With a reverse proxy there’s no need for hoops unless you add some authentication mechanism on top of that. I use reverse proxies for several things so that they flow through filtering like crowdsec or fail2ban. It just routes the single port to the device on question as is. The idea is to make it indistinguishable from a fully exposed port to the user. Just have to make sure whatever system runs the reverse proxy is secured. I always make sure that nothing significant is on the system that is exposed to the internet other than the reverse proxy server and all other ports are closed internally and externally. Ideally a device that has multiple Ethernet ports works well so you can keep an ssh port open on the internally facing ethernet port for troubleshooting. Nice if they are 2.5Gbit or 10Gbit ports, too, since they route a lot of traffic. But not needed.

Yubikeys work great for me for 2FA or passwordless auth. NFC and USB interfaces. Very secure. Pretty durable, though USB-C is inherently less durable due to the size and complexity than the USB-A footprint. But I’ve never had an issue with mine in my pocket or purse right with my keys. But if you bend it while it’s inserted in something it can be an issue.

This would be the 3rd time since I’ve been using it that it has broken compatibility with Vaultwarden, but Vaultwarden always fixes it pretty quickly. But usually browser plugins end up updating before I get around to updating Vaultwarden.

Yeah it has both onetime and subscription. I got the one time for around $15.

And yeah the app is available in multiple places. For Android, I get it from a custom Fdroid repo but Obtanium would work as well. I use that for a few apps.

Yes they can both be used at the same time, though KeyPass stuff is new and beta. I’ve never used it.

There is both a subscription model and a one time payment model. I bought it with the one-time payment. I believe it was $15. But don’t quote me.

Keyguard. It’s not perfect and makes money from the paid version for syncing changes back to the server as well as offline editing that will then sync when you’re back online. But it was worth it back when I bought it, and it has never broken so far.

Thanks, probably saved me a lot of headache on my laptop browsers. Fortunately, I don’t use the official Bitwarden client on android partly because this seems to keep happening.

I use Signal because it’s the best balance of privacy and security vs. convenience and reliability I have found. Not self-hosted, but I’ve yet to find a self hosted alternative that is as reliable, especially since I don’t want to set up distributed servers, and it’s one of those things that “just needs to work” or people will abandon it quickly.

And the older people I’ve convinced to use it, like my mom, have had very little trouble adopting it. It helped that RCS messaging is so unreliable on my phone since Google or my carrier keep seeming to break it (likely became I use GrapheneOS), and also for those with iPhones it is way more compatible with itself vs Apple and Google refusing to implement RCS in a way that all features work between them, like message reactions. Without RCS, my mom couldn’t send me decent quality pictures of my niece all the time, and I couldn’t send nice pictures of my outfits to the girl I’m dating, LOL.

Can you use a dummy address or a friend’s address in another country and/or sign up via a VPN to mask your location? There are companies that will open and scan your mail and make it available online so it could be a real address. But they are a little pricey. It’s likely due to UK laws not the provider themselves, so probably all reputable providers (that follow the law) may require it.

If it’s closed source but can be self hosted, what is the business model? I think it would be hard to fight piracy in that case. If it requires connecting to a service periodically for licenses and has no free version that doesn’t require that, then I believe it should be banned. I don’t consider that self-hosted. If the company disappears and the served goes down, its dead. That’s just running on your hardware, but not under your control. If the application is open or can be run locally without connecting to their servers and the paid portion is an add on like working as a proxy or something, then I have no real issue with that.

That said, there definitely should be a higher standard for users who are only marketing here. They should be making posts specifically for this group, not just sharing generic ads. The post should specifically state why it’s useful to self-hosters and thus relevant to the group.

I run a single instance of Postgres and one of MariaDB on my NAS that all services connect to. And all of my containers store their settings in NFS shares from that NAS and backup most other things to the NAS. This greatly simplifies off-site backups overall when a copy of almost everything critical lives on the NAS.

Of course, the NAS needs to be powerful enough to handle the load, but since settings don’t get changed often and backups are during off hours and NFS has good caching anyway, the DBs are really the only heavy load on the NAS outside of storing and serving media. It has plenty of memory and has two 2.5Gb ports trunked together and a couple of small SSDs for fast caching in addition to the RAID array of HDDs. So it’s easily able to handle all of its file sharing duties as well as hosting the DBs.

Only negative might be that there’s no fail over if the NAS goes down. But I also don’t have a second router, so that’s another even more devastating single point of failure. But since everything critical is backed up to the NAS and then off-site, it’s an acceptable risk considering the cost to properly remediate it and the unlikelihood of major issues outside of times I’m doing maintenance…

ISP: $75/month for symmetrical 1Gbit fiber and unlimited data. This is the biggest expense. All other options are 1-25 Mbps up with cable or dsl and most are just as expensive.

VPSs: around $40/month, though I’m planning to cut back a bit as I’m moving some stuff local.

2 Domains: < $30/year

The rest is purchased with no future subscription costs. This covers everything except for the security cams that I need to migrate off of corporate services one of these days.

Reverse proxy with fail2ban or crowdsec. It’s possible to set up things like Pangolin which ultimately use a VPN between external and internal access points but not at the client, though it takes more setup if you want to use apps over pangolin instead of just the browser.

