overview for Fedegenerate

Maybe There'll Be Birdseed! in c/[email protected]

[–] [email protected] 3 points 6 hours ago* (last edited 6 hours ago)

This has the feel of a trap. There's something in my hindbrain that wants absolutely none of this.

[–] [email protected] 10 points 6 hours ago* (last edited 5 hours ago)

When is it do you believe the Marxists and Anarchists were in power? When do you believe they held the gun to be able to give it away?

Punch up, not down.

To put it in another reference frame. When a video game fails who's fault is it? The millions of consumers? Or the corpo overlords? When democrats fail, is it the fault of millions of voters? Or the fault of corpo overlords? When something fails it is always the responsibility of those in power to affect the most change. Except, when it comes to politics, then we forget that it's those with power that hold responsiblity.

I hate predatory micro transactions and day 1 dlc. I don't blame the people that boycotted them for the prevelence of mtx? I blame the people that demand they be sold first, then I blame the people that sell them, then I blame the people that bought them. It's not the fault of the people that didn't buy them. Except in politics for some reason.

Sorry, I just got recommended a "games are shit now corpos took over, it's the leftist's fault games are bad". The misattribution of blame from 'capital interests' to 'leftists' is so pervasive even the "I'm left of center" crowd are doing it. I didn't engage there but still need the catharsis

Reminder for Bitwarden users: Starting in February, users without two-step login (2FA) enabled will need to enter a verification code sent to their email when logging in from an unrecognized device in c/[email protected]

[–] [email protected] 3 points 2 days ago (2 children)

Sorry, basic question here. I'm running vaultwarden, I host my own vault that bitearden apps access. I don't think my vault has a mail server, how fucked am I?

First self-hosted post! in c/[email protected]

[–] [email protected] 8 points 2 days ago (1 children)

Lemmynsfw here, we see you. Do you, errr, see us?

Can we stop asking people who are on the brink of death and suffering greatly to sacrifice themselves for a bunch of able bodied people who refuse to stand up and sacrifice themselves for the disabled in c/[email protected]

[–] [email protected] 3 points 2 days ago* (last edited 2 days ago)

Interesting timing. I was considering my own sense of guilt associated with this. I watched and was dwelling on innuendo studios South Bank of the Rubicon video. I was thinking where mine was, when I would act, what that action looked like.

Part of me had the same reasoning, I am disabled and my qol is set on a ever increasingly downward slope. Physio is merely to slow the acceleration of the decent, as such why wouldn't my South Bank be a little closer, action a little more drastic.

I do have a fiancee whom I love dearly, but no kids. My social circle is very close but quite small. My job is for hobby money, it's not a career. All of which screams why wouldn't my South Bank be a little closer, action a little more drastic.

I see JSO keeping corporate sponsored climate disasters in the news. I think who among them had better QOL prospects than I? Why was their bank so much closer, their actions more drastic?

I don't have answers, or I do and I don't like them which is functionally the same. Just a mild sense of guilt which peaks whenever I see someone doing something.

Just learned how to do a reverse proxy in c/[email protected]

[–] [email protected] 1 points 2 days ago

You can still use a reverse proxy inside the VPN and use your own DNS server that spits out that internal address to your devices for your various applications.

Excuse me what? Here's my dumb ass navigating to "[device name]:[port] over tailscale.

I've tried this a couple times and I've always failed. I could never figure out how to get a http://service.domain/ request to my Nginx install to be proxied in the first place. I tried putting pihole on tailscale and setting that as tailscale's DNS. It blocked ads but I couldn't navigate to custom domains. I put NPM on tailscale hoping that was the issue. I looked for LocalDNS/CNAMES in tailscale to see if I could do it that way. Do I have to set a local machine as an exit node and do split DNS shenanigans, service.domain goes through to my local and everything else the wider web? Do I set a router node?!

Not expecting you to troubleshoot, I don't have time to see it through anyhow. Just annoyed at myself I couldn't figure it out and driven to try again.

