talkingpumpkin

joined 2 years ago
[–] talkingpumpkin@lemmy.world 3 points 1 day ago (1 children)

I've not looked into it much yet, but https://radicle.xyz/ seems interesting.

It's kinda a bittorrent-powerd codeberg and it looks like it's worth playing around with (even though it might not get you rid of much bandwidth... IDK how popular it is, but source usually doesn't weigh that much).

[–] talkingpumpkin@lemmy.world 1 points 2 weeks ago (2 children)

Getting the router to actually assign an IP address to the server

You would typically want to use static ip addresses for servers (because if you use DHCP the IP is gonna change sooner or later, and it's gonna be a pain in the butt).

IIRC dnsmasq is configured to assign IPs from .100 upwards (unless you changed that), so you can use any of the IPs up to .99 without issue (you can also assign a DNS name to the IP, of course).

all requests’ IP addresses are set to the router’s IP address (192.168.3.1), so I am unable to use proper rate limiting and especially fail2ban.

Sounds like you are using masquerade and need DNAT instead. No idea how to configure that in openwrt - sorry.

[–] talkingpumpkin@lemmy.world 0 points 4 weeks ago (2 children)

A NAS is just a computer and TrueNAS is just Linux (ok, TrueNAS CORE is Bsd).

You can run zfs on any machine: they recommend loads of RAM for optimal performance, which you don't need at home (or at work, unless your job is running a data center).

You can choose from a number of FOSS NAS-specific operating systems, plus all linux distros (since you post here, I'd assume you either can or aim to administer a home sever?)... why would you go with a proprietary OS?

There are several FOSS operating systems for network equipment too (keyword "NOS"), but as far as I'm aware none that work on small soho/edge switches. OpenWrt runs both my router (mikrotik) and WAPs (tplink), but the two 8-port switches I have at home (also tplink) run their proprietary firmware.

[–] talkingpumpkin@lemmy.world 9 points 1 month ago

Don't tear down your server just to have fun - setup a vm (or get one of those minipcs), call i "playground" and have fun there.

Redo your server after you've tried different things, and only if you feel like you found something that is worth it.

Experimenting with different distros can teach you a lot (especially if you try very different ones - mint and debian aren't that much different) and I do recommend you do it, just don't do it in production :)

[–] talkingpumpkin@lemmy.world 16 points 1 month ago

Honestly, do we need a legal definition of what "self hosting" is and what isn't?

I didn't see your post and in the modlog I can only see it's title: "Apparently I'm into Web3, says Netcup" [ed: Netcup is a hosting company].

If your post was discussing stuff specific to your hosting provider, then the mods did well in removing it - if you were talking about things that would have interested this community, then they have probably been too rash in removing the post.

[–] talkingpumpkin@lemmy.world 4 points 1 month ago (4 children)

IDK how much I'd trust them with tech stuff (not much, definitely). However I don't see how encrypted storage may become an attack vector?

I mean, they could clog up the HDDs with crap, but they can already do that via non-encrypted network storage (and in several other ways).

 

I'd like to give my users some private network storage (private from me, ie. something encrypted at rest with keys that root cannot obtain).

Do you have any recommendations?

Ideally, it should be something where files are only decrypted on the client, but server-side decryption would be acceptable too as long as the server doesn't save the decryption keys to disk.

Before someone suggests that, I know I could just put lucks-encrypted disk images on the NAS, but I'd like the whole thing to have decent performance (the idea is to allow people to store their photos/videos, so some may have several GB of files).


edit:

Thanks everyone for your comments!

TLDR: cryfs

Turns out I was looking at the problem from the wrong point of view: I was looking at sftpgo and wondering what I could do on the server side, but you made me realise this is really a client issue (and a solved one at that).

Here's a few notes after investigating the matter:

  • The use case is exactly the same as using client-side encryption with cloud storage (dropbox and those other things we self-hoster never use).
  • As an admin I don't have to do anything to support this use case, except maybe guiding my users in choosing what solution to adopt.
  • Most of the solutions (possibly all except cryfs?) encrypt file names and contents, leaking the directory structure and file size (meaning I could pretty much guess if they are storing their photos or... unsavory movies).
  • F-droid has an Android app (called DroidFS) that support gocryptfs and cryfs

I'll recommend my users try cryfs before any other solution. Others that may be worth it looking at (in order): gocryptfs, cryptomator, securefs.

I'll recommend my users to avoid cryptomator if possible, despite its popularity: it's one of those commecrial open source projects with arbitrary limitations (5 seats, whatever that means) and may have nag screens or require people to migrate to some fork in the future.

ecryptfs is to be avoid at all costs, as it seems unamaintaned.

[–] talkingpumpkin@lemmy.world 1 points 1 month ago (1 children)

I don't remember them asking for any ID. Then again I gave them my real name/address and I payed with my credit card so... it's not like they can't confirm it's me.