I have a lifetime pass from many years ago when it was cheap. So I’m not in a huge rush to convert and want to do it right. But I am on the path to converting. I decided to make a major change to my home server infrastructure and it’s still in an experimental stage. Moving from a really old standalone computer I’ve used for. HTPC purposes over the years, currently dedicated to Plex combined with a few raspberry pi’s of various generations for the little stuff, and a single, good NUC for my router, to adding two additional NUCs and eventually upgrading the Plex computer with a more modern processor and video card for ML stuff for Immich and a few other systems that I plan to start using. I’m not just moving from Plex, but also a lot of Google and Nest products.

My dilemma has been Docker Swarm vs Kubernetes. I was trying to set up Kubernetes in a way that is easily repeatable and self documenting, but ended up with lots of manual steps required to install things and lots of things that I had to write my own helm charts for as well as the scripts to install and set up Kubernetes itself on each of the servers. Lots of custom stuff. Docker Swarm would be way easier, but the issue is I’m worried about Docker getting so proprietary these days and swarm mode getting so little attention, and Podman quadlets aren’t self balancing across multiple small servers like swarm. So that’s why I haven’t switched to Jellyfin yet.

Seems funny that they continue to increase the price as that value sharply declines with the limited life left in it.

I mean at this point in its evolution, what parts does vaultwarden rely on from bitwarden? The clients, but there are alternatives like keyguard for Android devices. What other layers does it rely on, I actually have been trying to figure this out myself.

Glad I started using Vaultwarden a while back. Just need to find better apps for android and Firefox I guess because I’m guessing they’re going to try to break compatibility.

Right, but my point is, most US ISP are shitty and don’t offer IPv6 blocks. If you are in the lucky minority who’s ISP does provide proper support for IPv6, then why bother dealing with IPv4 at all, ignore it. Almost nothing needs it anymore besides the majority of ISPs in the US which all suck.

There are some cases where locally defined addresses (private IPv4 or IPv6 ULAs) and NAT are useful for controlling what people and devices on your LAN can access, but usually not in a residential or home lab situation. So why bother. Either if your ISP offers proper IPv6, just use that, or if they don’t, just use IPv4 and ignore the transitional IPv6 addresses. With both you end up writing every NAT and firewall rule twice, I don’t see the point unless you have an old device that can’t handle IPv6.

As for performance hits, I was referring to the fact that most ISPs dont offer proper blocks of IPv6 and the transitional technologies they do offer like 6rd or 6to4 do have performance hits, sometimes extremely significant ones. So if you implement dual stack and your DNS query returns AAAA record and your systems prefer it, they will always take a hit. This is from lots of experience. I always disable IPv6 because my ISP uses 6rd and it is the only one in the major city I live in that offers >10Mbps upstream, so it’s not feasible to switch. When I was on Comcast and got an IPv6 block, I disabled IPv4. Dual stack would be too much work.

What do you use for repeatable recovery and deployment of systems?

I’ve looked at ArgoCD and FlexCD. ArgoCD was too flaky. When I made changes to helm files it would often fail to deploy them and the UI often wouldn’t really show the detailed errors from things like helm syntax errors, so it was a pain to troubleshoot.

FlexCD was just really a pain to configure in the first-place and I didn’t want to learn kustomize when I already have helm charts.

And neither really supported staged deployments or dealt with dependant services well. So I couldn’t get it to deploy the infrastructure level helm charts like PostgreSQL before deploying the services that depend on it. Technically, with Kubernetes it shouldn’t matter about the order of deployment but in reality when ArgoCD would deploy the other stuff first and wait for it to come up and it never came up because the dependencies weren’t there, it caused it to choke a lot.

Just an example of the issues I’ve had. But I really want an easy way to make lots of small changes to charts and deploy them quickly as well as being able to quickly recover the cluster from backups if something catastrophic happens like a fire without having to manually deploy each chart. Just curious how others handle it or if it’s always manual deployment of charts via CLI only.

But why bother if you get ULAs. It doesn’t enhance anything and adds complexity if you use NAT or other routing as you need to add rules for both IPv4 and IPv6. Most ISPs, in the US anyway, don’t offer true IPv6 only what was supposed to be transitional technology decades ago like 6rd. I hate to say anything good about Comcast, but it’s the single thing I miss from that they actually do. But having such limited upstream speeds on cable just isn’t reasonable for much of anything these days, but definitely not when self-hosting. 1-10Mbps up on Cable or most DSL just doesn’t cut it.

If you’re starting from scratch implementing IPv6 on your LAN might be worthwhile if you dont mind the limitations of or don’t require the transitional technologies on your LAN like NAT64 and the hit to performance from the translations/tunneling when accessing the internet doesn’t bother you (it sure annoyed the hell out of me every time I accessed a website, among other things).

But dual stack, seems like it’s not worthwhile. Just choose one or the other. Few software applications or modern hardware are going to have an issue with IPv6. But if you’re using both ULAs and IPv4 private addresses, it seems like a lot of extra hassle to write duplicate routing rules for everything.