What's up, selfhosters? It's selfhosting Sunday again!

Finally found what's causing my laptop's DNS servers to change automatically in the background. It was the systemd-resolved FallbackDNS setting. Disabled it in a config and now I can access all my custom DNS names.

Hi, I finally set up tailscale on my raspbery pi, in exit node mode so I have access to my whole network. I also set AdGuard an the very same pi with dhcp. I finally bought home assistant voice device, didn't arrive yet, but cant wait to experiment with it.
I still have to setup Authelia for sso, I want to setup a device on my network as a (proton) vpn gateway (zero knowledge right now) and then I want to start learning about pfsense to properly segment my network (into subnets) and have more control.

Went through and verified that a number of things were backing up and updating correctly. I feel a little less weight on my shoulders knowing things are working as they should.

Not really self-hosted, but I set up obsidian with syncthing and am going to transfer all of my notes from book stack to it and let bookstack be more organized documentation and obsidian to be a big scattering of notes and tags and such. I tried it with bookstack, but the flow was too much of a barrier for me to use it consistantly

Set up Traefik. Had it working with authelia to forward requests to authenticate then to the destination.
Friend mentioned caddy and a plugin that means all you need are docker labels. So I spent the next 3 days setting up caddy.
Accidentally overwritten my compose file and had to restart.
Luckily my authelia was saved elsewhere. But after fixing it
I ran git init and git add .
I shall be a fool no more.
Anyways, now I've got cloudflare blocking all requests outside of the UK, as well my friends and I don't live outside of it. Set it up such that caddy uses the DNS challenge with cloudflare API key.
So now I can set a DNS entry for internally only. E.g. internal.example.com resolves to a private address for tailscale.

Was able to put calibre web on nixos. Still trying to build a package that's not available (piped), but boys is it hard to package java stuff for nixos...

Configured changedetection.io to notify me when my usual bus is delayed or canceled.

I'm working on self-hosting my own LLMs.
I realized there are things I wanna talk about and research but I don't want to send it to open AI. Frankly I feel gross about how much I've sent to open AI. My desktop is a beefy gaming rig that I don't use for gaming much. I have a 20thread core, 64gb ram, an Nvidia gtx 3060 and 5 spare TB so why not.
I keep a few ollama models downloaded and I'm slowly getting to know them and what they can do. Gemma seems to answer the fastest so I've been using that. Deepseek is like the reasoning button on chatgpt.
I use openai-whisper to transcribe meetings I record using OBS. It's really slow so I have a cronjob transcribe all my meetings for that day overnight.
Open Web UI is a fantastic LLM frontend. It provides tools, rags, web searching, and model ranking all as a simple to use UI.
My desktop has a Wireguard server which makes it easy to use my OpenWebUI on my phone.
Now I want to work on giving the LLM access to my Google calendar so it can create reminders for me. I'm sick of forgetting to think about remembering to do things so I hope if I can just ramble at the LLM about what I'm doing or what's on my mind it can organize my thoughts. What else are these LLM actually for?

How the hell do you get Wger working on http only? I always get the CSRF error even after trying their recommendations

Latest thing is my server was hard locking up randomly every couple days. Finally thought to check IPMI and it was triggering a correctable ECC error on a specific stick of RAM.
I figured maybe the first couple errors were correctable by the ECC RAM but then they just got worse and caused the lock up.
Pulled the 2 sticks in that pair and so far so good. I'll survive just fine with the remaining 192GB of RAM lol.
Also switched from my old Dell box with Opnsense to a Linksys MX4300 running OpenWRT, saves me about 20W and its fun to try something different.

I finally dealt with the AI scrapers hammering my Forgejo instance - https://jade.ellis.link/blog/2025/05/18/actually-stopping-forgejo-ai-scraping Hopefully next week I'll be able to get back to actually programming Continuwuity rather than fighting fires.

