• 0 Posts
  • 9 Comments
Joined 1 year ago
cake
Cake day: June 30th, 2023

help-circle



  • At the homelab scale, proxmox is great.
    Create a VM, install docker and use docker compose for various services.
    Create additional VMs when you feel the need. You might never feel the need, and that’s fine. Or you might want a VM per service for isolation purposes.
    Have proxmox take regular snapshots of the VMs.
    Every now and then, copy those backups onto an external USB harddrive.
    Take snapshots before, during and after tinkering so you have checkpoints to restore to. Copy the latest snapshot onto an external USB drive once you are happy with the tinkering.

    Create a private git repository (on GitHub or whatever), and use it to store your docker-compose files, related config files, and little readmes describing how to get that compose file to work.

    Proxmox solves a lot of headaches. Docker solves a lot of headaches. Both are widely used, so plenty of examples and documentation about them.

    That’s all you really need to do.
    At some point, you will run into an issue or limitation. Then you have to solve for that problem, update your VMs, compose files, config files, readmes and git repo.
    Until you hit those limitations, what’s the point in over engineering it? It’s just going to over complicate things. I’m guilty of this.

    Automating any of the above will become apparent when tinkering stops being fun.

    The best thing to do to learn all these services is to comb the documentation, read GitHub issues, browse the source a bit.


  • Bitwarden is cheap enough, and I trust them as a company enough that I have no interest in self hosting vaultwarden.

    However, all these hoops you have had to jump through are excellent learning experiences that are a benefit to apply to more of your self hosted setup.

    Reverse proxies are the backbone of hosting and services these days.
    Learning how to inspect docker containers, source code, config files and documentation to find where critical files are stored is extremely useful.
    Learning how to set up more useful/granular backups beyond a basic VM snapshot in proxmox can be applied to any install anywhere.

    The most annoying thing about a lot of these is that tutorials are “minimal viable setup” sorta things.
    Like “now you have it setup, make sure you tune it for production” and it just ends.
    And finding other tutorials that talk about the next step, to get things production ready, often reference out dated versions, or have different core setups so doesn’t quite apply.

    I understand your frustrations.



  • I get what you are saying, but the balance is off.
    YT premium costs (edit) more than a streaming service per month.
    There are no industry leading movies or series released exclusively on YouTube.
    YouTubes benefits of premium is “not being delivered ‘skip after 5 seconds’ live streams” as an ad that will play indefinitely (or at least for hours).
    Also, streaming services provide much better series discovery. Ie, find a show you like and easily discover the start of that series, then binge watch the entire series in order.
    YT premium is basically a “play next” queue, 1080p, and no ads.
    It doesn’t (AFAIK) support creators any more. It’s literally just a fee to not-be-inconvenienced, and it’s not great at that


  • If the router/gateway/network (IE not local) firewall is blocking forwarding unknown IPv6, then it’s a compromised server connected to via IPv6 that has the ability to leverage the exploit (IE your windows client connecting to a compromised server that is actively exploiting this IPv6 CVE).

    It’s not like having IPv6 enabled on a windows machine automatically makes it instantly exploitable by anyone out there.
    Routers/firewalls will only forward IPv6 for established connections, so your windows machine has to connect out.

    Unless you are specifically forwarding to a windows machine, at which point you are intending that windows machine to be a server.

    Essentially the same as some exploit in some service you are exposing via NAT port forwarding.
    Maybe a few more avenues of exploit.

    Like I said. Why would a self-hoster or homelabber use windows for a public facing service?!


  • How many people are running public facing windows servers in their homelab/self-hosted environment?

    And just because “it’s worked so far” isn’t a great reason to ignore new technology.
    IPv6 is useful for public facing services. You don’t need a single proxy that covers all your http/s services.
    It’s also significantly better for P2P applications, as you no longer need to rely on NAT traversal bodges or insecure uPTP type protocols.

    If you are unlucky enough to be on IPv4 CGNAT but have IPv6 available, then you are no longer sharing reputation with everyone else on the same public IPv4 address. Also, IPv6 means you can get public access instead of having to rely on some RPoVPN solution.