plateee

Would you make someone you love a home server?

No. Especially no for a non-technical, remote person.

Troubleshooting my lab in the basement is hard enough without having to try some weird screen share app, or telling the person, “press the blinky light button. NO NOT THAT ONE”.

If you want to share the joys of a home lab, do what I did for my technologically impaired in laws - get a wireguard VPN client on a laptop and walk them through (several times) the process of connecting to the VPN, browsing to your services, logging into the services, doing the thing, then disconnecting from the VPN.

• Show them the process while they take notes on the process.
• Let them follow their own notes with minimal help (except to correct the notes) while they do the process end to end.
• Repeat that last step a few times with zero feedback so they build confidence in the process.
• The next day, have them do it again based exclusively on their notes and memory.
• If you’re still in town, wait a full day and repeat the last step a few days later.

My in-laws are now experts at VPN’ing in and interacting with my services.

At work, I used ssh-signed certificates for Linux server access - those certs are only valid for about 15 minutes.

The whole idea of shorter lifetime certificates is to address if a certificate is compromised. (Especially for client certificates which, iirc, Let’s Encrypt no longer offers).

For a home lab? With no externally accessible services? Short-lived certs aren’t really a big deal. Nobody is going to be hacking your homelab, stealing your private keys, poisoning your internal DNS, and pointing you to a different, malicious service.

As long as it’s painfully French, I’m on board.

The only reason why I hesitate to recommend Ubiquiti cameras is even their cheapest offerings are kind of expensive.

And although you can run isolated from the Internet, managing updates is a bit painful. (Ask me how I know)

They gave POE cameras that will just work with an Ethernet cable (although they gave weird POE requirements). Their USB powered ones are wifi connected.

Source: I’ve had them for years and am happy with the setup.

Money doesn’t corrupt, it just exposes.

So in other words the exact opposite of what this thumbnail/article title is implying (that people are continuing to buy overpriced discreet graphics cards.

I’m running a 13th gen core i9 and an rtx 4070 on my rog zephyrus. It runs CachyOS beautifully.

No complaints for the two-ish years I’ve had it.

You could either set up DNS overrides on your inwards facing DNS server, leaving external resolution to something like cloudflare (with DDNS), or you have a second internal domain for internal resolution.

I chose the latter for my homelab - it’s service.lan.fqdn inside and service.fqdn on the outside. Since I use a wildcard cert, it’s still protected with TLS if I access it internally or externally.

Edit: this also solves hair pinning as your internal resolution will go to your LAN network, not your public IP

Me neither, whatever comes after would.

Hrm, the tinfoil hat part of me that thought the massive spike in RAM and storage was a bid to make the average consumer have to subscribe to thin workstations (so you own nothing, only run “approved” software, and have all your actions monitored for compliance) gets another supporting data point.

Edit: the full conspiracy theory incorporates the AI bubble and suddenly super cheap data center space with a metric fuckton of GPUs that can be repurposed. Why pay $3k for a gaming desktop when you can pay $100 for a little box that sits on your desk and RDPs into a cloud workstation in a data center 10 miles from your house?

Aren’t you supposed to do apt full-upgrade instead of apt upgrade?

Also wtf is pkcon for?

For me, I have multiple OIDC compatible systems (Proxmox, Netbox, Synology, Zabbix, Vault, etc).

So keycloak offers a SSO option to make my life easier with a single account to worry about instead of individual ones.

Plus MFA because it’s cool?

This one is bad - unauthenticated user account take over.

If you’re like me and only using it internally on a homelab, the risks are lessened, but if you expose keycloak to by the Internet - boy howdy

vim, because that’s how my father taught me, and how his father’s father taught him.

Choose vim! The generational trauma of file editors!