I started this about a month ago, absolutely no idea what I was doing, and in that short time this little box has grown a ton. Got the basics for cloud storage, jellyfin with the arr suite, navidrome to replace spotify/tidal, etc. Got my scanner going right into paperless, finally starting a budget planner with actualbudget, even set up homebox to maybe eventually keep track of my collections of random bullshit. Spent 3 days fighting with Wireguard and gluetun to make a single VPN connection that'll hook me into my LAN but also output all my traffic through Mullvad, using pihole as my DNS - I should get Unbound set up at some point too but that's a project for another day.
Today I learned about homeassistant, and while I'm not one to care about IoT shit or whatever, just dabbling with NFC tags for the lights and such has been pretty neat.
This week I'm getting a second machine in that I'm going to use exclusively as a NAS and stop relying on USB external hard drives.
I really just wanted a little 24/7 Bob Ross box with a bit of cloud storage, and this project blew up a lot more than I thought it would LOL
- Bob Ross box???
  
  Grab the entire series, load it up on the tv, and let it rip all day

Hello! I recently deployed GPUStack, a self-hosted GPU resource manager.
It helps you deploy AI models across clusters of GPUs, regardless of network or device. Got a Mac? It can toss a model on there and route it into an interface. Got a VM on a sever somewhere? Same. How about your home PC, with that beefy gaming GPU? No prob. GPUStack is great at scaling what you have on hand, without having to deploy a bunch of independent instances of ollama, llama.ccp, etc.
I use it to route pre-run LLMs into Open WebUI, another self-hosted interface for AI interactions, via the OpenAI API that both GPUStack and Open WebUI support!
- Oh that's dope. How many hours are you running? Do you also use them for things like encoding or something like that?

This week moved all my vps's to nixos, so am now able to use one flake for my desktop and all my vps's which significantly lowers down the time I need to manage my vps's.
Nowto move my proxmox homelab server ( an old desktop pc I bought recently ) and all my server's/devices witll be running nixos.
EDIT: An issue I'm thinking about is getting a "proper" server. Not a server like a server rack server, but a mini pc or something along those sides wbich would be a lot stronger and a lot more power efficient than the current 10+ y/o desktop pc I'm using currently.
So would like some reccomendations on that front, like what are some good mini pc brands and mini pc's that I could have raid seted up on for nas or good budget parts and case to make one myself.
- Hey! Another nixos user 😁 What are you using for your VPS? nixos-infect? nixos-everywhere?
  As for mini PCs, a friend bought one from Minis Forum and quite likes it. But if you want to support the opensource ecosystem, there are tuxedo computers and slimbook. There's also starlabs byte.
  Take your pick :)
  Anti Commercial-AI license
  
  I'm using nixos-anywhere to install and then deploy-rs to deploy updates to nixos vps's.
  Also using agenix for managing secrects for the services so that I can easilly have them all in a public repo, so that other's could take a look and take inspiration.
  My nixos flake url if you wan't to take a look.

Today I learned that for some reason some DNS servers don't like SRV records, so had to troubleshoot it when people were unable to log onto my Minecraft server that is on a non-default port.

Having electric stability issues this week in Bangkok - several 2-3 hour outages, which are too long for a UPS to cover the gap. I have several mid range but older PCs running docker, virtualbox, etc for various things including a postfix server for the family email, immich, QBittorrent, pihole, paperless, huly, postiz, a Minecraft bedrock server, a flightradar24 ads-b collector, and a variety of other homegrown projects.
Thinking about getting some or most of this over to a service like hetzner, perhaps even splurging on a baremetal dedicated system.
Recently I've been reading about/trying to learn qemu and proxmox, but don't understand them yet. Is that where it's at for managing a bunch of your own VMs? Or kubernetes/k8s?
I've been a little out of the loop for a few years and of course coming back up to speed IT wise judge take weeks. Looking for recommendations on offloading my home stuff to a cloud that I control.
- proxmox
  You will enjoy Proxmox. When you get it all jammy, check out the Proxmox Helper Scripts: https://community-scripts.github.io/ProxmoxVE/
  
