I'm looking for advice on setting up kiosks for a smart home.

I'd like to have 2-3 touch screens setup to control devices from.

I've decided on the following:

• preferably plug in devices/screens (with no battery)
• e-ink screens would be preferable but not a must
• cost is a factor

Anyone had success in setting up something similar?

Right now I'm creating a nightly restic snapshot of my server on borgbase and on some spare drives, and keeping the snapshots forever. There's a ton of daily churn in my data though, between databases and logs and other files that don't constitute 'real data' but might be needed to restore the app.

I've been using Duck DNS happily for years but it's been down more than up for the last month for me and I think it's time to switch.

I saw this and installed it but the WebBluetooth doesn't work regardless of the browser I used on Android. Can someone tell me if it's possible to use this on your phone? I can't move my desktop to where the bike is. Also I've never used Chrome on my phone and I feel raped sybernetically for being used like that to install that piece of shit data hording browser.

I've had several occasions in my life where I've tried to switch to Linux only to run into hardware incompatibilities that would have taken me man-months to solve. Thanks to GPT my primary personal PC, home media and project server is now running Linux and fully functional. I've got Jellyfin, NextCloud, Navidrome and Joplin all happy. I've also been able to wipe an obsolete MacOS off my 2017-era Macbook Pro and it's happily running Mint.

There's a deep irony in Windows being enshittified by AI, while the same AI makes Linux about a billion times more usable. Now I have a leftover Windows micro-PC running a local LLM model, so I can be less dependent on GPT, as long as time isn't a factor...

Built when Netflix first took away password sharing. Thanks for the heads up Netflix! Would not want to start this project now 😂

Hi selfhosters,

I'm considering improving the security of my homelab/server setup and I'd love to hear some more experienced opinions on my plans.

Like most self-hosters, I started out with a single-server setup: I cobbled together some old hardware, slapped on a NAS-style OS, bolted on Docker and started experimenting. As things go, my setup has grown a lot over the years. I'm running a lot on that machine - NAS capability, local DNS via pihole, a Wireguard VPN endpoint (so I can tunnel into the LAN from outside), many private services (accessible only from inside the LAN), but also some public ones accessible from the open web.

Although I've tried to do my homework in terms of security (various hardening measures for SSH and Docker, reverse proxy, proper SSL termination for everything), I realise I've put a lot of eggs in that one basket and I might want to introduce some network segmentation.

I don't think I'm ready for getting a hardware firewall or a router/switch capable of VLANs just yet. What I'm considering, though, is putting my services available from the open internet on a separate server inside my network - a little Pi 5 I've still got lying around. My idea is that if a container on that is breached and if an attacker manages to escape the container to gain root access, compromise would be limited to the few of publicly available services I have on the Pi, thus limiting blast radius. If combined with (software) firewall rules that make the Pi a 'pariah node' (dropping all incoming connection efforts), lateral movement to other devices on the network could be contained.

An alternative would be to finally make the move to Proxmox. Everything would still be running on one physical machine, but I'd create several VMs: there would be one for private, one for publicly available services, and I'd firewall the latter off rigorously so it cannot connect to anything else.

I'd like your opinion on these plans. Which one would you recommend? Are they both sound, or is there anything I haven't considered? Are there other (easy, non-hardware intense) things I could do to improve security even more?

I run DietPI on one of my SSDs. SSDs are inside USB adapters connected to USB hub. Recently I started from scratch.

I have tested already:

• dockerized Navidrome music library with Tempus android APP via Tailscale. It needs some tweaks I guess for losing connection or music streaming stutters though.
• Moonlight + Sunshine game streaming. Although I have not figured out how to handle problematic wireless bluetooth ps4 connection in RetroArch.

Starting from scratch so I guess I will stick to basics for now

• SSH
• dockerized Pi-Hole

Then maybe will gry to play with dockerized

• Forgejo
• Nextcloud
• Obsidian (self-hosting?) abilities
• Teamspeak and move from there.

Im more interested in development now, less in media server stuff.

Any upgrade recommendations are welcome. I thought about Thin client like wase, but will swe. I still have some empty slots for 2 more ssds ;P

Hello selfhosters! I read here a lot, longing for the day to get back into it. I have a little plan to do so I have access to some thin clients with decent enough hardware to run a small file server. I’d like to set one up for myself and as a gift to my partner

I keep getting lost in the jungle of options and incompatibilities so I was hoping to enlist some help in selecting a stack

I’m looking for open source software in the base, maybe truenas but I prefer debian and my partner uses LMDE already.

