CLOUDFLARE IS NO MORE FOR MY NETWORK

Soon I'll drop Cloudflare for my public services too

I have been looking for something new.

Last week was moving Immich up to the new release I was on an old version, which meant migrating to an intermediate version to allow a database rebuild. It worked well.

I was bored this week so just ran some wattage testing.

• 15w at idle (800MHz)
• 20w active (3.4GHz)
• 30w peak at boot

I finally got my ISP to enable bridge mode on my modem.

I also learned that I didn't lose port forwarding and related services because I had been moved behind CGNAT or transitioned to IPv6 -- they simply no longer offer port forwarding to residential customers. Ruminate on the implications of that statement so I'm not the only one with blood pressure in the high hundreds.

I've had immich but went to homegalley instead. Mostly because I want to keep MY directory structure in case I'm abandoning the choosen platform. Have not regretted my choice (so far ... 8 months)

I’ve learned a hard lesson this week. Jellyfin server OS partition run out of free space and corrupted the database. Nothing to do but reinstall. I guess this week I’ll be reviewing backups! 🤣🤣🤣

Self hosting wise, not much, just ran through updates (I prefer to do this manually) and set up a new box which will host another proxmost host and NAS.

The mobo/CPU that became the new server has been replaced with an Asus prime x370-pro and a spare 1700x to be used as a new endeavoros desktop (their defaults are close enough to what I want I dont bother with full manual install). Mostly need it for a KDE 6 box for dev/testing to go alongside the instances of Trixie/Sid, since I'm considering arch for some work stuff that Debian won't fit the bill for.

I installed immich and began migrating our phones away from Google.

Working on getting bazarr to work with Plex, turns out it still requires radarr/sonarr even if I don't sail the seven seas. Guess I'll be learning the entire stack tonight :)

Installed qbittorrent and downloaded a few seasons of Linux isos onto a vps. Discovered accessing those files over SSH to be too slow to play them without buffering so installed filebrowser to get them via http which worked well.

It's been a long long time since I used bittorrent and wow it works so much better these days.

I've set up Kavita for my e-books. Nice UI, looks promising, and I've added some books. I haven't really used it yet, because half of this was just an excuse to try podman (instead of docker). I wanted to set it up to run as unprivileged user, without the docker daemon running as root. That wasn't too hard, but it was definitely a few extra steps.

But something about Kavita didn't sit well with me. Maybe I don't self-host enough stuff to know what's normal, but there is a donate button, which I don't mind, but its tooltip says: "You can remove this button by subscribing to Kavita+."

I'm donating to a few software projects already, and I have developed a substantial amount of free software myself. There is nothing wrong with asking for money. But what I cannot stand is when software running on my own device is intentionally acting against my interests. And this tooltip was very clear about not letting me do something that I might want to do.

So I checked the source code for more. I found another anti-pattern: telemetry is opt-out instead of opt-in. But that seems to be it, I didn't find anything worse than that. So... fair I guess, if the author wants it that way. It's still free software. It looks like I could delete all the Kavita+ stuff myself and re-build. Which I'm going to do if I keep using it. But this is now an extra step that prevents me from just using it, because I need to feel in control of what I run. Kind of self-inflicted, I guess...

Love the post haha! Nothing much here things run rather stable and with low maintance right now.

I've been making another attempt to replace Docker with Podman. The issue is I can't connect to my server through a web browser. I think it's a firewall issue.

Networking and networking troubleshooting is a bit confusing for me and that's the least favourite part about self hosting for me. Turns out I actually enjoy writing scripts more and the challenge of writing POSIX scripts especially.

If I can figure it out, I'll probably write a guide for setting up Podman and Caddy on Alpine Linux since there isn't a lot of recent information out there from what I found in my searches so far.

Building out ansible.

Now it's creating roles and groups, adding a few items to the hardening playbook, and I've been playing with tuning the output as playbooks run.

Not much with the server, as I'm finally finishing my switch to Mint on my main PC, now that I've finished the things I was stuck with Windows for.

I'm debating whether to put Calibre Web on my PC or media server, as the PC is easier to access, but the server is always on.

I'm also trying to figure out the best way to host a family Minecraft server. I've currently got two running at home and one remotely, but have managed to get a decent free tier Oracle server running too.

One of the Minecraft servers is staying local, as it's just for the immediate family for our gaming sessions, but the other is for the kid's cousins to join in too. Typically though, they haven't wanted to play since I got the servers running, so I can't tell which is best for them 🙈

Working on setup reserve proxy properly. With all this research and testing, im going to be ans expert in the area, just to never speak about to another human being... except on and another post

Finally managed to carve out some time since the birth of my daughter two months ago to tinker around a bit. Decided to tackle my gripe to semi-automate updating my services when there is a new release.

