Anywherelan (styled AWL) is a direct peer-to peer-to-peer LAN solution for self-hosting and accessing services remotely without a server infrastructure.

Tailscale connections require an account identity (or OAuth authentication through services run by Google, Microsoft, etc.) I currently use it because it's codebase is open, and there are self-hosted forks (that I have considered as a future fallback), and it is dead easy to set up and use. It "just works."

However, this just popped up on my radar and I'd never seen it before or even heard of this technology. I couldn't find any posts about it, but if it works as promised, this would be a huge improvement in terms of my overall infrastructure. It seems like a somewhat young project with very active development, but the first release goes all the way back to 2022.

Has anyone here tried it? Is it any good?

Hiya, looking the a firewall for my homelab, mostly to experiment but also for a added layer of security. There are just two of us in this household with a few laptops, phones and my servers, so nothing much. Therefore looking for something affordable and not "overkill".

Anyone got any recommendations for this? Also how do you run your opensense/pfsense instance?

Appreciate any tips!

Hey guys, so I have been searching for the different ways to self-host a music-server and don't really know whats the best/most elegant way to go.

I know that there is navidrome and many also use jellyfin for it. Now I have a few questions:

• Are there any good apps for android for navidrome/jellyfin respectively?
• how easy can I add songs to them/do they pull metadata from somewhere (like jellyfin does for movies)
• how do they (or any other options) compare in terms of ease of setup/maintainability?
• do you have any overall recommendations?

Thanks a lot for any tips/recommendations and your help :D

I think I officially have a hoarding problem...

What is the best way to provide internet access to guests on a Proxmox VXLAN? Is it:

1. One node (host) in the cluster is the default gateway, all traffic is routed through it. Sounds clean and simple but there's multiple layers of jank to get it working, if it works at all
2. Have a guest (lxc or VM) on the VXLAN act as a gateway. Give it two NICs - one on the vnet and another on the hosts bridge (physical lan), route traffic through the second.

My default approach is the first but despite hours of tinkering and forwarding tricks it never works. I'm leaning more to the second but having a dedicated gateway guest seems like a waste of resources - logically the host should be doing it.

And yes, SNAT is enabled 😅

These are for ten years on a 1.1111b xyz domain

Godaddy $17 (unsure if includes protection) Dynadot $11.50 (with whois protection) Xyz $19.90 (with whois protection)

Its all very confusing. I just want to get a domain for my server as cheap as

I'm using Vaultgarden. Things are okay after losing my SSD yesterday morning. My strategy worked... HDD for data, SSD for the OS. I promptly found an available drive, installed Linux mint and recovered.

But that was scary. I keep a backup on another computer. The only way to actually run it and see the passwords needed to do anything was thru my phone. I was lucky that somehow the database was available offline. But if I had run out of battery I would be extremely screwed.

So I've decided the Vaultgarden is encumbered by not really having a local reliable copy. Maybe I'm wrong, but as I understand, if your server goes down and you log out, you're screwed... No more passwords until your server is up again. I find that to be extremely stupid unless I was protecting my severed testicles... No wait, that would be way worse.

So I'd there a server + local system? Like Joplin... You can write notes all day with no server at all. The server just Synchronizes it all. In the past I used syncthing and I will continue using it. One thought was to have an automated backup from Vaultgarden that was automatically synced to my various devices as a Keypass database.

cross-posted from: https://discuss.online/post/41958206

Open to suggestions for managing Caddy for domains from Porkbun.

• Porkbun itself is using Cloudflare.
• Their Caddy module is confusing to setup due to API changes and older documentation.
• I'd like to use a declarative json configuration, but first I just need Porkbun to play nice enough to work when adding subdomains via wildcard.

The Goal

Setup legit Let's Encrypt as wildcard locally to test services at *example.domain.com, then put them into production on mainsite wildcard *.domain.com on VPS or similar.

Seeking Advice

Can anyone advise on setup recommendations. I'm currently using Nginx, which I had no difficulty setting up with ACME challenge. Perhaps I'm approaching Caddy in the wrong way. Thanks for any ideas!

Hey all you beautiful selfhosters,

What are your suggestions for frugally obtaining HDDs in the current economic climate? Specifically the EU (Netherlands).

I'm looking at second hand drives, but even those go for €100+ now, with bad sectors and all.