• On top of that should be a simple file server for backups/network storage. Some interface for managing storeage would be huge too
• Wireguard with an interface
• Having a simple container interface for future features like homeassistant and jellyfin et al is great too.

Open source and free is a must and I want to avoid risk for future lockins and freemium/ripe for enshitification-software as far as possible. And no or at least responsible llm use if that even exists anymore. Happy to shed featues to acheive that in combination with longevity. Is plain debian or even ubuntu the way to go or are there more optimised distros? Or am i just describing fedora with cockpit? Im not lost in linux itself, just overwhelmed with the endless options hoping someone can help me make a plan!

Would you make someone you love a home server?

Hello,

I stopped using TeamViewer a very long time ago. Since then, I’ve been using DWService and I’m quite happy with it. I like the fact that I can access to the terminal without launching any graphical component on the machine (which is handy for my headless servers, and allows me not to open SSH port). I also like the fact that it works even if my VPN server is down, as I can access remote servers that aren’t accessible via the web when they’re no longer reachable through my VPN.

However, there are a few issues that are bothering me more and more. I’ve switched my mum’s computer to Fedora and, whilst it worked perfectly under Windows, remote control is very buggy under fedora because the connection isn’t great. Furthermore, it’s impossible to access the screen if the computer isn’t unlocked.

So, I’d really like to find a solution that meets my criteria:

• Accessible via a web browser
• Ideally open-source
• Free
• Ideally self-hostable, but I’m worried that if, for example, my reverse proxy or VPN crashes, I won’t be able to access my machines to debug them?
• Allows access to servers without a monitor
• Allows access to computers running Fedora without the need for prior unlocking

Thanks!

My father owns a NAS by Synology. I have a sneaking suspicion that it might have been infected by some form of malware. I noticed for example it often increasing in overall and specifically fan noise at odd times and when nobody is using it.

What are tools I can use to scann it for unwanted intruders and if found get rid of them?

Now that I have time for hobbies again I wanna dive right in to building up a home lab. Right now I just have a Netgear router that reached end of life, and a NAS i'd like to make accessible remotely, and a DIY router seems like the correct next step for me. I'm very interested in ad-blocking network wide and someday I'd like to host my own little webpage, but for now I'm really just barely getting started.

I'm information gathering, I don't know what I don't know and my networking skills are pretty weak anyway. But even if your needs and desires have nothing to do with mine, I also just like to hear people talk about their set ups. Please? 🌞

I called my ISP today to set up a static IP because my services keep being taken down from my IP changing. I either need a business plan or a 5-10gbps residential plan to do that...

I cannot get on the business plan without a valid Business ID so that's not an option. And no way in hell I'm paying for those speeds.

Anyone have any alternatives to stop this from happening so often? My public IP seems to change regularly every 2-3 weeks and it's getting pretty frustrating having to reconfigure things. I only have 2 ISPs in my area and they are both terrible. I assume I'm out of luck, but maybe there's some tech magic I'm unaware of.

I'm going to be away from home for a few weeks and would like to access my computer (LMDE) while I'm away. Remote desktop connection would be ideal, just file transfer would be acceptable.

Is a VPN necessary, or can port forwarding be good enough for a one time use?

What software/networking recommendations do you have?

Hi folks!

Ten months ago I started Ideon as a side project. This week it reaches v1.0, with 640 stars on GitHub. Thanks to those who have followed along from the beginning, this really means a lot.

What's new in 1.0: the canvas has become a Git artifact.

A project now syncs to a Git repository. The structure, notes and block positions are version-controlled as files inside an .ideon/ directory, with a manifest and SHA-256 checksums. The rest of your repo stays untouched.

In short: you edit the canvas, you push, and the project history sits in Git like code. Every change shows up as a file diff.

The rest of 1.0:

• Database block: typed columns, search and aggregation, all on the canvas.
• Mermaid block: live rendering, editable source, PNG export.
• Chained audit trail and sealed records: every state change is traceable and verifiable.

What's next:

• A plugin API, so the community can build its own block types.
• A desktop app. It's Docker-only for now. I'm solo and can't test every platform properly. That comes if the growth justifies it.