The AI revolution is coming in c/[email protected]

[–] [email protected] 0 points 2 days ago

Change happens very slowly then all at once - unknown, to me. I didn't want to go down that rabbit hole, it's 0330

Smart methodology in c/[email protected]

[–] [email protected] 4 points 2 days ago

I try keep my ID10T errors between an LLM and myself now. I diligently follow all of it's first steps that I know won't work. Excuse me, what do you mean check pihole is installed? Of course its, oh it errored and didn't install. New chat copy-paste error.

Happened today actually. apt didn't have access to the internet because the pi's DNS was set to 100.100.100.100. GPT didn't figure that out, it did politely ask me whether lighttpd.conf not existing was because pihole didn't exist after I just, ahem, installed it.

What's with the overkill hardware setups? in c/[email protected]

[–] [email protected] 2 points 2 days ago

I like my n100 mini and usb drives. A full fat server has little WAF when the selling point is an LLM. The n100 handles all our needs sadly.

A dozen or so LXCs. A dozen or so docker containers. A couple VMs, including a Mint VM to turn my android tablet into a desktop. They were sold as a great little home lab, and that they are.

Then again, it's a year old and I'm only beginning in this hobby.

Instance policy update: Votes are in and Xitter links are now banned on this instance in c/[email protected]

[–] [email protected] 3 points 2 days ago* (last edited 2 days ago)

Ahem... Gestures vaguely at the nsfw handle. Aside from the obvious upsides, not federating downvotes has been pretty good. I think my reader, connect, can turn them off. Just looked, maybe it doesn't, there a "show upvotes and downvotes" button. Regardless, this is not the place for that.

It would probably be good to get a general user off lemmynsfw though. "All" is cluttered with all sorts of nonsense.

Instance policy update: Votes are in and Xitter links are now banned on this instance in c/[email protected]

[–] [email protected] 28 points 3 days ago (2 children)

What could possibly go wrong in c/[email protected]

[–] [email protected] 1 points 3 days ago* (last edited 3 days ago)

People are unaware of the bias of their own government. People are aware of the biases of the Chinese government.

The biases you're aware of is better than the biases you're unaware of.

Therefore: the deep seek bias is better than openai's. More tongue in cheek, don't worry about it.

I kinda agree for what it's worth. I'm only half aware of the shit the UK government instilled in me, confronting it is good. I support the tiktok ban in so far as I don't like any of the "skinner box" media. I wouldn't single out the Chinese version because it's Chinese. Edit to clarify, I don't support an "only tiktok" ban.

Likewise for AI, I wouldn't treat deepseek negatively just for being Chinese. If it could make my countrymen less [blank]phobic that would be a boon. I don't hold much hope though.

22

Help using NginxProxyManager to route multiple non-tailscale devices to multiple services. (lemmynsfw.com)

submitted 2 months ago* (last edited 2 months ago) by [email protected] to c/[email protected]

6 comments fedilink

For legibility I split the post into: my current setup; the problem I'm trying to solve; the constraints for solving the problem; what I've tried and failed to do; and key questions.

When roasting me in the comments, go nuts, I'm not a complete beginner, but I wouldn't rank myself as an intermediate yet. My lab is almost entirely tteck scripts, and what isn't built by tteck are docker containers. My inexperience informs some of my decisions for example: I'm using nginxproxymanager because Nginx documentation is beyond me, I couldn't write a nginx.config and NPM makes reverse proxies accessible to me.

My Current setup

I have a Proxmox based home server running multiple services as LXCs (a servarr, jellyfin, immich, syncthing, paperless, etc. Locally my fiancée and I connect to our services. Using pihole-NginxProxyManager(NPM) @ "service.server" and that's good. Remotely we connect to key services over tailscale using tailscale's magic DNS @ "lxcname:port" and that works... fine. We each have a list of "service: address" and it's tolerable. Finally, my parents have a home server, that I manage, it is Debian based with much the same services running all in Docker (I need to move it to Podman, but I got shit to do). We run each others' off-site backup over tailscale-syncthing and that seems good. But, our media and photos are our own ecosystems.

The Problem

I would like to give someone (Bob) a box (a Pi, a minipc, a whatever). The sole function of this box is to act as a gateway for Bob's devices to connect to key LXCs on my tailnet. Thus Bob can enjoy my legally obtained media and back up their photos.

The constraints

These are in order of importance, I would be giving ground from the bottom up. The top two are non negotiable though.