Can we organise a collective AI datacenter robbery and doll out some stolen drives? 😁

Self hosting: real game starts today

@selfhosted

So, it's done: my main domain has finally got its transfer to Hostinger, new provider where I have the VPS I'm experimenting in.

Real game with WordPress multisite/multilingual and self-hosted Fediverse starts TODAY!

#activitypub #selfhost #selfhosting #wordpress #yunohost

Hey Hosters!

Just wanted to share that I got Jellyfin installed and set up on my Windows 2022 Server, and it’s working great! I didn't even know there was a version for WIndows. How do you like that?

I know this is probably “the usual” for everyone here, but I’m genuinely excited that I managed to get it all running smoothly.

After getting the server up, I went through the basics (users/permissions, library paths, and making sure everything was reachable on the network) and it all just worked. The interface is super clean, playback is nice and responsive, and it feels like I’ve been missing out on this until now.

Huge thanks to the Jellyfin team and the community! This project is awesome!! If anyone is stuck, please don’t give up. keep poking at the configuration and it’ll pay off. Now I just need to spend some time organizing my libraries!

Happy Hosting!

Breaking change in #FreshRSS for those of you with feeds on your local network such as RSS-Bridge or RSSHub: for improving security (SSRF), local addresses must be added to your allowed list. There are a Web UI and an environment variable INTERNAL_HOST_ALLOWLIST, whichever is easiest. Breaking changes in FreshRSS are rare, but this has been made default since not everybody is able to properly isolate their services. This has just landed in the rolling release (edge). Tests welcome.

Tempus is an open-source and lightweight music client for Subsonic, designed and built natively for Android.

This app works with any service that implements the Subsonic API, including:

• LMS - Lightweight Music Server - personal fave and my backend
• Navidrome
• Gonic
• Ampache
• NextCloud Music
• Airsonic Advanced

https://github.com/eddyizm/tempus/releases/tag/v4.20.0

My last release post was for v4.12.0 so I've included whats changed since that post.

What's Changed

Highlighting these 5 features that people have wanted for some time and were well received.

• feat: tile size manager
• feat: Implement a sleep timer button to the currently playing screen
• feat: offline playlist in dowloads view
• feat: add to queue, edit playlist in main playlist page
• feat: local radio station management, directory search, and radio cover art

And a ton of bug fixes, performance improvements and other features -> Full Changelog: https://github.com/eddyizm/tempus/compare/v4.12.0...v4.20.0

note app-tempo* <- The github release with all the android auto/chromecast features

app-degoogled* <- The izzyOnDroid release that goes without any of the google stuff.

As usual, any dev contributions appreciated as I am not actually a java/mobile dev, so my progress is significantly slower than those who do this on the daily.

Big thanks to all the folks who have been contributing.

https://nodebb.org/
https://docs.nodebb.org/installing/os/ubuntu/

Does anyone know if it's possible to achieve this? Possibly with an external service that syncs the two?

Basically, the last feature immich can't do that google does is to share albums. Sometimes my family wants to have albums after events, and my ones live in a silo.

I have a single Podman stack & Podman network - ingress via Caddy with crowdsec that forwards stuff to the various things I've got going. All self-contained in the Podman network.

I want to put Caddy in a VM to establish a "DMZ" (separate kernel) as I've seen recommended for directly internet-facing infrastructure. But to do that, I'll break my single Podman network across two "servers".
Because it is across two "servers", I need to publish the ports for the services on the non-VM server so that the VM can address them externally - which allows the services to talk to the internet (even if they don't need it) and allows the services to talk to each other on published ports (before I could have separate networks for each service, so BookOrbit can't talk to Jellyfin for instance).

How can I have the Caddy in the VM that deals with the WWW forward things to the server running everything but retain that closed Podman network topology?

And ancillary Q, what other things should be in that "DMZ" VM? Auth ODIC? Headscale? Just Caddy?
Edit: Caddy forwards everything to the Auth OIDC which forwards it along if the connection attempt is logged in. Will be adding mTLS to bypass that check eventually. That's why I'm thinking Auth ODIC should be in the "DMZ" VM too.

And lastly, Podman networking works just like Docker networking, so any topology is transferable if you've solved this in Docker!

WRT = with respect to

I have some subdomains that go to my home address (I know I should put it through a VPS first but I'll get to that when I have time).

If I connect to example.domain.tld and DNS records point back to my own IP, where does that data go to reach back to my device?

