaks I either fix it (often it’s just an issue where the new version needs extra config added), or roll back to a backup if it really went wrong and I can’t recover otherwise.

Backups run early AM before any auto updates start, and no one is using services and changing data then, so nothing should really ever be lost by rolling back.

It’s easier to setup and use for less technical people, also just more widely known.

I run Jellyfin but logging in is a pain, have to manually enter the URL (including https for some crazy reason) and username and password using a crappy TV remote.

Wildcard SSL does help a lot, since every subdomain isn’t broadcast publicly in the cert logs.

That’s fair, shutdown service + backup everything is certainly more guaranteed to work properly.

With Immich I’m not too worried about the DB potentially being off since it can rescan the filesystem, but I also backup at 3am when nothing is happening on Immich because I’m asleep!

If you have someone far enough away, with fast/reliable internet, and a safe spot to put it.

Immich uses YYYY/MM folders on my setup, and I exclude any thumbnail directories from the backup too. So not many dirs/files to check for the backup software.

You don’t need to shut it down, pg_dump works fine while it’s like if you want to make sure it’s a good database backup. The files side of things are fine either way.

I have a storage box with hostbrr for my ~800GB of files. They have deals sometimes with 4TB boxes for like $9 a month or so. Hetzner storage boxes are also sometimes on sale.

People abusing cloudflare workers.

I think it’s worth it, but you could move to one of those VPS deals on racknerd (or another lowendbox.com deal), for like $10-20 a year and save a bunch.

I guess? They advertise it as blocking bots and bad actors and such but it doesn’t really do that.

They do talk a lot about security and their WAF on their home page, it might be secondary but they do mention it a lot.

I don’t believe there are any logs being transferred, just the abusive IPs are shared with the central DB.

So if an IP starts hitting a ton of rules (like .env access, repeated 404s, 429s, etc… Or specific AppSec rules) then that IP is blocked and sent to their central DB where it’s pushed out to everyone running Crowdsec.

Pangolin would work, it’s still wireguard underneath but with a webUI to set up things and simplify it.

What does these “tunnels” actually add?

Ease of deployment / time savings generally. You can certainly do it yourself with wireguard and a reverse proxy.

Self hosted alternative is buying a static IP from your ISP I suppose.

Performance on opnsense is fine for anything you’ll be doing at home, so I wouldn’t factor that into your choice.

Features on opnsense are probably better, just due to all the packages you can install.

Do you prefer being 100% in a CLI all the time? If not I’d say opnsense, the GUI certainly makes things a lot easier when you’re not really familiar with something.

I set up Plex/Jellyfin specifically to get away from having to manage media manually, it tracks watch states, gets subtitles, transcodes for me when I’m traveling, and does all of that for family too.

MPV is neat but its just a standard media player app like VLC, not really anywhere near the same concept as Jellyfin.

I didn’t say that, I said almost! Generally disk IO is where VMs fall short on performance vs a container.

Extra security and full isolation with its own kernel, so you can load kerne modules and such.

Also can run Windows in a VM when needed, or MacOS.

It’s interesting because you’re not the first person to complain about getting ISOs in Proxmox, but on my instance if I click on my local storage it has an upload ISO button, and a download ISO from URL button right there, so it’s really simple.

Is it all automated with versioning intervals and stuff? Or is restic required as a third party step and maintaining a duplicate of data on the server for it to grab?

Overall it sounds like a decent VM manager but is meant for enterprise stuff where they’ll be building their own backup systems.

That’s what proxmox has too, but snapshots aren’t backups and aren’t being sent to a remote backup server… You’re also not supposed to keep snapshots around for very long, whereas I have backups going back several months.

Or are you sending snapshots to a remote server? I think ZFS can do that, so maybe that’s an option I can look at.

This looks interesting, how do you handle automated backups of all the VMs/Containers? Their docs kind of seem to say “stop everything and figure it out”, but with Proxmox I’m used to it handling everything automatically to my PBS server every night.