No harm in giving it a try, but I personally wouldn't bother with a selfhosted solution for it. Especially if you're not sure it will work out.
Well, paint me green and call me a pickle. More power to you if it works. 😊
Tangent, unsolicited:
Music lessons over video call, that has to be a real pain. I can't find it now, but there's an Adam Neely video where he talks about why online recording sessions can't work, as transmission latency works against the immediacy needed to play music together. He said it better than I can.
Except if your idea is to play in turns, but then capturing the thing you want to show... Can't you find another teacher closer to you?
Installing the Jellyfin add on into kodi takes a few minutes. Nothing much to consider, just try it and see if that changes anything.
I have a similar setup (rpi with OSMC, media hosted on file server) and prefer using Jellyfin as the source for all clients, as it keeps track of watched status across everything. It's not perfect, but better than without Jellyfin.
Anyone remember the Darknet Diaries episodes about a bunch of white hats from the Netherlands who managed to guess Trump's Twitter password twice? I think this was after he started campaigning for what would be his presidency, and then again a few years later.
Here's the first of the two episodes: Darknet Diaries: 87: Guild of the Grumpy Old Hackers mp3
According to Varoufakis, Europe missed the bus on cloud capital (=big cloud platforms like amazon, meta, twitter,...) and the race is currently playing out between US and China.
Don't forget a flyback diode at the inductive load or your transistor will bacon at midnight.
It's going to be powerful by every imperial, too.
Oh boy, 2017 can't come soon enough!
I think your heart is in the right place, but I wonder how you feel about tools and their quality vs. cost.
There are many easily made arguments to pay extra for quality, as you pay less in the long run, which is an idiom ("cheap tools you always buy twice") but also very true in most cases. Then what about paying extra for ergonomics, reducing strain on your body and preserving health?
And then there's the question where the line is between a hammer and a table tennis racquet.
Again, I think your heart is in the right place. There are few things more ridiculous, I feel, than absolute beginners of a sport in full brand gear from head to toe, even the stuff nobody who really practices the sport won't actually use. But then you've been playing table tennis for a few years. How much is your current gear holding you back? True it takes a lot of effort to learn about what you like and need, but it definitely pays off. Why don't you borrow a racquet from one of the other players once in a while for a match to get a feel for what you like?
This file compresses so well. 🤏
Terrible opsec sharing your WiFi SSID, by the way. I can't find one right now, but I've seen global "wardriving" maps of all broadcast WiFi SSIDs that allow to pinpoint a somewhat unique SSID or at least narrow down to a few options. A list of SSIDs around you pretty much gives away your precise location.
Had similar behaviour last night. Turned out UnboundDNS had crashed in my opnsense firewall and took "internet connectivity" with it. Restarting the service fixed it in one click after I found it.
Highly recommend cupping your favourite coffee with different kinds of water (e.g. tap, mineral, DIY water see below). It's pretty eye opening.
Here's how to make your own, if you're motivated to try: https://www.baristahustle.com/diy-water-recipes-the-world-in-two-bottles/
What is this doing in Technology?!
It's not my Github, but I think you'd do something like print and store in a safe place your trusted party has access to. My SO has my Keepass password stored in their password safe and theoretically knows (and hopefully will recall when the need arises) how to find my Keepass file, for example.
In short, it's trust. And then there's the fact that they would never voluntarily touch this stuff anyway. 😅
Not about design patterns, but about making preparations: https://github.com/potatoqualitee/eol-dr
Grindr faces massive fine for "allegedly" "sharing" "sensitive" "user" "data".
Haven't seen your laptop, but if it's anything like mine it's a very lousy boat.
In my home network, I'm currently hosting a public facing service and a number of private services (on their own subdomain resolved on my local DNS), all behind a reverse proxy acting as a "bouncer" that serves the public service on a subdomain on a port forward.
I am in the process of moving the network behind a hardware firewall and separating the network out and would like to move the reverse proxy into its own VLAN (DMZ). My initial plan was to host reverse proxy + authentication service in a VM in the DMZ, with firewall allow rules only port 80 to the services on my LAN and everything else blocked.
On closer look, this now seems like a single point of failure that could expose private services if something goes wrong with the reverse proxy. Alternatively, I could have a reverse proxy in the DMZ only for the public service and another reverse proxy on the LAN for internal services.
What is everyone doing in this situation? What are best practices? Thanks a bunch, as always!
Hi there, hoping to find some help with a naive networking question.
I recently bought my first firewall appliance, installed Opnsense and am going to use it with my ISP modem in bridge mode, but while I'm learning I added it to my existing LAN with a 192.168.0.0/24 address assigned to the WAN port by my current DHCP. On the firewall's LAN port I set up a 10.0.0.0/24 network and am starting to build up my services. So far so good, but there's one thing I can't get to work: I can't port forward the firewall's WAN IP to a service on the firewall's LAN network and I can't figure out why.
To illustrate, I would like laptop with IP 192.168.0.161 to be able to reach service on 10.0.0.22:8888 by requesting firewall WAN IP 192.168.0.136:8888.