Edit: thanks for the responses everyone

My old laptop for self hosting just croaked, and I'm thinking of buying a 2nd hand mini pc, but this time I want to do it proper. I want to optimize the electricity consumption and specs needed/ future upgreadability, considering how expensive everything is now.

My use case is just for self hosting files (infrequent access and reducing reliance to google drive), and occasional dev workload via ssh. I'm thinking of buying a used optiplex with at least i6 gen cpu (SFF or micro form factor), but I want to see if there are better options.

There was a link posted in this subreddit about power consumption comparison of different mini pcs (raspberry pi, n100, etc), and I regret not saving it.

If anyone could suggest me better options it would be greatly appreciated. Thanks!

Recently, I saw icanhazip.com pop up in my pFsense firewall logs. It was immediately blocked but the name piqued my interest, so I did a little digging which revealed an interesting backstory.

It's owned by Cloudflare:

spoiler

spoiler

...but it hasn't always been theirs: icanhazip: How a simple IP address tool survived a deluge of users. Pretty interesting, at least to me as I have never encountered it before.

I have it still blocked as nothing I'm doing seems hampered by blocking icanhazip.com's ip range. Anyone else ever encounter icanhazip.com?

I think I found the source of the icanhazip.com block. From the Github Issues page:

2025-03-27 17:00:02] production.ERROR: Failed to fetch external IP address. [“cURL error 60: SSL: no alternative certificate subject name matches target hostname ‘icanhazip.com’ (see https://curl.haxx.se/libcurl/c/libcurl-errors.html) for https://icanhazip.com/%E2%80%9D]

ETA: Solved

I think I found the source of the icanhazip.com block. From the Github Issues page:

2025-03-27 17:00:02] production.ERROR: Failed to fetch external IP address. [“cURL error 60: SSL: no alternative certificate subject name matches target hostname ‘icanhazip.com’ (see https://curl.haxx.se/libcurl/c/libcurl-errors.html) for https://icanhazip.com/%E2%80%9D]

Yup, I'm posting another this week. Sorry.

This week I'm hoping we can wrangle a solution around AI and our selfhosted community. There are plenty of strong opinions (both pro and con), but one thing is for certain - there needs to be better disclosure in promo posts. Two options (that aren't mutually exclusive):

• Any posts of an AI focused, AI Developed, etc software gets an [AI] tag. No, a [Not-AI] tag is not needed to accomplish this, thats kind of a "non-golfer" sort of tag.
• Comment requiring an AI disclosure response to every promo post, if its not detailed in the post itself. Specifics (generating docs for commands, translation, whole-boat vibe-coded this app, etc) would be requested.

I will say that having disclosure and/or tagging would mean that comments that just say "slop" or "fuck ai" or whatever would be off topic at that point, that information is already provided, so its just noise (and sometimes pretty uncivil - I've been light on that for now due to the need for a rule on this).

The tag [AI] would make it easy to filter out (or search for, if that's your thing), but there is a wildly different degree of AI use out there, and from the posts with a positive score, its usually due to responsible AI use (translations, a snippet they had to do something obscure with, available to use with AI but doesn't require it, whatever), which is why I think the disclosure has a place as a benefit to everyone.

Please provide any input or alternative options on this, and I can then put it to a vote like the last one. Comments seem to be the best approach without involving something off-site, but if you have a better idea/option, please share.

This is an alternative to manually typing your password to decrypt your home server disks.

The idea is that you have a Tang server somewhere on your local network. When your server boots up, it needs to communicate with the Tang server to unlock the disk. Tang doesn't store the key and is stateless, but the client requires Tang's cooperation to compute the key.

For me, I'm thinking about someone breaking into my house and stealing my computer. Currently, I have LUKS read a keyfile from a USB drive... but I almost always leave it plugged in... so a thief would probably accidentally steal that too.

With this setup, I'm thinking maybe I could setup a Pi on the opposite side of my house, ideally hidden. And then if my home server gets stolen, LUKS wouldn't be able to reach my Tang server, and therefore not unlock anything.

In an effort to make the sidebar a bit cleaner, and allow for more thorough explanation of the rules, this post has been made. Comments are disabled, to start a discussion with the community about this post or the rules in general, please make a meta post. Please stick to one specific item to address as your post to keep discussions on topic.

If you see a rule violation, please report rather than interacting with the post/comment.