  Hey that's awesome! thank you for the share. Planning to install proxmox this weekend and give it a try.
- Proxmox runs Qemu under the hood. It's the current favorite for VM management.
  I wouldn't bother with k8s unless you're deploying services in high availability, or groups of related containers.
- Thinking about getting some or most of this over to a service like hetzner, perhaps even splurging on a baremetal dedicated system.
  If I may, I find LUXVPS to be quite capable and responsive hosts.
  Black Luxury Deal #1
  
  4 vCores (Xeon Gold 6150) 26 GB DDR4 RAM 150 GB Raid 1 NVMe 1 Gbit internet speed | 40 TB Traffic 1x IPv4 1x /64 IPv6 3.2Tbit Premium DDoS Protection 24/7 Ticket Support 4 Backups For ONLY 10€/Mo (recurring)
  I've never used Hetzner, and I don't know what you are hosting, but I'm sold on LuxVPS. I also use Contabo, and Ethernet Services. The latter would indeed be bare-bare-metal as there are no frills. However, for a test server and for $35 a year, it works.
- K8S is a whole different approach and I find it to be a lot more complex, but you would not need virtual machines. If all your applications are running in containers anyways, you could consider it. Finding a good solution for persistent storage is probably the most important design decision.
- I've used a RV/Marine deep cycle battery attached to a UPS before, that would certainly give you enough for 2-3 hours on most setups.

I’m currently trying to figure out why my email server got blocked by Proofpoint and they refuse to talk to me. Really about ready to give up on email after self-hosting it for a decade with few problems.
- Check RBLs a lot of times services just use one of those, and they can be flaky. Usually, you can fill out a form and get reinstated.
  https://mxtoolbox.com/blacklists.aspx
  
  I’m not on any of those blacklists, luckily. I guess Proofpoint doesn’t publish theirs. At least iCloud and Gmail both use them. I saw one hint that they may require mail servers to literally have the word “mail” as the subdomain, so I’m working up the courage to mess around with my perfectly working DNS.
- Oh that sucks! One would think that after that long, it'd be somewhat established.
  
  RIGHT?!
- There is still the relay through the cloud route (SES, but also at least Scaleway)
  
  Part of me thinks if I have to pay for a relay service, I should just pay for hosted email. But I’ve definitely been considering it!

For some reason Grafana started to sync roles with my IdP (google) and now my own user keeps getting a read only role, so I decided to take this opportunity to finally move away from google and start hosting keycloak instead.
It was a busy week so I could not get the time to finish it yet.
- You may also have a migration path by hosting keycloak and add Google as an Identity Provider. Gives you much more flexibility and control this way
  
  Thanks for the tip! I didn't know that setup was possible.

I set up my old laptop as a home server, with a vps as reverse proxy via nebula. It runs Mint - strange for a server but that's so it can still be a laptop. Syncthing keeps it in sync with the more portable laptop.
The 'server' now runs immich, which I can use super fast from the laptop itself; a bit slower if I connect with nebula over the LAN (it's firewalled off from the LAN generally); or still pretty decently via the VPS on Https - and that VPS proxy means the family phones can connect with the apps easily.
Immich runs in podman, with some help from Lemmy about how to set that up.
And filebrowser makes it easy to share files or allow uploads with/from family around the world. With caddy on the VPS, ufw on the server and nebula in between, it's really easy to add in something like filebrowser on a new subdomain.
Next is to try some other podman containers, or set up mqtt and owntracks.
- How are you finding immich? I got it running on Ubuntu, and it's fine on the server, but the android app keeps lagging and crashing.
  
  I'm liking it. I've had no problem with the Android app, but then I don't use it a lot, nor do my 10k pre-shrunk photos compare to some people's collections here.
  My only complaint is that two accounts don't share great if you want to share face data etc. or to have a shared album show up in each others' timeline.
  Edit to add: Also because it lacks editing, I think my new workflow is going to have to be keep the photos separately still and edit/sort them my old way, then put them back in an external folder. I still want to do external folders generally because I still want my photos organised my way on the file system, but I was hoping to gradually sort/delete/edit in Immich to make the workflow more relaxing. Maybe I'll still do some of it - deleting and I think it can rate - but I haven't worked that out yet.