[–] talkingpumpkin@lemmy.world 2 points 1 month ago (2 children)

(I missed the first part so I'm not sure I follow)

How are the the subdomains resolved? If you registered them on a public DNS that might be what leaks them. Otherwise... maybe your browser?

[–] talkingpumpkin@lemmy.world 2 points 1 month ago (3 children)

I moved to infomaniak because registering domains come with a free mailbox (or at least they used to - IDK if it's still like this).

It works fine with lego (as should any other supported one).

[–] talkingpumpkin@lemmy.world 3 points 1 month ago* (last edited 1 month ago)

IDK where I've read that... should have double checked before posting, my bad.

Quick fact checking:

US police kills some 1,281 people last year (wikipedia).

1,281/340,110,988*100,000 gives around 0.38 police killings/100,000 people, which is below homicide rate in EU.

I couldn't (be bothered to) find out what the overall European homicide rate actually is (it also depends on what you count as "Europe"), but Germany is at around 0.8, France at 1.8, Italy at 0.57, Spain at 0.9 and Poland at 0.8 (these are the five most populous countries). So... let's guesstimate it at around 1? (numbers are from this random source).

We can conclude that US policemen are roughly 38% as deadly as European criminals (if it wasn't clear, this last statement is a joke)

[–] talkingpumpkin@lemmy.world 21 points 1 month ago* (last edited 1 month ago) (6 children)

TLDR: Protesting or resisting privately inside your house does not lead to social change and is not the most rational way of protecting yourself if you feel threatened by your government.

Self-hosting is not "resistance": at most, it's prepping for nerds, with computers instead of guns.

Self-hosting is not even a rational/efficient way of making a statement. If that's what you want, it's far more efficient to follow the established tradition of declaring you are moving to Canada and not following up with actual actions.

Don't get me wrong: I can relate to the nerdy way of coping with the ugliness around us (I say "us", but thankfully I don't live in the US), but - the way I see it - it's that your society that needs change, and self hosting won't help with that.

Frankly, the shit you US people are putting up with is unreal.

It has always been (~~US police forces kill far more people than the overall homicide rate in Europe - read that again and pause a second to think about it~~ this isn't true - see comments below), and it's just getting worse.

If you feel threatened you can essentially respond by fighting, fleeing, or cowering.

If you wanna FIGHT (this is what "resistance" is about), try to use whatever power you have and apply your energies to bring actual change. If you don't feel comfortable acting outdoors, this could include lending your nerd skills to protesters or (nonviolent) resistance groups. Heck, even being a keyboard warrior is more useful to changing society than being a hobbyist sysadmin.

If you wanna FLEE, just leave the country. Honestly, there are better places to live than the US, and (if you have or plan to have any) better places to raise your children.

If you wanna COWER, then be a prepper or a self-hoster or whatever, but be aware that, while misrepresenting your reaction as "resistance" may make you feel more heroic than you are, spreading the misrepresentation can also lead others to cower instead of fighting. Is that what you want?

[–] talkingpumpkin@lemmy.world 1 points 2 months ago

By that reasoning, backup isn't redundancy because you'll lose your data if the backup gets corrupted while restoring.

That said, there's nothing wrong in redefining "redundant" to mean "having two or more duplicates"... you should however tell people if you do, to avoid misleading people that assume the dictionary definition.

19
submitted 5 months ago* (last edited 5 months ago) by talkingpumpkin@lemmy.world to c/europe@feddit.org
 

Delusional.

 

A lot of selfhosted containers instructions contain volume mounts like:

docker run ...
  -v /etc/timezone:/etc/timezone:ro \
  -v /etc/localtime:/etc/localtime:ro \
  ...

but all the times I tried to skip those mounts everything seemed to work perfectly.

Are those mounts only necessary in specific cases?

PS:

Bonus question: other containers instructions say to define the TZ variable. Is that only needed when one wants a container to use a different timezone than the host?

 

Prometheus-alertmanager and graphana (especially graphana!) seem a bit too involved for monitoring my homelab (prometheus itself is fine: it does collect a lot of statistics I don't care about, but it doesn't require configuration so it doesn't bother me).

Do you know of simpler alternatives?

My goals are relatively simple:

  1. get a notification when any systemd service fails
  2. get a notification if there is not much space left on a disk
  3. get a notification if one of the above can't be determined (eg. server down, config error, ...)

Seeing graphs with basic system metrics (eg. cpu/ram usage) would be nice, but it's not super-important.

I am a dev so writing a script that checks for whatever I need is way simpler than learning/writing/testing yaml configuration (in fact, I was about to write a script to send heartbeats to something like Uptime Kuma or Tianji before I thought of asking you for a nicer solution).

view more: next ›