Where this goes next: the canvas stops being a map and starts being a system. A graph that remembers everything, connects the dots, and eventually reacts on its own 👀.

If you want to try it: a plain docker run works for the SQLite build, docker-compose if you prefer Postgres. The repo-sync guide is in the documentation.

The project: https://github.com/3xpyth0n/ideon

(Not the registrar. E.g., .com TLD is operated by Verisign.)

I wanted a domain for my e-mail. Sounds simple.
But I am a major overthinker, so over the period of past 2 weeks (damn!) I've been deciding between e-mail providers, choosing potential domain names, choosing a TLD (round 1 - by price and looks), looking through registrars, deciding whom to choose for nameservers, and now I am comparing registry operators (TLD round 2).

There are differences, such as who can register a domain, restrictions on domain privacy, and some TLDs like .dev are on HSTS preload list.

Currently, I am mostly looking at EURid with .eu TLD.
What piqued my interest is being able to transfer a domain directly through the registry. So, if a registrar locked me out or shut down, I could still transfer my domain.
From EURid:

From your registrar: Your first point of contact should be your registrar.
From the My .eu platform: You can also issue the transfer authorization code yourself on the My.eu account.
From EURid: This should be done only as a last resort. After proving you are the holder of the domain and cannot obtain an authorization code from your current registrar or via the My .eu platform, you can request an emergency transfer authorization code directly from EURid

Alright.
But I must wonder, how do I prove my ownership?

First sign that this may not be that secure is right on the same page:

Print the form, sign it and send it to us via email at authcoderequest@eurid.eu. If the requester is an organization, please print the form on company letterhead paper or add a company stamp.

OK, the form. Here's the request page. Fields are domain name, first name, last name, job title, email address, and reason for the request.

I generated the form to see what's there. So... is this the security?:

I hereby confirm that I am the rightful holder of the domain name mentioned above, or that I have obtained the legal power to represent the holder, and that all data provided is true and correct. I am fully aware that making a false statement in this matter is considered fraud and may have judicial consequences.

I mean, it doesn't even sound like they collect your signature during the verification, not that a picture provides much security. This is one of the methods:

You can receive a small bank payment (less than one euro) from EURid, which includes a 10-character code that starts and ends with “EU”, with six digits in between (EUXXXXXXEU). After receiving this payment, the domain holder logs in to the My .eu platform and enters the code to verify their registration data.

Either way, it seems this might be mitigated by registry lock:

The Registrar Lock Service will also protect your domain name from accidental changes, but the difference from Registry Lock is that a locked domain name can still be transferred with an authorisation code sent to your My .eu account or an emergency authorisation code received from EURid.

Enough about safety. What about privacy?
The T&C [PDF] prohibits the domain having info of the registrar:

Your registration data must be your own data and must not be that of your Registrar, or of a proxy holder or a representative of a natural person or legal entity who does not meet the eligibility criteria. You may at any time check your registration data via the web-based WHOIS or the secure registrant portal available on our Website.

But it gets a bit better in the WHOIS policy [PDF]:

When the Registrant is a natural person the Registry publishes the Registrant´s e-mail address and language.

Alright. I hope there's someone else who took a similarly overcomplicated route in choosing a domain name.

Selfhosters what is the power draw of your entire setup? And have you done anything special to manage it you'd like to share?

Including all network equipment I use around 110kWh of good ol' 120V 60Hz USA juice per month. Averaging about 215 watts of power draw for my systems. Nothing amazing, but I like to think that it's a conservative setup for everything I accomplish with it. I'm paying around $25 a month for my setup. None of that includes my work PC or personal PC, just hosting infrastructure.

Other than trying to make sure all power states are available on my server I haven't done a lot of power conservation.

I'm curious what you all have.

At work I was asked by a different team how we can deal with bots, because someone in my team remembered that I knew how to do it.

I reluctantly suggested Anubis because I got shit for it last time, This is the URL https://anubis.techaro.lol/

This is the 2nd and last time I will ever recommend Anubis anywhere at work to deal with bots because of how unprofessional, un-serious and weird others perceive it.

The mascot being a ~10 year old "cutsie" anime cat girl is weird in a work setting.
I will never put myself in a situation again where I have to explain that it's not weird to anyone again, same for that URL.

What is a professional looking open-source alternative to Anubis?

Edit: No I can't just send my colleges here https://anubis.techaro.lol/docs/admin/botstopper The issue is they find the Mascot and domain weird, they will still run into both.