I've installed coraza web app firewall with OWASP ruleset this weekend. I must admit that it wasn't as easy as I expected it, but it now (mostly) works. I had to give up with nextcloud though.

My biggest shortcoming at the moment is my NAS is also my gaming PC. It's pretty inefficient to have that on all the time. But I haven't had the time to build a dedicated NAS.
- I'm putting together a pretty simple one this week. Got a used HP Elitedesk G4 SSF for around $150, already have 2 8TB external drives lying around that are easy enough to shuck and slap into it. Should be pretty easy to just slap TrueNAS Scale onto it, set up a mirror with the 2 drives, and be good to go for a while.
  I'll definitely need more space down the road and this thing can't fit more than 2 drives without some modifications (3 is doable, but 4 will take some 3D printed parts which I believe someone's still working on fine-tuning). But it's good enough for me for now, still got 2.5TB I'm not using.
  If I thought about storage a bit more before starting this project, I probably would've just gotten the same SSF but with some slightly better specs to use as the entire server, rather than running 2 different machines, but oh well.
  Edit: Slight change of plans, got a 12tb drive free through a program at work, so gonna go with UnRAID instead. The license fee is a bit disappointing but it seems to suit my needs better, and being able to mix and match drives of any size at will is pretty nice
- Yeah I had your idea back when I wanted a nas. I didn't have the time and just bought a synology knowing it wasn't the best option and was aware of the possibility of enshitification. Now that they've enshitified, I can't really recommend them any longer. So far it's been good but I'm still looking for options that are quick and easy to set up. Or maybe I'll grit my teeth and start building one from scratch.
  
  I'm perfectly happy to build my own NAS with NixOS and ZFS on it. I think it's mostly a matter of getting the right hardware.

Sweet!
What's up is everything I've been running and down is what I haven't.
not working
I haven't been able to get friendica to connect to Maria DB, so I'll eventually try just MySql. Grafana isn't running bc I would need to change a lot of things to get an exporter into each container and the truenas apps don't really allow that configuration - fine if you have docker compose though, which I've started doing more and more.
new
I just got up and running with Stirling pdf, a free (and paid) PDF editor. That looks pretty sweet.
But I'm now also using 15GB of the 32 on the system, which is still plenty for Arc cache for me
what I want
I want to rent a VPS to host various fediverse apps, probably Lemmy, pixelfed, and write freely to start, for the nomad/expect communities. I've been looking at netcup and they have some decent arm offerings.
I'd like to put Talos Linux on it so I can get some kubernetes experience. They have a good sized server for €10, so I could expand to add a DB server or one specifically for logging and metrics.
I was looking at Hetzner, but I've read that their block storage is super slow and causes timeouts on DB.
Of course, can I even run these apps on arm? I guess I gotta find that out.
One thing I'd like to do is make a web page that makes signups super easy and would create an account on all services, ideally. Not a huge deal of that isn't reasonable, but it'd be nice to allow doing it once rather than multiple times. If I could get sso, that'd be good, but I don't know how supported that is.

I need to get a new VPN setup. Been using OpenVPN through OPNsense for years but I’m fed up with the abysmal performance of the OpenVPN client on iOS. Open to suggestions but it has to be fully self hosted.
- Wireguard is where it's at.
  
  Good on iOS too, albeit a bit battery hungry if you route 0.0.0.0/0 and ::/0
- wg-easy is what you want
- I have running OPNsense as well and was looking for OPEN VPN on it as well, but I'm not decided yet. I wonder if Android clients are any better.
  
  I'm running OpenVPN on pfsense and am using the android app.
  I've got a stable 150mbit/s, depending on carrier coverage.

A couple things I've been working on
First, I spun up a larger VPS to consolidate two smaller ones. This time I dockerized almost everything. Still a docker newb, but karakeep, redmine, mbin, lemmy (still deciding which I want), davical. Asterisk and postfix/dovecot are probably gonna stay on the vps root. I'm using zfs and compression. Interestingly, the postgres database that everything is using seems to get better compression than the mail spool.
A couple weeks ago I picked up a NetApp 7 bay disk shelf for $30. It uses fibre channel (AT-FCX) controllers and I've never used that before. I grabbed a $7 FC HBA (QLE2560), a 2m cable and an m2-to-PCIe adapter meant for an eGPU. The idea is to see if I can't get the RK3588 board I'm playing with to see it. I did something similar with a $50 Dell 12 drive bay and my old C6100.