A VPS has low to zero WAF. Otherwise I would have followed the well trodden ground.

Failsafe. If the box dies bob can't access jellyfin until I can be arsed to fix it. Otherwise, they experience no other inconvenience.

No requirement to install tailscale on Bob's devices. Some devices aren't compatible with tailscale: Amazon fire stick. A different bob does't want to install a VPN on their phone. Some devices I don't trust to be up to date and secure, I don't want them on my tailnet... I have no idea if the one degree of separation is any more secure, but it gives me the willies.

I'm pretty sure I can solve this using pihole-nginx-tailscale with my skillset. But then I have to get into bob's router, and maybe bob might not like that. If I could just give them a preconfigured box that would be ideal. They would have pretty addresses though.

I don't currently have a domain, I do plan to get one. I just don't currently have one.

My attempts and failures to solve the problem.

I've built a little VM to act as a box (box), it requests a static IP. On it I installed Mint (production would probably be DietPi or Debian) Tailscale,Docker (bare metal) and NPM as a container. In NPM I set a proxy host 192.168.box.IP to forward to 100.jellyfin.tailscale.IP:8096. I tested it by going to box.IP and jellyfin works. Next up Jellyseerr... I can't make another proxy host with the same domain name for obvious reasons.

I tried "box.IP:8096" as a domain name and NPM rejected it. I tried "box.IP/jellyfin" and NPM rejected that too (I'll try Locations in a bit). I tried both "service.box.IP" and "box.IP.service" and I'd obviously need to set up DNS for that. Look, I'm an idiot, I make no apologies. I know I can solve it by getting into their router, setting Pihole as their DNS, and going that route.

Next I tried Locations. The required hostname and port I set up as jellyfin.lxc.tailnet.IP:8096 and I set /jellyseerr to go to jellyseerr.lxc.tailnet.IP and immich set up the same way. Then I tested the services. Jellyfin works. Jellyseerr connects then immediately rewrites the URL from "box.IP/jellyseerr" to "box.IP/login" and then hangs. Immich does much the same thing. In desperation I asked chatGPT... the less said about that the better. Just know I've been at this a while.

Here's where I'm at: I have two Google terms left to learn about in an attempt to solve this. The first is "IP tables" the second is "tailscale subnet routers" and I have effort left to learn about one of them.

During this process I learned I could solve this problem thusly: give Bob a box. On this box is a number of virtual machines(vm). Each vm is dedicated to a single service, and what the fuck is that for a solution?! It would satisfy my all of my constraints though, its just ugly.

Key questions

Is my problem solvable by just giving someone a Pi with the setup pre-installed? If not I'll go the pihole-npm-tailnet and be happy. Bob'll connect to "service.box" and it'll proxy to "service.lxc.tailnet.IP".

Assuming I can give them a box. Is nginx the way forward? Should I be learning /Locations configs to stop jellyseerr's rewrite request. Forcing it to go to "box.IP/jellyseerr/login". Or, is there some other Google term I should be learning about.

Asssuming I can give them a box, and nginx alone is not useful to me. Is it subnet routers I should be learning about? They seem like a promising solution, but I'll need to learn how the addressing works... Or how any of it works... IP tables seem like another solution on the face of it. But both I don't know where to send bob without doing local DNS/CNAME shenanigans

Finally assuming I'm completely in the weeds and hopelessly lost... What is it I should I be learning about? A VPS I guess... There's a reason everyone is going that route., Documentation on this "box" concept isn't readily findable for a reason I imagine.

16

Uncomplicated firewall rule set for a *arr stack. (lemmynsfw.com)

submitted 11 months ago by [email protected] to c/[email protected]

25 comments fedilink

I set up an *arr stack and made it work, and now I'm trying to make it safe - the objectivly correct order.

I installed uncomplicated firewall on the system to pretend to protect myself, and opened ports as and when I needed them.

So I'm in mind to fix my firewall rules and my question is this: Given there's a more sensible ufw rule set what is it, I have looked online I couldn't find any answers? Either "limit 8080", "limit 9696", "limit ..." etc. or "open". Or " allow 192.168.0.0/16" would I have to allow my docker's subnet as well?

To head off any "why didn't you ?" it's because I'm dumb. Cheers in advance.