Thanks for saying that, I have been loving immich on one of my pi 5’s now I am going to need to replace it. I am thinking Ente, just cause it is FOSS with paid tears just like vaultwarden/bitwarden.
I have stopped using Nextcloud because I can never get things tuned right, and I feel it is trying to do more than it should.
I have a 2014 mac mini running Debian (just the CLI although I did use the GUI to set it up just removed the GUI later) and it hosts my Jellyfin and *arr stack. I just installed rEFInd on it and booted it to a USB drive with Debian on it, knowing it worked enough to do that much I ran some tests, every thing excluding the HDD said it was working ok. So I stuck an external drive to it and installed Debian on it. In a few weeks I am hoping to inherate a 2018 Mac mini but as I understand it it will be a little more difficult because of a T2 chip or something, not impossible just not as easy.
Sounds neat but I would be worried about the no shell stuff, I run my things headless for the most part and like SSH and occasionally VNC access.
Thank you for coming my nerves, I have been seeing a lot of things on this some sensationalizing this as a big issue and some saying it was not really a big deal. I broke and went to see what of my homelab that really touched the WAN had php, I removed somethings and decided to risk it for someother things.
If it is for backup I will give you that.
Pihole is runs on pi zero’s I am sure you would not have any problemswith running it on your pi 4’s. I have my primary pihole instance running on a pi 5 with a bunch of other things, my secondary pihole instance is running on another pi 5 that used to run ghost which hosts my webpage.
I would say put pihole on both, also put unbound onto whatever one you decide is your main pihole. If you are going to get pihole and setup Matrix with the Whatsapp bridge may I suggest you get a firewall as well, something that you can flash OpenWRT onto. I have a Flint 2 that I have multiple vLANs setup on for security, but also a VPN so that I can have the benefit of all my services away from home. It is something that I wish I had setup a lot sooner.
Of course you will need a static IP address for this, for me my ISP gives them out for free but I understand that it is expensive elsewhere. I do however hear there are apps that emulate static IP’s for things like wireguard to use.
Don’t be stressing the pi out to much, maybe look into investing in more than 1 pi! I personally have had Jellyfin running on a pi 4, a pi 5, but it is currently running on a 2014 Mac mini (with Debian installed).
I have 3 pi 5’s, one pi 4, and a pi 0 2, an old Mac mini running in my LAN, and a VPS running my simple blog and encrypted backups. Shuffling things around is a thing you do as your homelab and services expand.
This hobby becomes an adventure.
They are just pluged in, with battery saving features turned on.
But why? If it is backup I personally have a VPS that backs up stuff and runs a few services. In a few weeks I am hoping to have a second off site backup as well.
I personally use retired devices around the home, they are put on my IoT vLAN and wam bam thank you man I have a kiosk.
My passwords for OS and all admin dashboards are extremely long, unique, random strings managed by Bitwarden.
If you are paying for Bitwarden, or using their free tier, stop and and start hosting vaultwarden. You can still use the Bitwarden app, with vaultwarden but with all the premium features.
Get a firewall you can either install OpenWRT or opnSense on, when making my decision I went with OpenWRT because opnSense has a webpage that tries to upsell you. vLAN the heck out of your place, and set up a VPN to access your services like vaultwarden out side of your home. On a vLAN that cannot access your WAN or anything else put your IoT things, on a vLAN that cannot access anything else setup crowdsec. On the topic of crowdsec it should be your only device that port 22 is ssh!
For your IoT things set up home assistant, which should be on a different vLAN that can reach out to the WAN and into the IoT vLAN to control stuff. I wish I could say I have completly degoogled and deappled, but I am waiting for a year for my iPhone to stop getting updates and whenever for my iPad to stop getting updates. I should probably replace my homepod minis sooner rather than later with the Naebu things for HA. The only thing I still have a Google account for is youtube but once I get a hand me down Mac mini I will install Debian and get a youtube replacement with sponsor block.
