The simple way is using some bullshit free domain of the ddns provider, and cname to that from your domain

Recurring unconditional pushes, awesome :)

Can’t announce </24 :(

Or >/24.…. Depending on semantics :)

I run PowerDNS as my DNS server. This supports rfc2136 (iirc) which can be configured via the dnsupdate tool for example. and then a webpage that allows to register new names. i added two columns to the powerdns databse “dyndns” as a flag if this domain can be used for ddns and “webkey” as an alternative update mechanism via wget. some small php script that does the sign-up and update in the powerdns database.

As a selfhoster, I host my own dyndns :)

I’d argue it’s even more secure, as it reduces the amount of attacks you are exposed to. For targeted attacks it changes absolutely nothing. But it keeps you our of a few DBs and spares some brute force attacks.

Nice. I recently migrated from bind/isc-dhcp to dnsmasq, which has a cleaner 1-line per reservation syntax. PowerDNS is what I manage my domains with, but not in my home-homelab.

I run some china box with 5 integrated 2.5GBe NICs, 48GB RAM and 2x 500GB SSD/NVMe. CPU is Celeron® 6305 @ 1.80GHz, two cores or HT, who knows…

On this I run Proxmox. I didn’t like Proxmox integrated firewall, so I rolled my own.

all containers unprivileged

one container is the firewall. it has all up+down stream NICs mapped via bridges, cable internet, backup 5g internet on dedicated ports. one port to the switch with a few VLANs, and one bridge that is local to the Proxmox for the local VLANs.

Every service I operate sits in its own network/segment, usually with a /30 netmask. VMs/containers have a eth0 device in this and the firewall defined as default gw. On the firewall the VLAN interfaces are named as the container/service. So the interfaces are not eth0 but wan, wan5g, frigate etc. Great for readability.

Some networks like “family” or “guest” or the one with the APs/WLAN-controller are /24. Bit big, but what ever.

I have a structured netfilter firewall script, fw.sh calling it’s parts under fw.d/*fw. Each service is managed individually, sometimes widely open (iptables -A FORWARD -i frigate -o wan* -j ACCEPT) but usually down to the required ports. Database, reverse proxy etc all on separate containers.

There is also like 30 VPN configs from 2 VPN providers. I have a home assistant dashboard where I can direct specific devices to use specifig VPNs. My webradio is routed via UK so I can enjoy BBC2.

root@mercury:~# ip rule show
0:      from all lookup local
20:     from all lookup main suppress_prefixlength 1
300:    from XXX lookup wan_table
310:    from XXX lookup wan5g_table
1000:   from all fwmark 0x1 lookup bbc-ss-lon
1001:   from all fwmark 0x1 lookup bbc-ss-man
3000:   from XXX lookup pm-gb
4000:   from all lookup wan_table
5000:   from all lookup wan_table
5100:   from all lookup wan5g_table
32766:  from all lookup main
32767:  from all lookup default

ip rule also does the fail over to wan5g if required. There are some rules where I tried to auto-filter BBC traffic with marked connections via dnsmasq, but BBC knows all my VPNs (not BBC radio it seems).

IPSec VPNs and other OpenVPNs (dialup, site2site) are handled via a dedicated LXC. There is a tor entry node container, for a few services and one of the public WLANs. Firewall makes sure certain traffic can only exit via certain upstream interfaces, vpn*, wan, wan*… very helpful

I didn’t like opensense… don’t know why. Work a lot with firewalls in my job (mainly check point, fortigate) so have some professional background.

Also: client isolated WiFi for all iot shit. No internet for TV (jellyfin), PV controllers and most others.

deleted by creator

dang, suddenly Magnum shows up :D

I’d totally see the risk if the clients were not available as open source. But they are. So I’m not.

They might diverge, but vaultwarden users will just fork. Nobody who is using official clients with vaulwarden will be “oh dang, now I have to buy bitwarden, so long vaulwarden, was fun…”

What is “the API”?

The API is implemented by the bitwarden back end.

The API is also implemented by the vaultwarden back end.

The open source bitwarden client does talk the current version of this API. The open source client can be forked, so there is without much effort a version speaking this protocol in this version and is FOSS. Just the name will be different. I guess “vaultwarden client” would be fitting, but what ever.

The api is implemented in Foss front&back end… I don’t know what you are talking about

The back end is already solved by vaultwarden, so I’m not sure what you mean

I highly doubt future compatibility. Things will diverge. I care about having a good hostable password manager. I don’t care about the name of the client or if it’s compatible with some closed source shit.

There is certainty that the Foss version won’t be worse than current bitwarden client. Then those will diverge. So?

well, the first step of forking is clicking a button or execting a “git clone” command. thats trivial. publishing to android is a bit of work, but very one-time.

keeping up with development is a different story - but many foss projects thrive with support from whoever needs to have something fixed.

License is: all rights reserved.

That’s free like in beer, and open like ‘allowed to inspect’ that’s not what most people mean when they talk of Foss.

source: https://github.com/AChep/keyguard-app/blob/master/LICENSE

History shows this will happen. Or do you have any counter example?

Mariadb, libreoffice and most recently OpenCourant

There will be… Some fork at least