No new devices, but I migrated my homelab from an intel nuc to an old recycled HP z240 with a p1000 gpu I got for free. I had Nextcloud and jellyfin on it, but jellyfin gets the majority of the use.
I then added a gitea docker container to my server for my personal projects. Then I configured a miniflux container with some of my favorite RSS feeds for a lightweight way to view my feeds on my computer.
I would like to get pihole configured again in a docker container(I have only ever run it on a raspberry pi), but I have small children and a baby and they make it hard to find extra time in the day.

I'm still trying to get a good backup strategy. I am currently using Duplicati but I cannot get the before script execution to work. I will eventually look at Kopia.
What kind of hardware are you using for a mini lab? I want to switch from a raspberry pi 5 to a small form factor Intel based system so I can run Proxmox. I was looking at the Lenovo m920q or an Optiplex 79xx series machine.
Do you have any recommendations for backups or the hardware switch I mentioned?
- Have a look at Backrest for Restic. It works great with pre/post scripting and supports healthchecks for monitoring status and stats.
  Also is a nice easy to use WebUI which is great for servers.
  
  I'll look at this again. I had it before and did not stick with it though I don't remeber why now.
- I use cron schedules to run scripts that backup my important stuff to s dedicated backup drive, then copies the backups to a different external drive, then upload the backups to a dedicated backup cloud storage account. Then it deletes any backups older than a month.
- If you do make a switch to Proxmox, then Proxmox Backup Server is where it’s at for backups. Its de-duplication feature is incredible. I backup all my Proxmox VMs/LXCs with it, as well as my non-Proxmox hosts (laptop, etc.), with proxmox-backup-client.
  Personally, I’m using a few of those tiny Beelink PCs (a couple Mini S12 and an EQ12) with the N100 processor, as well as a couple larger rackmount PCs I built for situations where I needed to add an HBA or some other PCI-Ex device. I do recommend something like a Beelink before building, though - they run Proxmox fine, they’re inexpensive, efficient, quiet, and each one can run a handful of VMs.
  
  Yeah, I heard about Proxmox backup and that sounds really nice. Love the idea of being able to take a snapshot before any major changes to a VM and then if it goes south restore from snapshot very quickly.
- I don't know Duplicati or Kopia, im mostly just using VM snapshots as backups. I store them in an NFS Share on my NAS.
  I just posted my Minilab, check my history - I'm also using tiny Lenovos. m920q should be able to do anything you want it!

I finally finished setting up my Nebula network! An overlay network, as opposed to a true VPN, but excellent for flexibility and remote access. For anyone wanting maximum control over your network with excellent performance, I highly recommend it.
Check out apalrd's blog for a great tutorial if you're interested.

i just moved almost all of my containers (except for my omada controller) to my VM running fedora and podman off my VM running ubuntu and docker. why? i was in a product sales call (being sold to) and didn't have any actual work tasks to do during that time. Now there's an additional VM on the network.
Trying to decide if I'll move omada as well or just shift everything back. I shouldn't have fiddled with the stack while I was bored. A video game or something would've been a better idea.

DOWN:
I'm currently fighting with my OliveTin config file. I added a simple new config for a button action and ylthe whole thing just shit the bed. Now OliveTin won't load at all. Even after removing the new config. Stupid yaml.
UP:
After reading the Jellyfin docs and their Hardware Encoder Quality section which states
Apple ≥ Intel ≥ Nvidia >>> AMD*
I decided to spin up a test server on the m1 mini that's been sitting unused in my basement for a couple of months now to see if I can get better performance out of jellyfin on the m1 vs where it's running currently, which is on an i7 Intel that's going on 10ish years old now.
I also spun up baserow and directus containers to see which one I want to use for my database needs.

