One problem is that it's not much use applying secondary auth methods on the server side if the mobile app can't use them.

Yeah it's a big pile of crap. More details here if anybody's curious:

https://www.reddit.com/r/AskAGerman/comments/1t4pio6/how_are_germans_ok_with_schufa/

OP is in Germany where they have a private database called Schufa that pools information about you collected from banks, mobile carriers and internet providers, and provides a "score" to them as well as to landlords.

It's borderline legal under GDPR because it doesn't actually store anything about things like nationality, employment, religion, marital status or sensitive financial information like income, assets, expenses.

The score is based on things like loan existence & repayments, ongoing utility contracts (with privately owned companies), if you've filed for insolvency, how often 3rd parties inquire about your score and other circumstantial data.

Generally speaking you're correct, in most countries there are very clear rules about loans that are based on what other loan repayment you have vs what's your current income, and there are rules about how far much debt you can take as a ratio of the two (say, you can't take a new loan if you're already using 60% of your income to repay previous loans).

Also, the information about loans is typically restricted to this exact inquiry: can this person get a new loan (yes/no) and if yes what's the maximum they allowed to repay per month (X euro). So the bank knows they can structure a loan to you based on a repayment of up to X per month, but nothing else.

I'm guessing Germany doesn't have regulation like this (since accessing any information about your income and expenses is forbidden), so Schufa was created to be a (poor) substitute.

I don't computer enough to host my own site.

You mean savvy or cost?

If it's cost, you can have a simple site and email with your own domain for something like $30 a year.

I cut lawns and maintain gardens,

Do you own your rake and gloves or rent/borrow them?

It's the same thing having a domain. Really basic but essential tool that it makes sense to own it and have no surprises or changes at anybody else's whim.

Your business email is a @proton.me address?

You mentioned a website, wouldn't you rather have an address @ your website domain?

AFAIK the concept behind keepassxc is that it's an encrypted .kdbx file that you sync yourself among your devices by any means you can. There are official apps for Windows/Linux/Mac, browser extensions for Firefox/Chrome/Chromium/Vivaldi, there's integration with ssh-agent, and 3rd-party apps for Android and iOS.

decided that scraping the internet for fanworks and hosting them on a new site without asking permission from any of the creators was a good idea

The thing is, in any fetish and fanfic community there will be a body of works accumulated over the years that contains many classics but the authors are only a nickname. Sometimes there's an email listed that stopped working decades ago.

The sites that host the works are usually run by enthusiasts. Over the years they lose the incentive to maintain them. Whenever a site goes down and others take its place there's always a dilemma about what to do with that body of work.

Technically speaking, yes, any site that's not the site where each author originally uploaded their work is in breach of copyright and/or licensing for those works. On the other hand, if you were to attempt to contact each author and only carry forward the works where you get an answer and permission... only a tiny fraction would qualify, and massive portions of the literature would be lost in each move.

Clementine

Whoa, has Clementine picked up again? I've long ago switched to Strawberry and then to Fooyin.

As someone who's used all three (moved from Plex -> Emby -> Jellyfin):

Plex's killer feature is the relay and the fact it's completely transparent for users. You log in with a Plex client (whatever device, whatever location in the world) and it will sort out a connection to the Plex server. Complete no-brainer.

Jellyfin has been killing it lately, the last 3 versions (10, 11, 12) were all amazing leaps forward. The devs have been really hitting their stride and are addressing fundamental design issues and making Jellyfin better from the ground up. If you want complete independence, openness and control, excellent performance, this is it.

Emby for me sits somewhere in-between and it's not necessarily the better off for it. Feels like a compromise or the worst of both worlds. It has touches of Plex's enshittification streak, it hasn't addressed any of the core problems like Jellyfin has.

Both Emby and Plex have issues navigating VPNs and complex/unusual network setups because their plug'n'play approach relies too heavily on autodetection. Plex has the relay to fall back on (provided you pay for it) but Emby doesn't.

Both Emby and Plex will move features around and really, really want you to keep paying so it's anybody's guess what you'll be paying for from month to month. Lifetime passes were (can I say it?) a tremendously STUPID idea and now that ship has sailed anyway.

IMHO, one of these days someone will come up with a way for Jellyfin to provide free, transparent, aecure client+server pairing behind NAT and that will be a huge blow to both Plex and Emby.

You can appoint multiple accounts as administrators at Migadu, provided you're not on the Micro plan.

Another option would be the "pattern rewrites" feature of Migadu. It's a sort of "wildcard alias". You, as admin, can define an alias with a asterisk in it (let's say bla.*@) for one of the wife's mailboxes, and she could give out addresses with the asterisk replaced by anything she wants (bla.amazon@, bla.ebay@ etc.)

You can define more than one such wildcard pattern, you could make for her shop.*@, bank.*@, bills.*@, social.*@, and so on, a pattern for every occasion.

She would still not be able to edit these aliases but she would be able to make them up on the fly (as long as they match the fixed part of a wildcard). You can even send from these aliases (you simply use them as your "From" address in the mail client).

You can do what you want with IMAP too.

I use isync, it's a CLI tool that can sync between IMAP accounts or between IMAP and local plain storage and it has the option to delete messages over a certain age after it copies them.

Is there a set up where some remote service handles email exchange, and you just sync with it

Any regular email provider can do this as long as it offers IMAP. I use email clients with my provider's IMAP but I also use isync on the server to periodically pull all email locally and delete messages older than 30 days. I've also installed a local private IMAP server and a private webmail client on top of that private IMAP, which I use to search through old emails.

This way I normally use the "live" mailbox with my PC/mobile devices, and use the private webmail when I need to search for anything over 30 days old.