Now I have Renovate running on my self-hosted Forgejo instance using Forgejo's actions and a "Podman in Podman" image for its runners. Don't ask me why I wanted to do a PINP instead of DIND - I guess I like to punish myself. But at least this means everything I deploy is running with Podman 😄

I am playing around with Podman Quadlet and that's one hell of a rabbit hole. I have everything up and running, and now I need to configure the containers, and probably will deal with other pain points, etc.

The good thing is that I have documented the whole process so it is reproducible but it took me quite some time to figure out everything.

Currently working on a networking problem. I have multiple Proton VPN connections on my Mikrotik router. Main reason being for fail over in case one endpoint reaches capacity, goes unresponsive, etc.

It's a bit tricky since Proton issues the same peer and gateway IP for each connection. Haven't quite got it working the way I want it to yet.

Set up Zipline to share bigger files with my friends.

I finally got my home services covered with my website's wildcard ssl. Which is great, because now I can setup ELK Stack and setup an auth portal on my vps, and get Plex and gitlab out of the house securely.

So, serious question, should I self-host my servers in AWS?

I got tailscale cert to work but I feel kind of bad about learning tailscale instead of headscale

I've been deploying Gitea (or Forgejo, still can't decide), but I've fallen into the Ansible rabbit hole and can't get out. Also learned Terraform in the last week and I'm still on the fence about using it in my homelab. It's nice for the cloud but I don't think it's as useful on-prem.

almost done re setting everything up after a catastrophic failure (ended up replacing multiple drives, the CPU, the motherboard, the psu, and the ram).

now I'm just running long command after long command, waiting for drives to zero, ensuring extended smart checks pass on new drives, cloning to my backup drives...

this things been down for a few weeks and I'm so excited to have it back up soon!

anyways, moral of the story is, the 3-2-1 strategy is a good strategy for a lot of reasons. just do it, it may save your ass down the line.

Updated several Syncthing Server and one of them that comes as Yunohost Package got an new ID.

So that little thingy flooded all my other Syncthing Servers with Sharing requests... Its pretty anoying and surely its that one that serves the outside Backup...

I actually did something for quite a while. Finished long overdue wiring for outdoor access point and one more camera, replaced a main switch since the old one started to behave unreliably, installed frigate (which still needs some work), cleaned up some wiring while messing around, updated a bunch of firmwares, replaced switch in garage to managed one and made some changes on my workstation and some other minor stuff.

Next would be to move cameras into their own VLAN and harden that setup a bit. And I really should get around on better backups for my VPS. But it's a new week coming up, if the work isn't too busy I might get something more done.

At this point my whole setup is mostly in maintenance mode - I've got everything I need up and running, making some minor changes here and there (like swapping out StirlingPDF for Bento), and keeping things up to date. I only started this hobby about 6 months ago or so, and I'm really satisfied with where things are at. We'll see when the next Big New Thing arrives.

I installed gitlab on mine. Time to organize my projects!

I have noticed that Microsoft and google are trying to scan my domain for /php-myadmin and similar links that I thankfully do not have.

I had already fail2ban running but it failed to ban a single IP. I did setup custom filters that would ban admin panel scanning attempts but somehow now it also bans my home IP and my phone 5G ip sometimes. No idea how to fix it so far. Also, this filter/jail doesnt necessarily jail everyone attempting to reach these links, just sometimes it does.

Finally finished setting up and testing a Peertube instance. The video stuff and object storage related things certainly make it more involved than other fediverse software, but overall it is working quite nicely. Just need to find some workable solution to using GPU acceleration in containers, but I think I mostly figured it out (might work after a server restart, but my sweet, sweet uptime makes me procrastinate on that 😅 ).

I migrated iptimr-kuma to the new v2.0 release. The DB migration took a long time. I learned I probably should have run the vacuum command before the migration, but I never noticed the button in the settings before.

Also preparing Jellyfin for its new 10.11.0 which comes with another long running DB migration.

Updated to OpenSuSE Leap 16.0 with the autotool and it broke some things, but nothing terrible. Had to fix network config and add back Packman for ffmpeg for Jellyfin to work but that was about it

I threw a thinkcenter in my laundry room and did the bare minimum to securely SSH into it (fail2ban, nonstandard port, root login disabled, can't login with password, etc), to be used as a testing platform for building my workplace a new website.

Just gotta relearn HTML/CSS and figure out what platform to use.

Also set up traefik/Authelia/maybe Anubis for the new domain and block any access outside of my home or workplace.