I am re-re-factoring my plans for homelab 3.0 and the migration to it. Hardware budget is non-existant so I am trying to figure out how to do everything with what I already own, while re-organizing to better use what I have to make some room. Adding a few sticks of RAM and replacing some older cat5 are all I will do this year.

Anyone have a good guide on setting up a reverse proxy that works with tailscale? Not sure if there's anything specific I need to keep in mind or if it would just be setting up the reverse proxy like normal. Thinking of using either traefik or caddy.
- It should be the same setup regardless if you're using a VPN or not.
  Having used both I generally prefer traefik.
- You're gonna need to provide more detail on what you're trying to do
- Might look into the pangolin project if what you're trying to do is expose services from your home network over wireguard to a reverse proxy on a vps.
  The software suite is basically wireguard, traefik, and auth middleware wrapped in a trenchcoat. Much simpler than rolling your own implementation, but there has been recent controversy with the project over locking "basic" existing features behind a paywall after the project got popular, though after public backlash they've backpedaled on that iirc.
  Edit: Just realized you said tailscale. Above recommendation might be a deal breaker depending on your reason for wanting tailscale specifically
  
  All good, thanks for the recommendation. I'm using tailscale as I currently don't want to expose anything over the Internet and also don't mind tailscale being a freemium service. I might still look at pangolin just to expand my knowledge.
- You can restrict Caddy access to use your tailscale. For instance in your Caddyfile:
  For tailscale ip range:
  
  myverycoolserver.duckdns.org { @allowed { remote_ip 100.64.0.0/10 # Allow Tailscale IP range } respond @allowed 200 # Allow access respond 403 # Deny access for others reverse_proxy localhost:YOUR_SERVICE_PORT # Your service configuration }
  For specific tailscale IP:
  
  myverycoolserver.duckdns.org { @allowed { remote_ip YOUR_TAILSCALE_IP # Replace with the specific Tailscale IP } respond @allowed 200 # Allow access respond 403 # Deny access for others reverse_proxy localhost:YOUR_SERVICE_PORT # Your service configuration }
- I have caddy on a vps that serves as a tailscale exit node and also reverse proxies over the tailnet. My pfsense router is also in the tailnet and exposes some subnet ip addresses to the tailnet. So for example I have public domain watch.example.com hits my caddy and gets proxied to internal IP 192.168.31.48 which is my jellyfin docker.

Tried to use my fifteen year old intel atom home server for 4K videos with Jellyfin. Probably could have predicted that, but it was veeeery laggy 😄 no way that old of a processor can transcode 4K videos in real time. It is useful for backups though.
- Does it have QuickSync support? If it does it might be able to handle a few 4k transcodes.
  Alternatively I wonder why the video is needing to be transcoded in the first place, maybe you can get it playing natively.
  
  It was one of the cheapest variants of intel processors, so I highly doubt it has any sort of transcoding support. I have resorted to using my desktop pc for streaming, since it has a much better CPU.

Up: My unraid server with media library, emby and my kids Down: the fiber internet line into the house that the contractor working on our siding snapped. No one is upset so the system is working.

Trying to get navidrome routed through Traefik.
I think it's rejecting it as an untrusted proxy because forwarding the ports locally works.
Also working on getting Traefik up and running on a TuringPi cluster to eventually move my workloads over to it.
- I have navidrome running in k8s behind Træfik. Do you want to take a look at my environment variables for navidrome? I haven’t configured anything on Træfik
  
  Sure thank you 🙂

Everything is running and I'm not making many changes because work got hectic. I have a few projects I'd like to tackle once I get time:
finish migrating to podman
get a new drive to test migrating to microos
get more media to finally eliminate Netflix (SO is still clinging to a few shows)
find a smaller box for my NAS - currently in a massive ATX box, but I don't want to pay an arm and a leg just for space savings

Finally got it working just in time for life to implode again so I just powered it down and unplugged everything again.
This time I'm probably just gonna huck it out a window or into the trash
- mood

I recently setup a full matrix server. What I am currently worried about is my server. I am currently shopping for a used dual Xeon server. I am hosting close to 40 docker containers on 2 1 liter PCs with very low specs. I would love to bring it all in house to a single server with a separate NAD which I do have currently holding 60 terabytes of storage space.