My Goal: Recommend a Open-Source bot protection tool

The Issue: When I send my coworkers to https://anubis.techaro.lol/docs/admin/botstopper they find the mascot and URL weird.

Result: They don't see Anubis as a serious tool and turn away from it

What is a professional looking open-source alternative to Anubis?

Hello everyone!

I have been having a hard time finding a solution to my problem of sorting music from both Youtube music and Bandcamp. I have tried Picard and while it is good I have had problems with it. For example it has made songs shorter (they now end to soon.). So far the only solution I have found is to use Picard and manually review every song I own, and since I have thousands of songs It would take quite long.

I'm using Jellyfin with Finamp to play my music, and sometimes add lyrics via the Jellyfin app when they are missing.

How have you people solved this or similar issues? Does someone have a automated setup that works well?

Possibly it would make more sense to ask on the 196 community based on the company's energy.

Anyway, I was browsing EURid's list of registrars, and this company's logo took my attention. However, I can't find any experiences online.

I've checked through their websites, and so far my feelings are a bit mixed. Although most of it is just outdated or somewhat inconsistent bits across their websites.

Things that make me unsure

First and least important is info about one of the people behind the company, "Alfie". Links on the about page are just completely outdated and dead. Website link in docs is at least alive, but also outdated, as can be seen by navigating in manner of URL in docs -> keybase -> GitHub -> newer website.

Second, the "Email us" button on the contact page redirects to a contact form, which really contradicts the text below:

If you want to send us a PGP encrypted email, please use the below key. Remember to attach your own key (as application/pgp-keys), so we can encrypt our reply to you.

That sounded so cool when I've seen it, but what e-mail address?
The contact form is on a "support" subdomain of their other website. This seems to be centered around the contact form, but there is also a "Manage PGP keys" button which redirects to a login page.
Maybe they migrated to that?
But then going to contact page on the domain's second level does show an email, as well as linking to the same contact form.

Third, in the list of services, there's also "Email"... which presents a self-signed certificate. Ignoring that, there's just an "Unknown URL" error page.

We're probably not responsible for this domain.

Lastly, and most importantly, right on ther main page it says:

Proxy registration for .eu

And that's the only mention of that feature. But what is it? If following ICANN's definition...

Proxy Services – Proxy services allow a domain name to keep certain identity and contact details from appearing in public Whois information. The proxy service becomes the registered name holder of record, and its identity and contact information is displayed in Whois data.

...it might be a problem. Because, let's take a look at T&C of EURid (PDF):

Throughout the Term of your Domain Name registration, you must: [...] b. keep your registration data accurate, complete and up-to-date at all times. Your registration data must be your own data and must not be that of your Registrar, or of a proxy holder or a representative of a natural person or legal entity who does not meet the eligibility criteria. [...]

There's also an annoying requirement for tax reasons, but that's not their fault:

In short things are about to get a lot more complicated. We will need to collect at least two pieces of non contradictory evidence about which country you’re resident in, so we can pay the correct tax authority.

And what caught my attention (in a good way)

As I've said, I checked them based on their logo. That's not a usual company logo.

Pricing for .eu TLD is OK.

Their ToS is short.

One button on bottom says "there's no ai here!".

Looking at the about page, this seems to be a small company operated by 2 people.

Looking at their mailing list archive, they've used to have a VPS service, gave shutdown information in advance (though less than 2 months), and set-up a migration route with another provider.
They've also informed about a security incident at one of their registries.

WHOIS privacy includes email forwarding from a funny domain name:

If you do not select it we will generate an anonymous @owowhosth.is email and publish that instead.

On their Mastodon, they describe themselves with

On a mission to make interneting a little easier, join us at http://glauca.digital/. Possibly anarchist, definitely antifascist.

Oh, and speaking of Mastodon, that is listed as one of their services. Based on this disclaimer...

MOBILE APP USERS: if you're trying to sign up with a mobile app go back and select login to authenticate with our SSO.

...it does indeed sound like being their customer includes account on their Mastodon instance. Pretty cool if true.

Also, try whois with their ASN:

aut-num:        AS207960
as-name:        AS-TRANSRIGHTS
descr:          Trans Rights! Hell Yeah!
[...]
remarks:        ----------------------------
remarks:        Hmmmmm tasty routing policies...
remarks:        ----------------------------