this post was submitted on 30 Oct 2026
171 points (100.0% liked)

Selfhosted

63469 readers
460 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Detailed Rules Post

  1. Be civil.

  2. No spam.

  3. Posts are to be related to self-hosting.

  4. Don't duplicate the full text of your blog or readme if you're providing a link.

  5. Submission headline should match the article title.

  6. No trolling.

  7. Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details. Tags [CBH] or [AIP] are required, see the links in Rule 8 for details.

  8. AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post, and find example disclosures here.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 3 years ago
MODERATORS
 

Hi all,

I am running proxmox on a mini PC with a handful of services in my stack. I also run NPM in an LXC to reach my services through my domain name (service.domain.tld).

For my Arr related stuff, I use Usenet, and everything runs through a VPN.

I have three services which are public. Jellyfin, Seer and BookOrbit (for syncing Kobos).

Currently I have no security besides the built in login managers from the services, but I am considering setting up Authentik. I know I'm asking for trouble with my current set up.

I have elderly and extremely tech averse family members who live in two countries other than me, so tech support can be a challenge.

A lot of people suggest running a VPN, but it would be difficult for my family and I don't know how to make it work syncing our Kobos with BookOrbit.

I've also seen some posts about tunneling to a VPS somewhere and users can connect to the VPS without a VPN.

I feel this question has been asked several times, and I tried searching here and on the internet in general, but my knowledge is not good enough to use the right terms and to get something that is idiot proof.

Any suggestions on best practices or links to guides you recommend would be much appreciated. Also, what EU based affordable VPS would you recommend?

you are viewing a single comment's thread
view the rest of the comments
[–] MonkderVierte@lemmy.zip 7 points 1 day ago (2 children)

So the public services are purely for private use, to sync your mobile devices? You can install Wireguard on Android, send them over there. Though for e-reader, since they are Kobos (basically Android), you can trick it to install the app. Or even another launcher/book reader.

[–] neo2478@sh.itjust.works 4 points 1 day ago (2 children)

Kobo uses its own OS, not Android unfortunately. But I just found a tailscale plugin for it, so will try that

[–] Evotech@lemmy.world 3 points 19 hours ago

Install Koreader. Then install the bookorbit plugin

It’s very easy and reversible. And its really good

[–] MonkderVierte@lemmy.zip 1 points 1 day ago* (last edited 1 day ago) (1 children)

Yeah, not "Android" like Amazons' is not Android; all based on AOSP but not certified for Play Store. Or is it depending on the device in Kobo, do they use something else too? The ones i know (Leaf, Note) have the not-Android ROM.

[–] PerogiBoi@lemmy.ca 3 points 1 day ago* (last edited 1 day ago) (1 children)

Kobo runs a light linux software called NickelOS on an esp32 board. No android at all. No ability to instal apks. Its not even AOSP.

One can install a custom OS over top called KOreader which expands its usability and offers tons of community led plugins.

[–] surewhynotlem@lemmy.world 2 points 1 day ago (2 children)

I hate our kobos. The app is shit. Total waste of money.

But this gives me hope. I'm going to play with this.

[–] Evotech@lemmy.world 1 points 19 hours ago

Just install koreader. It really saved my kobo purchase

[–] PerogiBoi@lemmy.ca 4 points 1 day ago

I love my kobo precisely because there's a huge community behind KOreader. Lots of YouTube tutorials, lots of flexibility. My kobo kept dying at like 50% battery and I just assumed it was a bad battery. Turns out NickelOS was trying to cache a book infinitely in the background so the battery calibration was wildly off because it never properly achieved a sleep state when powered down.

I left it sitting for a year and a half. Charged it for a full day to balance the cells, copy pasted the files needed for KOreader, changed a config file so that NickelOS would not cache items in hidden folders, and then threw all my epubs onto a hidden folder called ". books" and boom.

New life in my kobo. I use it daily now. Battery is accurate to 20% (then it sorta doesnt turn back on but whatever). Fair warning though because KOreader is so expansive that its a rabbit hole. UI takes getting used to but the customizability is huge and it runs more efficiently without bloat and you can even use LocalSend to wirelessly push epubs from any device that can run LocalSend to the Kobo so you never have to plug it in again.

I sync book progress from my Xteink X4 pro to my Kobo Clara HD using KOSync and have my own little KOSync instance running on my homelab (but you can just use the public instances if you want).

[–] Appoxo@lemmy.dbzer0.com 2 points 1 day ago* (last edited 1 day ago) (1 children)

Issue:
Most clients we instruct on homeoffice usage with vpns are already unable to remember the workflow: VPN -> (wait until green for connected) -> open work app -> Do work -> close work app -> disconnect vpn.

Now you also may not want to tunnel all traffic (if you don't have a VPS with symmetric Gbit and unlimited traffic) so you'd need to set up split-tunneling and/or limit the apps allowed for the tunnel (works in android).

Honestly? It would be easier to set up a S2S split-tunnel VPN with wireguard on the relatives router.

[–] unique_hemp@discuss.tchncs.de 4 points 1 day ago (1 children)

You can just specify AllowedIPs in the wireguard client config to route only traffic to your services through the VPN, works great.

[–] Appoxo@lemmy.dbzer0.com 3 points 1 day ago (1 children)

Yes. Split-tunneling...
But if you are really hardcore about restrictions and would need to update the profiles it will be a pita...
Scheduling stuff is annoying ;-;

[–] unique_hemp@discuss.tchncs.de 2 points 1 day ago (1 children)

AllowedIPs is a client side restriction that can be ignored anyway, no real security benefit from not just putting your entire network there.

[–] MrTolkinghoen@lemmy.zip 1 points 1 day ago (1 children)
[–] Appoxo@lemmy.dbzer0.com 3 points 1 day ago (1 children)

The user can just edit the wg conf file and remove the restriction where it can and cannot connect to.
The file is not a baked immutable binary

[–] MrTolkinghoen@lemmy.zip 1 points 22 hours ago

Oh sorry I was thinking you were talking about something entirely different. Makes sense, and yes.