What I do is not "selfhosted email", technically speaking, because I rely on the live IMAP and SMTP from a provider. But I can switch provider at any time because all my email is @ my custom domains, so I can simply point my DNS to another provider and update my apps to use the new provider's IMAP/SMTP server.

Do you know if it is possible to connect one alias to multiple mailboxes?

I don't know if Mailbox does this but technically speaking it should definitely be possible, as long as the mailboxes are on the same domain. (If you cross domains it's not aliasing anymore, it's forwarding.)

I know Migadu has this feature and it works as intended.

Speaking of Migadu it's another good option but they only do email, nothing else (no calendar, no drive etc.) They have an interesting pricing model where the account owner pays for a certain tier of storage and of emails sent/received per day, but inside that account you can have as many mailboxes, logins, domains and aliases as you want. It can become cost-effective very fast, as low as 2-3 users.

if I have a custom domain in my account, can I share it with other users in a family plan, and can they use it to create aliases in their own?

I think so but I only have an individual account with Mailbox so I've never tried this. See their help pages (under Resources), they have extensive documentation. Another option is to use the contact form on their site to ask.

I know they have this thing called "family accounts" that takes individual accounts and makes them part of a "family" so they can share stuff like files and calendars. I think it means they can also partake in custom domains. And of course each account can make their own aliases.

Keep in mind each account needs to be paid separately though. Not sure it's possible to have multiple mailboxes with different logins and self-managed aliases under the same account.

You can make free accounts and add them to a family but free accounts have some limitations, particularly about aliases.

Have a look at mailbox.org, it's a German provider of email/drive/calendar/office/conferencing. They've been around for a few decades and they use Linux and FOSS.

https://mailbox.org/en/about-us/

May Be a Linux Client Support

You can use any email client you want because they use standard IMAP and SMTP, and their non-mail services are used in the browser.

It does, there's a lot of features and UI added on top of it because it's primarily an enterprise-oriented service and large companies tend to have a lot more complex usage scenarios than self-hosters.

Headscale is a FOSS reimplementation from scratch of some of the Tailscale proprietary features. It's inteded as a fallback option for Tailscale users in case the Tailscale service ever enshittifies, and also as a canary for ongoing verification of the Tailscale claim that the client plane functionality is entirely FOSS and above-board.

Speaking of which, Tailscale today is a great example of a company using FOSS well. They are able to provide commercial services and have proprietary code while at the same time opening the client-facing code so users can see for themselves their privacy is cryptographically proven. They also cooperate very well with Headscale and provide a generous gratis service tier.

• I've taken the opportunity to update most of my hosted services to newer image versions.

  They're all in Docker and behind private access (Tailscale, mTLS, IP whitelist etc.) so I'm not usually too worried. I update images manually whenever I can find time on a slow weekend, so this wasn't strictly speaking related to the recent vulnerabilities. Volume data and container definitions are backed up automatically once a day and I also take manual copies of the old images when I update them.

• I've switched to new major versions of Immich and Jellyfin in the process and I'm very pleased with the new releases, amazing great work from the developers, they've been killing it lately.

• I've been tinkering with some custom images that I use for various things like syncing specialized data (logs off FTP services, archive email over IMAP from my mail provider, grab Garmin data copies, run monitors and log parameters to Influx, run port forwarders etc.)

  I typically want to lock down this kind of images as much as possible, so I tweak them towards running with an unprivileged user, remove all caps and only grant strictly necessary ones, make the storage read-only inside the container etc.

• Some needs have been recurring inside this type of containers, like having a decent process manager to keep some things running and restart them, or having a decent cron service. So I've been toying with the idea of making a "universal" image for this kind of thing and maybe publishing it for others to use as a base too. If I get around to it I'll be announcing it here.

I mean, "plain WG" doesn't have the ability to connect multiple sites seamlessly, nevermind from behind NAT. That's what Headscale/Tailscale do, they enable multiple WG backends to connect together on the fly into a common VLAN, with almost zero extra config.

It may seem overkill if you only want to connect two sites but once you solve this problem for 2 it's basically also solved for N so why not take advantage of the capability.

There's Headscale, but it can't be fully selfhosted because you need an external host if both clients are behind NAT.

Wireguard may be more obviously public, but they both technically are, right? Otherwise accessing a node just wouldn't be possible.

There is something exposed to the Internet in both cases, yes, but it works very differently.

With WG it's a client-server pattern; the server exposes a port, waits for authorized clients to connect, and when a client connects successfully the server routes their connections into the private LAN with everything that entails.

With TS the public part is a supplier of control configurations and client pairing service. The pairing service needs to be contacted by two authorized clients in order to negotiate a connection between them. Once that's done, it's the clients that route each other's connections into their respective LANs, the pairing server is not involved anymore.

In other words the TS public surface is not WG, it's their (proprietary) client verification and matching service. The WG connections between clients happen later, privately.

To me, separating client authentication from routing and transport looks like a better design, because it's multi-layered. You get the normal WG authentication and another layer on top.

If you don't need something specific that tailscale offers, then wireguard offers probably better security.

"Security" is a relative term. It's better to think in terms of attack surface, exposure, whether attacks are targeted or not etc. Which are all ongoing factors.

Both TS and WG are popular and being used by lots of people but it's also important for them to be actively maintained, independently audited, maintain transparency etc.

Also, I've never been able to understand how something exposed to the entire internet (a WG server) is considered more secure than something that only connects peers privately to each other.

The attack surfaces are nothing alike.

Even if you limit access to WG with IP blocking there's still no comparison to something you can't access at all from outside.