Private IPs and bogons are permitted on the WAN interface and I have followed every guide I can find for the port forwarding, but the closest I have come to this working is a "connection reset" browser error.
Hope my question is clear and isn't very dumb. Thanks for the help or any explanation why I might be struggling to get this to work. Am I missing something obvious?
---
UPDATE The thread is all over the place, but I have made some progress:
- RDR rule gets triggered when requesting 192.168.0.136:8888 from 192.168.0.123
- Apache logs show
2024-02-09T17:39:17.056208857Z 192.168.0.123 - - [09/Feb/2024:17:39:17 +0000] "GET / HTTP/1.1" 200 161 - a tcpdump (in spoiler below) on the apache container looks inconspicuous to my untrained eye, with the exception of checksum errors in some packets from the docker container (172.20.0.2). The last five lines, after the second GET request (why is there a second GET request?) appear in tcpdump after a delay of about five seconds.
tcpdump
```17:45:14.918182 IP (tos 0x0, ttl 62, id 63127, offset 0, flags [DF], proto TCP (6), length 60) 192.168.0.123.54120 > 172.20.0.2.80: Flags [S], cksum 0xfdc5 (correct), seq 4106772895, win 64240, options [mss 1460,sackOK,TS val 1485594466 ecr 0,nop,wscale 7], length 0 17:45:14.918207 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 60) 172.20.0.2.80 > 192.168.0.123.54120: Flags [S.], cksum 0x6d68 (incorrect -> 0x2fd7), seq 3999845366, ack 4106772896, win 65160, options [mss 1460,sackOK,TS val 1469298770 ecr 1485594466,nop,wscale 7], length 0 17:45:14.924098 IP (tos 0x0, ttl 62, id 63128, offset 0, flags [DF], proto TCP (6), length 52) 192.168.0.123.54120 > 172.20.0.2.80: Flags [.], cksum 0x5b30 (correct), ack 3999845367, win 502, options [nop,nop,TS val 1485594472 ecr 1469298770], length 0 17:45:14.924102 IP (tos 0x0, ttl 62, id 63129, offset 0, flags [DF], proto TCP (6), length 134) 192.168.0.123.54120 > 172.20.0.2.80: Flags [P.], cksum 0x70f5 (correct), seq 4106772896:4106772978, ack 3999845367, win 502, options [nop,nop,TS val 1485594472 ecr 1469298770], length 82: HTTP, length: 82 GET / HTTP/1.1 Host: 192.168.0.136:8888 User-Agent: curl/7.74.0 Accept: /
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN"> <html> <head> <title>Index of /</title> </head> <body> <h1>Index of /</h1> <ul></ul> </body></html>
17:45:14.924119 IP (tos 0x0, ttl 64, id 34500, offset 0, flags [DF], proto TCP (6), length 52) 172.20.0.2.80 > 192.168.0.123.54120: Flags [.], cksum 0x6d60 (incorrect -> 0x5ad1), ack 4106772978, win 509, options [nop,nop,TS val 1469298776 ecr 1485594472], length 0 17:45:14.924407 IP (tos 0x0, ttl 64, id 34501, offset 0, flags [DF], proto TCP (6), length 364) 172.20.0.2.80 > 192.168.0.123.54120: Flags [P.], cksum 0x6e98 (incorrect -> 0x0a74), seq 3999845367:3999845679, ack 4106772978, win 509, options [nop,nop,TS val 1469298776 ecr 1485594472], length 312: HTTP, length: 312 HTTP/1.1 200 OK Date: Fri, 09 Feb 2024 17:45:14 GMT Server: Apache/2.4.58 (Unix) Content-Length: 161 Content-Type: text/html;charset=ISO-8859-1 17:45:14.929077 IP (tos 0x0, ttl 61, id 0, offset 0, flags [DF], proto TCP (6), length 40) 192.168.0.123.54120 > 172.20.0.2.80: Flags [R], cksum 0x1833 (correct), seq 4106772978, win 0, length 0 17:45:15.138862 IP (tos 0x0, ttl 62, id 63130, offset 0, flags [DF], proto TCP (6), length 134) 192.168.0.123.54120 > 172.20.0.2.80: Flags [P.], cksum 0x701e (correct), seq 4106772896:4106772978, ack 3999845367, win 502, options [nop,nop,TS val 1485594687 ecr 1469298770], length 82: HTTP, length: 82 GET / HTTP/1.1 Host: 192.168.0.136:8888 User-Agent: curl/7.74.0 Accept: /
17:45:15.138872 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 40) 172.20.0.2.80 > 192.168.0.123.54120: Flags [R], cksum 0xb48d (correct), seq 3999845367, win 0, length 0 17:45:19.995097 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 172.20.0.1 tell 172.20.0.2, length 28 17:45:19.995161 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 172.20.0.2 tell 172.20.0.1, length 28 17:45:19.995164 ARP, Ethernet (len 6), IPv4 (len 4), Reply 172.20.0.2 is-at 02:42:ac:14:00:02, length 28 17:45:19.995164 ARP, Ethernet (len 6), IPv4 (len 4), Reply 172.20.0.1 is-at 02:42:b8:07:c2:99, length 28```
---
UPDATE 2 I see the exact same behaviour with a second VM and apache directly installed on it instead of in a docker container.