Currently rewriting my homelab into terraform and adding some redundancies using cloud environments, in case of power outages or network issues.

Currently in a holding pattern because, while I got RAM & SSD for a new-to-me "1-liter" server before tariffs hit, I don't have the server itself nor any money to buy one, despite looking for 9th or 10th gen Intel which will cost me only $120 to $150 barebones.
Money to buy one is not coming in because the place where I live has nonstop noise & activity and I don't have a separate room or any door I can close, which severely limits my ability to work as I have auditory hypersensitivity and an absolute need for solitude in order to recharge enough to think. 🤷🏻

Been spending some time with podman, but ran into some issues with denied access on a bind mount. Messed around with acl for 30 minutes or so until I realized selinux is a thing.
So, now I'm learning selinux. I'm a long time ubuntu guy, but just now adding Rocky to my setup.
Immich is UP and even my wife likes it, now I'm slowly adding her 100gb library to immich. Kinda fun going through all those old pictures.
Proxmox Backup Server is DOWN. I've got a synology that boots at 11pm for my backup to use it as NFS share, but PBS won't auto mount that darn NFS. Works fine with PVE backup.
- Have the same problem with PBS and NFS. Have to turn off the PBS container, delete the .lock file in the NFS directory, then boot up PBS. Thinking I'm just going to use a local directory instead of NFS

I finally bought a tiny PC to replace my aging APU border router/firewall (OpenBSD), so I'm trying to wrap my head around building a router currently inside the network that it will be protecting.
I have Debian installed as hypervisor, Incus, and sticking with OpenBSD for the firewall. pf makes too much sense to me too switch to firewalld. I'll also move the network-related containers off my main lab host once this is up and running.

I have a question on top of my matrix setup. Has any one integrated VoIP? I am trying to bring all communication in house.

I installed Jitsi Meet on my YUNOhost server and am very impressed. It works really well and needed basically no setting up after installing.

Trying to get the right combo of iptables rules to shuttle traffic from vps to home lab server (as I think I'll need to do once my ISP upgrade puts me behind CGNAT for the first time...
Got it working sorta, but I didn't like seeing my vps private link address instead of the remote in logs.

Weirdness: My Authentik instance had a PostgreSQL upgrade prerequisite in order to update it.
I'd followed instructions 3-4 times completely unsuccessfully and had to keep reverting to backup.
So, I gave up for a couple weeks and left it be in order to get over my frustration.
Yesterday, I followed the instructions again. As far as I can tell, I did nothing different than I'd tried previously and it worked first try and then I was also able to upgrade Authentik.
NOTE: The instructions aren't exactly difficult! So, I don't see how I'd have gotten it wrong!
- NOTE: The instructions aren’t exactly difficult! So, I don’t see how I’d have gotten it wrong!
  Dude, don't feel pregnant. It took me an embarrassingly long time to wrap my noodle around Caddy. Seriously, I just couldn't grasp what was going on in the Caddyfile. Then, after extensive trial and error, I happened upon one tutorial that changed everything. Now it's so simple for me, but at the time, I felt like a complete dumbfuck.
  
  It's always crazy how that happens sometimes and after weeks of banging your head, everything just 'clicks' when you're exposed to the information in the way that works best for you!
  Dude, don't feel pregnant.
  Context clues, I assumed this autocorrect was some variation of crazy/bad/dumb? :-D