One of the things that finally got me off of cPanel was the host I was using decided to rape me over the coals without letting me have a wildcard email address so I got a business plan that I could have unlimited email addresses so if one got spammy I could just turn it off and if I still used the service I just changed the email, or if I wanted to extend a free trial I could just spin up a new address. So I recently moved to a new host that offers wild card addresses.
Get a whole LAN adblocker, let it be pihole or adguard home, there was recently that spyware ad pixel so expect more of those in the future. Me personally use pihole and have it very finally tuned to block a lot. I tried adguard once but liked pihole better, this was years ago even before I had pihole finaly tuned so don’t ask me why I liked pihole more.
What I have done to harden SSH is:
- set up pubkey authentication and disable password authentication
- disable root login
- not expose my SSH port publicly; it is accessible only from my LAN and through Wireguard
I have done those things as well, but I have also
If it was just for backup backblaze is probably less expensive but my LAN consists mostly of pi’s and hand me down computers. I am slowly moving things around on my LAN so to each their own I guess. I like the idea of having more control over my stuff so having a whole Debian system on the other end feels right for me.
*edit: It also gives me peace of mind knowing that I can encrypt my stuff to my liking. Silly me I forgot to actually look at the encryption tool I used, I just did a search and found age was highly suggested. It is coded in Go, sure it is open source and all that I am just not a fan of the language.
My flint2, came with OpenWRT, but I installed a vanilla OpenWRT onto it it handles my many different wifi APs, all my vLANs, and a couple VPNs. I have a finally tuned pihole setup, I could not imagine changing it, I was watching this video by SomOrdinaryGamer so I went to the site he made an example of and I got no ads with just my pihole.
I meant no shade, I know it takes a lot of work to do everything I have done for security/ad blocking.
I was backing up multiple places on my LAN but than half of my place flooded, so lamenat and carpet was ripped up, one of my pi 5’s was misplaced with a NVMe drive and another was lost. Than just down the street 3 house went up in flames had the wind been blowing just a little south my condo complex would have been burnt to the ground. After the fire fighters were telling us to get back further and further I had my main pi 5 that had all the backups of everything important on another NVMe drive and a few other things ready to go if the firefighters started banging on my door telling me it was time to leave. I wish I could honestly say that was the day I decided to get a VPS and start my back up, but I was still hoping my father would let me set up a pi with a drive big enough to do back ups at his place. It sounds like he will but he is concerned about security risks about my VPN, funny thing is my back up pi would be the most secure thing hooked up to his modem/router and I wouldn’t want his stuff touching my stuff and with how my LAN and VPN are set up they would have a hard time doing it. Anywho I have a domain hosted by EasyDNS, and just went and looked at their VPS options and got some year long plan and set up cron jobs to take the stuff I want to backup and use age to encrypt it and than it is sent to my VPS each age container is than deleted after there is something of the same name but 3 days iterations older and deletes it.
Yes, from what I understand. They are using ad services from the big ad companies, and because capitalism sucks they are completely fine with selling the spots.
if you do not have a system to VPN into your home I would suggest get a firewall (preferably one you can install openWRT of opnSense on) and VPN into your LAN when away from home.
I have a finally tuned pihole that offers different blocking for different vLANs on my home network and VPNs, I would not trust a third party for ad blocking. However you do you.
I was watching SomeOrdanryGamers video on this and his pihole did not block all the ads on an ad infected site, but mine could. I have used canyoublockit many times to stress test my system, wish there was something newer though.
Wow they gave you a time to come back, they have just said I have surpassed my 5 free articles for years now, I think it is because I am using a “DNS sink hole”/adblocker I do not care enough to turn my pihole off just to try and read it.
I have gotten a static IP, and clear my cache regularly since my last attempt to read a wired article so it is not that they are using anything to see that I have tried them before.
Nextcloud was not my first selfhosted thing, I was paying a service provider for it when I started self hosting everything else I was already frustrated with how nextcloud did not play well with my homelab so I thought why the heck am I paying for it. I have never had good luck with Nextcloud.