nixos, mostly. It has a very steep learning curve but if it breaks I’m just "whatever, rollback now, fix properly later".

I actually don’t remember off the top of my head, huh. The output chain is not the one I use often. I'd think nft add rule tracing filter output ip protocol icmp icmp type echo-reply meta nftrace set 1 would do it. Just make sure the priority is low enough again.

It is accepted just fine then. You might want to check the reverse, start in top of the output chain and trace the echo reply.

nftables offers a very decent debugging interface. First, you add a rule to trace the packet (a new chain with high priority works best). Usually I’d suggest to add those rules by hand instead of relying on declarative configs:

nft add table ip ping_trace
nft 'add chain ip ping_trace prerouting { type filter hook prerouting priority -301; policy accept; }'

Then you add the actual tracing rule there with the shape to match the incoming traffic:

nft 'add rule ip ping_trace prerouting icmp type { echo-request, echo-reply } meta nftrace set 1'

now you can run nft monitor trace and see the decisions made for the matching packets. Remember to delete the ping_trace table afterwards to clean up.

BGP anycast person here. If you have any presence in the region RIPE operates in then the pricing is within the homelab reach. ASN and a block of /48 would be about 70 EUR/year.

Alternatively, something like route64 would happily tunnel you IPs they announce for about 2 EUR/month.

I’ve used VM in my homelab for a while - it's genuinely a smaller ram footprint, especially on the ingress path. You can even scale query separately if required.

I'd suggest VictoriaMetrics over pure Prometheus - better ram footprint is pretty useful nowadays.

You probably want to mention that some prominent cryptographers think this just astroturfing?

I actually had lots of fun writing a clojure compiler in rust that would target wasm. This allows to write it all in rust and then get it to self-host bit by bit.

A second offsite NAS with your friend? That's what I did when I grew out of my old synology. My new NAS capacity is noticeably impacted by things like frequent local snapshots but I don’t need to back those up remotely and it saves space.

While matter technically requires IPv6 there are non-confirming devices (glares at Hue) that will only do IPv4. It will work with most of the matter controller networks, because in the end it's a conscious decision to disable IPv4 there.

You really want the ECC ram and the motherboard/cpu combo that supports it.