I know next to nothing about using the command line, so I’ve been relying pretty heavily on ChatGPT to set my stuff up and so far it has reliably helped me overcome every issue. The problem is, of course, that I often don’t even understand what the issue was in the first place so I don’t even know if the fix that the ai spits out is, let’s say, correct. I don’t really want to become an It expert, I just want to be able to host some services on my own to depend less on corps, is it alright if I continue to rely on the AI? Or do you guys think that I just have to learn this stuff or else I might mess up?
I don’t have great security concerns btw, my ISP doesn’t allow port forwarding, so I access my server exclusively though Tailscale.
- I love Tailscale.
  The more you learn with the command line the more interesting stuff you can do.
- Most of the stuff will somewhat work, but you'll introduce side effects sooner or later by using commands that might work but are not the proper ones and alter unrelated things. At some point those will likely bite you and you have no idea where it's coming from. I'd suggest to check at least what the commands you are copying are doing.
- I'd encourage learning. The more you understand the better you can control your data and maintain your services. You don't need to be an expert but I'd encourage working towards relying less on gpt.
- I've had some amusing mixed experience with ChatGPT for this. When I asked about iptables rules to restrict podman, it was great. About podaman quadlets, though, which I first misspelled 'quartlets', it completely made it up, and even sent me a fake link to nonexistent documentation when I challenged it!
  it's more helpful if you ask the right questions
  and its answers often give you ideas of what to google
  Old stuff that has been written about many times over is more likely to get a proper answer
  sometimes the gist of a wrong command/answer could still help me understand what to do with the right one
  Try to understand whatever you use from AI. At least understanding the general picture of what it means, and a basic idea of "this flag is for this; this option is for that". AI can also help you with that understanding, but again beware of it completely making up something logically coherent but wrong.
  
  Yes this happened to me as well, I don’t remember what I was talking about but I remember I made a typo and it just ran with it as if it was a real thing. I let it keep going to see if it ever realized it was talking about something that didn’t exist but nope it kept going until I pointed it out.
  I ask for it to explain what the command did and I did manage to wrap my head around a few concepts but in the end I feel like I’m trusting it to not insert any vulnerabilities into the system, and I don’t like that. Mistrust is the whole reason I’m doing this. But yeah I’ll pay close attention and maybe even ask all the implications of he changes we make.
- What you can probably do to build some knowledge if you're going to be using AI anyway is ask it to explain some of the concepts to you. You also have the ability to ask clarifying questions about anything you don't understand.
  
  Yes I do that, and it does help me a lot to understand what I’m doing it’s just I’m a top down type of guy. Like I don’t like messing with anything unless I fully understand it, which often makes me very unproductive. I decided to not be that way with this self hosting thing because I realized I would never get around to it with that mentality. Better to break shit as I go.

My problem is that I'm moving in the not so far future and I don't know where to put my server. Physical security is important and if someone gets into my house, takes the computer and leaves, it'll be worthless due to encryption. But if it's in somebody's datacenter (co-location or whatever), they could be forced to monitor my traffic, tamper with my system, and I'd have to entrust the key to somebody in order to boot the system and decrypt the drives should it restart for an update or for any other reason.
I'm considering asking a friend to host the homeserver and reimburse them for a better internet connection (fiber) + electricity costs. But I'm not sure they'd be up for it.
How would you solve the problem?
Anti Commercial-AI license
- Myself right now I'd probably take it with me - in fact that's that I'm planning to do in a couple of months - but it sounds like my needs are a bit less than yours, and i can do some stuff just over LAN and on the 'server' (which is also a laptop) itself.
  For more, I think I'd also ask a friend like you're thinking.
  I did that before with a relative - just had to ask them to restart the server every now and again!
  About trusted encryption keys, I did it with a simple password for boot encryption, that my relative knew, so in the event of theft it'd still be hard for thieves to get anything; but after boot I'd ssh in and unlock the second disk with my own password, then start up the services.
- What do you actually need to run on your server? I'd look into downsizing. A single small form factor computer or even a newer Raspi can do a lot these days.
  
  My problem isn't the hardware, it's that the place I'm moving to will have a bad internet connection. My current homeserver has stuff like a CI (currently being tested), a builder for software (compiling rust, C/C++, go, and whatever else), immich, nextcloud with an extension to download from youtube and other sources (basically to circumvent geoblocking of multiple friends and family), and it could be expanded to host other services e.g a seedbox. All that stuff needs good hardware and a good connection.
  Anti Commercial-AI license
  
  Yep - while only drawing a fraction of the power and creating almost no noise

not working

new

what I want