melroy

With tuning that means you can also try to set it via vm.swappiness kernel parameter. For example.

You can just set swapiness kernel level parameter (vm.swappiness).

If you want to setup a mbin instance. Just let me know.

Fail2ban is definitely using too much cpu and ram for me now! I will switch to fail2ban-rs soon.

Yes I'm the creator of Angie Guardian install is easy. Via:
curl -fsSL https://raw.githubusercontent.com/AngieGuardian/angie-guardian/main/scripts/install.sh | sudo bash

I also still want a 3 node setup for high availability as well! With the recent ram prices etc. I postponed it.

However the idea is simple. You setup a ceph cluster so the vm storage etc is shared across the cluster or your nodes. Then you can configure for each vm where it should start and where it can fallover to. Eg. Start a vm on node 1, but also allow it to start on either node 2 or 3 in case node 1 is down. Ceph cluster takes care of the rest.

1. Unbound can override custom domain names if you want.
2. I migrated from Nginx to Angie's to get more features for free. And also has builtin let's encrypt support.
3. If the services are public configure fail2ban and something like Angie Guardian see: https://angieguardian.org to reduce ddos and bots.

Proxmox down. Whole internet down? No thank you.

The scrapers most likely don't use the VPN providers AFAIK. But the datacenter clusters, so there are dozens of cloud providers where you can rent your own virtual server and those datacenters are also often used by VPSes.
Its actually often coming from separate IP address. Which makes it actually even harder, its not just 1 or 2 IP addresses. Meaning both good and bad traffic has 100.000's of unique IP addresses. At that point I block the whole ASN: https://www.cloudflare.com/learning/network-layer/what-is-an-autonomous-system/

Meaning I basically block the whole datacenter and mark them as bad actors. Cloud server providers F*K up the internet, since before you can easily block one, two or ten IPs and be done. Today, those bad actors and scrapers or DDos attackers can use millions of unique IP addresses, because it can rely on the whole cloud provider IP ranges (ipv6 is even more insane ofc).

Yea so the same server and IP addresses VPN provider use (which are again just cloud providers) are also used for other purposes mainly by scrapers and DDos attacks indeed. Too bad all those cloud providers do not act accordingly in the past 5 years. Since its getting worse and worse. With the increase of datacenters and centralization, I consider it a duty of these companies to take action to stop these scammers, spammers, scrapers, and attackers.

However, that is often not the case. Now I must say, I created Angie Guardian myself (alternative to Anubis). So hopefully soon I can slowly open some of ASN bans. And see how it goes.

I block some misbehaving data centers. Which are often also used by VPN providers. So it's more collateral damage.

No I fully block some data centers not just rate limit.

nah its not down.. maybe you use a VPN.

• I run 50+ websites
• MariaDB instances
• PostgreSQL instances
• Docker container
• Mbin, Nextcloud, GitLab, GitLab runners, gitea, bitcoind, fulcrum, grafana, prometheus, influxdb, Synapse, Angie, telegraf and various other services like fail2ban etc. etc.

All optimized for performance and fine tuned as well, eg. lets say you run mariadb vs how I run null

innodb_buffer_pool_size = 8G
innodb_flush_log_at_trx_commit = 2
innodb_log_file_size = 2G
innodb_log_buffer_size = 32M
innodb_max_dirty_pages_pct = 90
innodb_io_capacity=5000
innodb_io_capacity_max=20000
innodb_read_io_threads=8
innodb_write_io_threads=8
query_cache_type = 1
query_cache_limit = 2M
query_cache_min_res_unit = 2k
query_cache_size = 128M
tmp_table_size= 128M
max_heap_table_size= 128M

[mysqld]
max_connections = 200
character_set_server = utf8mb4
collation_server = utf8mb4_general_ci
transaction_isolation = READ-COMMITTED
binlog_format = ROW
innodb_file_per_table=1
# Increase open files based limits.conf value
open_files_limit=65535

Same idea for Postgresql.. You can run "postgres" or.. actually run postgresql in production correctly like:

shared_buffers = 6GB
work_mem = 20MB
maintenance_work_mem = 2GB
maintenance_io_concurrency = 200
max_worker_processes = 14 
max_parallel_workers_per_gather = 4
max_parallel_maintenance_workers = 4
max_parallel_workers = 12

synchronous_commit = off
commit_delay = 300

checkpoint_timeout = 30min
max_wal_size = 60GB
min_wal_size = 4GB

Not for me. I have a very quick ryzen setup with tons of ram and nvme etc. I never want back to a orange pi. But sure. I don't like waiting, as a developer myself I just want to have quick loading pages and services.

Most of these devices have very limited IO disks speeds as well as slow processors. And also limited ram.

I don't think it's a massive overkill. He most likely will try to host even some more services besides nextcloud etc.

I recommend actually to get more ram. Despite the stupid high prices I know.

Yes definitely get more ram you will regret it later.

I agree. The most limiting factor is still memory for me. And I'm max out currently of my motherboard (128gb).

Recently thessecond limiting factor is actually cpu. But that is due to my gitlab runners.

uhm.. yeah I need to look into that. with Telegram, I needed to register a special "telegram app token" and on top of that you still need to login with your own credentials. But I'm just using the official tdlib for that.

Yeah escargot just doesn't do it for me. I want to keep using the existing chat network I use daily. But just giving back the MSN vibes.

I created it using gtk4. So it's cross platform as well. Meaning Linux native. Which I also wanted.

Yah that's possible. I just implemented telegram for now. But depending on the open api like matrix should work for sure as well. Has signal also an open client api?

Ps. I notice your msn avatar. I'm busy with https://retromessenger.com. Coming soon for free!

And what if I have a router (like your thread, OPNsense), top-of-rack switch (10G ports) and an access-switch (1/2.5G ports). And then the ports that face end-devices are either on the access switch (that makes sense right) as well as top-level rack switch has connections towards my server machines in my rack.

So its bit more hardware then you initially though, and all devices technically support vlans. SO basically I had two questions in one:

1. What would be the best VLAN setup for my needs (I expect here some follow-up questions, back and forth)
2. How can I configurable the VLANs correctly across my various switches, such that it actually works.. So I don't accidentally lock myself out again and needed a SW reset (lol).

I have the same request but for vlans in my house. I do have supported hardware. But I just still don't vlans working

Yes don't buy their expensive hardware is whet I recommend. It's not worth it.

There are soooo many hacked devices currently in the United States of America. It's crazy how much bad traffic I see coming from residential IPs.