Rules:

1. Be civil.

This is a community of collaboration. We aren't here to put each other down, but lift each other up - helping to improve efficiencies, find the right solution to deploy, or work through bugs.

Disagreement and strong opinions are welcome, being degrading or disrespectful is not.

A good reference would be the Lemmy.world Terms of Service as well as the ACoC.

Sexism, racism, ethno-supremacy, homophobia, slurs for ethnicities, genders, sexualities, etc, will not be tolerated. If you see it, report it. Don't interact, as the comment chain will likely be nuked.

2. No spam.

Spam is not “I don’t like this”.

Spam would generally be considered:

• Mass-posting - Posting the exact same post across a bunch of of different communities, rapidly. Cross-posting is not spam, but cross-posting to communities where it wouldn't fit, is.
• Repetitive Content (aka karma farming) - repeatedly submitting old popular content. This is completely irrelevant on Lemmy,, but the behavior is still not permitted.
• Bot Activity / AI Abuse - Using scripts/bots/gen AI to automate posts and comments.
• Unsolicited DMs - Mass private messages or chats to users, completely unsolicited

Bots are allowed, but see the Rules of Use for Bots on Lemmy.World, where this community is located. Please be sure to review these rules prior to using a bot in this community.

3. Posts are to be related to self-hosting.

Please ensure it is clear in your post how it relates to self-hosting.

If you see a post where there is a more appropriate place for the discussion to take place, such as a linux or networking community, please feel free to recommend it to the user as well as report.

From a community discussion on this rule:

• Posts that are better off in a different community (not just intent, but also a community thats appropriately supported by activity) will be locked only after that community is noted. Posts will not be deleted though, only locked.
• If there is an influx of simple posts about hardware, pictures of setups, etc., then we can go ahead with a weekly sticky for that content.
• Low effort content is currently well managed with upvotes and downvotes. If there is an influx of low effort content, we can use a different approach.
• Repeated common questions, once enough of them are being seen, will go to an FAQ post or a wiki.

4. Don't duplicate the full text of your blog or readme if you're providing a link.

If everything you're posting is in the link, there isn't much value to adding that text. If you're going to add text, make it contextual. Summarize it, mention why selfhoster's might be interested in the news link, how you're using this software, etc.

5. Submission headline should match the article title.

Add supporting or related information in the post itself rather than the title.

6. No trolling.

Trolling is deliberately posting something offensive, nonsensical, or provocative to bait people into arguments or to get an emotional reaction. Its disruptive and manipulative, and is not permitted here.

A few key characteristics:

• Baiting: Comments / posts to make people angry or confused
• Derailing conversations: Ruining meaningful discussions by steering them off topic

Downplaying this behavior by claiming it was "just a joke" will not impact moderation decisions. See rule 1.

7. Promotion posts require your active participation in selfhosting or related communities, and your account must be at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See this link for further details.

• Active participation is defined by the 10% rule - no more than 10% of your posts or comments may be self-promotional, or your post will be removed. That is not per-project, but your account as a whole. If the entirety of your post and comment history is your blog and projects, then your post history is entirely self-promotional.
• Account Age has been added as a requirement to mitigate frequent posts that were being seen within the community. This rule applies in all cases, whether you intend to post about a paid or F/LOSS project. There are no exemptions from this requirement.
• F/LOSS Exception: If your post is about a project that is completely open source & can be self-hosted in full without payment, your post is exempt from the 10% requirement. The exception does not exempt you from the account age requirement.

This post will receive updates as rules are updated.

Hi everyone.

Given some recent.. issues with Bitwarden's leadership, I've been toying with Vaultwarden. It's been great, and supports pretty much everything I need.

I currently locally host the vault, but I'm realizing that this could cause problems for my family if something were to happen to me. While not technologically inept, if my server at home crashed they would have no idea how to access it, and they would lose all of the passwords.

I was thinking that a vps might be a better choice for this, possibly with some reboot automation in case of outages. That would allow them enough time to initiate the emergency access and import everything before anything happens to the passwords.

I've also got encrypted M-disc backups of the most important passwords with timestamps of when they were last set. I've demonstrated and written down instructions on how to decrypt these. Of course I also have other backups, but I doubt they'd be able to retrieve the non-physical copies of the backups.

Anyway, is that what most people here do with Vaultwarden, use a VPS with mTLS or VPN? To add, I would only use a tunnel for this if I go this route, so no open ports.