Aussie living in the San Francisco Bay Area.
Coding since 1998.
.NET Foundation member. C# fan
https://d.sb/
Mastodon: @dan@d.sb
you can override this by setting an IP on the port exposed so thet a local only server is only accessable on 127.0.0.1
Also, if the Docker container only has to be accessed from another Docker container, you don’t need to expose a port at all. Docker containers can reach other Docker containers in the same compose stack by hostname.
If you are good at manipulating iptables there is a way around this
Modern systems shouldn’t be using iptables any more.
How do you eat sleep?
Their deep investigations are so good. I liked their documentary about GPU smuggling in China.
If you don’t mind a web UI, Netdata is great. It collects a bunch of metrics once per second and can retain them for a long period of time. The web UI is pretty good. Their Github readme links to some example servers so you can try it out first. Just click the link to use it without an account (that’s optional).
It’s mainly designed for servers, but there’s no reason you couldn’t run it on a client system. They’re focusing a lot on AI/ML-based anomaly detection as well as their cloud offering at the moment, but you don’t have to use either and can just stick to the open-source agent.
Still up here in the San Francisco Bay Area. Maybe only some regions are affected.
why is a tower defense game listed under Automation?
and two of the most popular automation programs are missing (n8n and Node-RED).
who on earth needs customer live chat and a lot of business-scale website analytics, webshop systems and CRM and ERP in their homelab??
Maybe not in a homelab, but plenty of people self-host these. I’m setting up customer live chat (Chatwoot) and invoicing and account (Bigcapital) for my wife for example. I self-host website analytics (Plausible) and bug tracking (used to be Sentry but it got too complex to host, so now I’m trying Bugsink and Glitchtip) for my personal sites/projects, too.
Oh… Oops. Hahaha
DigiCert have said they’re not changing their prices as a result. It’s still a yearly payment (or every 2 or 3 years if you prefer that).
7-day validity is great because they’re exempt from OCSP and CRL. Let’s Encrypt is actually trying 6-day validity, not 7: https://letsencrypt.org/2025/01/16/6-day-and-ip-certs
Another feature Let’s Encrypt is adding along with this is IP certificates, where you can add an IP address as an alternate name for a certificate.
This is one of the reasons they’re reducing the validity - to try and convince people to automate the renewal process.
That and there’s issues with the current revocation process (for incorrectly issued certificates, or certificates where the private key was leaked or stored insecurely), and the most effective way to reduce the risk is to reduce how long any one certificate can be valid for.
A leaked key is far less useful if it’s only valid or 47 days from issuance, compared to three years. (note that the max duration was reduced from 3 years to 398 days earlier this year).
From https://www.digicert.com/blog/tls-certificate-lifetimes-will-officially-reduce-to-47-days:
In the ballot, Apple makes many arguments in favor of the moves, one of which is most worth calling out. They state that the CA/B Forum has been telling the world for years, by steadily shortening maximum lifetimes, that automation is essentially mandatory for effective certificate lifecycle management.
The ballot argues that shorter lifetimes are necessary for many reasons, the most prominent being this: The information in certificates is becoming steadily less trustworthy over time, a problem that can only be mitigated by frequently revalidating the information.
The ballot also argues that the revocation system using CRLs and OCSP is unreliable. Indeed, browsers often ignore these features. The ballot has a long section on the failings of the certificate revocation system. Shorter lifetimes mitigate the effects of using potentially revoked certificates. In 2023, CA/B Forum took this philosophy to another level by approving short-lived certificates, which expire within 7 days, and which do not require CRL or OCSP support.
Yes, this requirement comes from the CA/Browser Forum, which is a group consisting of all the major certificate authorities (like DigiCert, Comodo/Sectigo, Let’s Encrypt, GlobalSign, etc) plus all the major browser vendors (Mozilla, Google, and Apple). Changes go through a voting process.
Google originally proposed 90 day validity, but Apple later proposed 47 days and they agreed to move forward with that proposal.
The current plan is for the floor to be 47 days. https://www.digicert.com/blog/tls-certificate-lifetimes-will-officially-reduce-to-47-days, and this is not until 2029 in order to give people sufficient time to adjust. Of course, individual certificate authorities can choose to have lower validity periods than 47 days if they want to.
Essentially, the goal is for everyone to automatically renew the certificates once per month, but include some buffer time in case of issues.
Tailscale serve might work; I haven’t tried it so I don’t know what it’s capable of.
Usually I’d recommend getting a real domain name and using Let’s Encrypt. .com domains are around $10/year but some TLDs are even cheaper. If you don’t mind which TLD you use, go to tld-list.com and sort by renewal price.
Edit: I forgot to mention - a server does not need to be publicly exposed to use Let’s Encrypt. You can use a DNS challenge instead of a HTTP one.
Interesting! They used to have a warning about it. I guess they removed it at some point. It’s referenced in this discussion for example: https://github.com/immich-app/immich/discussions/13008
Tailscale is great. You should use it. Most of their code is open-source. Their coordination server is closed-source, however there’s a self-hostable open-source reimplemention called Headscale if you want a fully-open-source Tailscale stack.
Tailscale is a peer to peer VPN, meaning there’s no central server like with OpenVPN. Systems on the VPN connect directly to each other. You can also use Wireguard in this way if you configure it as a mesh (every device on the VPN has every other device configured as a peer, and for each pair, at least one of them has the port open and forwarded). Tailscale is more reliable for that as it uses several NAT traversal techniques, so you don’t need to open the port and it works even if both ends are behind NAT.
Immich doesn’t rely on Tailscale; you can use any VPN. They don’t recommend exposing it to the public internet at the moment though, which is why you’d use a VPN (edit: as per a reply, this is not the case any more). In general, never expose anything publicly unless it absolutely has to be (like a website that anyone can access). For giving access to friends, you can share a device with them via Tailscale and configure an ACL so they can only access particular services on it.
For the drives, I’d recommend ZFS instead of Ext4 or NTFS. ZFS can detect bitrot and corruption using checksums, which neither Ext4 nor NTFS can do. NTFS isn’t recommended unless you’re running Windows Server, but you already said you’re using Proxmox.
IMO, use Syncthing instead of Nextcloud, unless you’ll be using all the other apps that come with Nextcloud (calendar, office tools, chat, etc). Syncthing does one thing and it does it well, which is almost always better than using software that tries doing a large number of things. Consider Seafile too.
For backups, I’d recommend Borgbackup and Borgmatic. Get a cheap storage VPS to store it. You should be able to get a deal for less than $2/TB/month during the current Black Friday sales. Check LowEndTalk for deals. A Hetzner storage box would work great too.
Unfortunately it looks like that one is for Apple devices, whereas I use Linux on desktop and Android on mobile.
There’s some, but I haven’t seen any that have the main features Plex and Plexamp have:
And probably other things I’m forgetting.
Thankfully CGNAT isn’t as common in the USA as it is in other countries. In the US, ISPs generally either offer native IPv4 (most of the major ones), or only use IPv6 and provide IPv4 at all. The latter is the case with a lot of the mobile carriers, especially T-Mobile. Your phone only gets an IPv6 address, and their network uses 464XLAT to connect to legacy IPv4-only servers.
Do you have a CVE for this?
I self-host my emails, but use an SMTP relay for sending. IMO, the interesting part of self hosting email is the storage. Outbound sending is more complex and there’s not as much benefit to self-hosting it.
I use Mailcow and have it configured to use a relay per domain. Email clients use the Mailcow server as their SMTP server, and Mailcow (well, Postfix) handles sending it to the appropriate relay.