---
UPDATE 3
Thank you everybody for coming up with ideas. And thank you most of all to @maxwellfire@lemmy.world: The culprit was the Filter rule association in my Port Forward settings which I had as Add associated filter rule but needs to be Pass. As soon as that is set, everything works.
The full solution is a NAT Port forwarding rule with filter rule "pass", an outbound NAT rule for hairpinning, and everything related to reflection turned off in Settings > Advanced. It's that easy! 😵💫
Nextcloud seems to have a bad reputation around here regarding performance. It never really bothered me, but when a comment on a post here yesterday talked about huge speed gains to be had with Postgres, I got curious and spent a few hours researching and tweaking my setup.
I thought I'd write up what I learned and maybe others can jump in with their insights to make this a good general overview.
To note, my installation initially started out with this docker compose stack from the official nextcloud docker images (as opposed to the AIO image or a source installation.) I run this behind an NGINX reverse proxy.
Sources of information
- Server tuning on Nextcloud Docs: Most of this are very basic things that are already taken care of in the docker image or in the proxy companion image I'm using. The one thing I haven't tried and that comes up in other places, too, is using Imaginary for image preview generation.
- How to migrate Nextcloud 17 Database Backend from MySQL to postgreSQL
- Eking out some Nextcloud Performance mainly talks about using a socket connection for redis, but also mentions logging to syslog (have not found a good source of information for this), using postgres, using imaginary for image previews
Improvements
Migrate DB to Postgres
What I did first is migrate from maridb to postgres, roughly following the blog post I linked above. I didn't do any benchmarking, but page loads felt a little faster after that (but a far cry from the "way way faster" claims I'd read.)
Here's my process
- add postgres container to compose file like so. I named mine "postgres", added a "postgres" volume, and added it to depends_on for app and cron
- run migration command from nextcloud app container like any other occ command. The migration process stopped with an error for a deactivated app so I completely removed it, dropped the postgres tables and started migration again and it went through. after migration, check
admin settings/systemto make sure Nextcloud is now using postgres../occ db:convert-type --password $POSTGRES_PASSWORD --all-apps pgsql $POSTGRES_USER postgres $POSTGRES_DB - remove old "db" container and volume and all references to it from compose file and run
docker compose up -d --remove-orphans
Redis over Sockets
I followed above guide for connecting to Redis with sockets with details as stated below. This improved performance quite significantly. Very fast loads for files, calendar, etc. I haven't yet changed the postgres connection over to sockets since the article spoke about minor improvements, but I might try this next.
Hints
- the redis configuration (host, port, password, ...) need to be set in
config/config.php, as well asconfig/redis.config.php - the cron container needs to receive the same
/etc/localtimeand/etc/timezonevolumes the app container did, as well as thevolumes_from: tmp
EDIT Postgres over Sockets
I'm now connecting to Postgres over sockets as well, which gave another pretty significant speed bump. When looking at developer tools in Firefox, the dashboard now finishes loading in half the time it did before the change; just over 6s. I followed the same blog article I did for Redis.
Steps
- in the compose file, for the db container: add volumes
/etc/localtimeand/etc/timezone; adduser: "70:33"; addcommand: postgres -c unix_socket_directories='/var/run/postgresql/,/tmp/docker/'; add tmp container tovolumes_fromanddepends_on - in nextcloud config.php, replace
'dbhost' => 'postgres',with'dbhost' => '/tmp/docker/',
Outlook
What have you done to improve your instance's performance? Do you know good articles to share? I'm happy to edit this post to include any insights and make this a good source of information regarding Nextcloud performance.
Hi fellow self-hosting lemmings,
In an SME setting, I'm looking for a service to regularly fetch mails from an IMAP server and print incoming mails and attachments on a local network printer based on rules (e.g., only print mails where the subject contains a specific word.)
Does a solution like that exist, ideally with a browser frontend to set it up?
Thank you!
Hi everyone, looking for help with an SSD/Win problem: My Thinkpad with Win11 has been acting up lately, and I am fairly sure the problem is with the SSD (very high disk load on startup and shortly before each of the many many crashes.) I would like to avoid having to set up my system from scratch.
I have a new SSD and have tried the following:
- leave bitlocker intact, boot into Ubuntu live, dd the old disk to an external USB drive, install new SSD, dd disk to new SSD
- same as above but with bitlocker disabled
- boot into Clonezilla live, clone old SSD to external storage, clone external storage to new SSD
- clean Windows install on new SSD and clone c: partition to new SSD with Clonezilla
All of these attempts invariably lead to an "INACCESSIBLE_BOOT_DEVICE" blue screen, and "bootrec /fixboot" and the like executed from the recovery CMD shows "0 Windows installations found." Booting into Ubuntu live with the cloned SSD installed I can see all my user data intact with no apparent problems.
Is my old SSD/Windows installation broken beyond repair and do I have to accept it and move on or am I missing something?
Thanks for any help or pointers!