Taasz/Woof

I’m re-thinking a few things, mostly moving exposed services onto a VM or two that are on their own VLAN, and don’t contain any important data (it would be my website, gameservers like Minecraft, etc…). I might move to podman as well so nothing has a possibility of running as root, docker can run rootless but that setup seems more confusing to me.

I already use a VPN via Wireguard on my router for access to my private services when out of the house, so my changes are just separating the public from the private as much as possible on the server side of things…

Essentially if someone manages to drop a crypto miner or something on my website that’s fine, I’ll get an alert pretty quickly through Beszel that the server load is high and I can go roll back a backup or whatever. I just want to make sure there’s no access to anything else for them.

I generally stick with the main TLDs. Like com or net.

.com is fairly cheap and won’t be on any blocklists, where some other TLDs can be.

But if you’re in the EU then .eu probably makes sense to use.

There have been a few major ones this year, I’m sure they are fixed at this point though. https://app.opencve.io/cve/?vendor=jellyfin

Plex uses a code signin system where you open the app on your phone or just a browser, and enter the code there.

So there’s no typing/entering anything on the TV at all.

Jellyfin has plenty of issues with public instances too. It’s just the reality of exposing to the public internet, unless it’s something that has a lot of dedicated work going into security it’s going to have problems.

If it breaks I either fix it (often it’s just an issue where the new version needs extra config added), or roll back to a backup and pin the old version temporarily if it really went wrong and I can’t recover otherwise.

Backups run early AM before any auto updates start, and no one is using services and changing data then, so nothing should really ever be lost by rolling back.

It’s easier to setup and use for less technical people, also just more widely known.

I run Jellyfin but logging in is definitely a pain, have to manually enter the URL (including https for some crazy reason, why doesn’t it just default to it??) and username and password using a crappy TV remote.

Wildcard SSL does help a lot, since every subdomain isn’t broadcast publicly in the issuer logs.

It’s where the users are.

That’s fair, shutdown service + backup everything is certainly more guaranteed to work properly.

With Immich I’m not too worried about the DB potentially being off since it can rescan the filesystem, but I also backup at 3am when nothing is happening on Immich because I’m asleep!

If you have someone far enough away, with fast/reliable internet, and a safe spot to put it.

Immich uses user/YYYY/MM folders on my setup, and I exclude any thumbnail directories from the backup too. So not many dirs/files to check for the backup software and it’s very quick.

You don’t need to shut it down, pg_dump works fine while it’s like if you want to make sure it’s a good database backup. The files side of things are fine either way.

I have a storage box with hostbrr for my ~800GB of files. They have deals sometimes with 4TB boxes for like $9 a month or so. Hetzner storage boxes are also sometimes on sale.

I’m not a fan on the channel either generally, but as I remember they didn’t do anything unusual? Just installed some things and the distro broke itself.

If someone can break it by just doing average things a user would do, that’s not really the users fault.

People abusing cloudflare workers.

I think it’s worth it, but you could move to one of the VPS deals on racknerd (or another lowendbox.com deal), for like $10-20 a year and save a bunch.

I guess? They advertise it as blocking bots and bad actors and such but it doesn’t really do that.

They do talk a lot about security and their WAF on their home page, it might be secondary but they mention it a lot.

I don’t believe there are any logs being transferred, just the abusive IPs are shared with the central DB.

So if an IP starts hitting a ton of rules (like .env access, repeated 403s, 404s, 429s, etc… Or specific AppSec rules) then that IP is blocked and sent to their central DB where it’s pushed out to everyone running crowdsec.

On my setup crowdsec has been more effective than cloudflare at stopping scanners and bots from overloading things, cloudflare just lets basically everything through so I stopped using it.

That said I’m curious if you remember the source of the real world tests, because I’d love to see what’s actually better.

Pangolin would work, it’s still wireguard underneath but with a webUI to set up things and simplify it. It’s fairly easy to install on your server with their docker compose examples.