The set of vulnerabilities is dubbed PHP2Shell and disclosure is scheduled for 14:00 UTC with attacks expected to follow soon after.

It is adviced to take offline every non-vital services until the patch has been installed (or the Docker image has been updated with a patched version of PHP)

Edit: Solved! Thanks a ton non_burglar.

Good day selfhost gang!

I'm redoing my media stack and I've come across a conundrum that I can't solve on my own. I've got Docker containers on the same Debian machine for qbittorrent, sonarr, and radarr for automatic media downloading. The problem is, as you may have guessed from the title, I need to implement remote path mapping in sonarr/radarr because qbittorrent downloads to a different location than where my media files are hosted. My media is hosted on a network share, mounted at /home/marighost/gilashare/media (which is further broken into subfolders for media types). On this machine, however, I've got my qbittorrent downloading to a 2Tb SSD at /srv/data/torrents. Here are the volumes as presented in my compose.yml files:

qbittorrent:  
    volumes:  
      - /home/marighost/docker/seedbox/gluetunconfig:/gluetun  
      - /home/marighost/docker/seedbox/qbittorrentconfig:/config  
      - /srv/data/torrents:/data/torrents  

sonarr:  
    volumes:  
      - /home/marighost/docker/arrstack/sonarrconfig:/config  
      - /home/marighost/gilashare/media:/tv  
      - /srv/data/torrents:/data  

radarr:  
    volumes:  
      - /home/marighost/docker/arrstack/sonarrconfig:/config  
      - /home/marighost/gilashare/media/movies:/movies  
      - /srv/data/torrents:/data  

All three applications work mostly as expected (radarr can grab a release from an indexer, throws it into qbittorrent to download), but it does not move media into the /gilashare subfolder.

Obviously, I get the error in both sonarr and radarr that tells me: You are using docker; download client qBittorrent places downloads in /data/torrents but this directory does not appear to exist inside the container. Review your remote path mappings and container volume settings.

Here is how my remote path mapping looks in the settings of sonarr/radarr:

Host: qbittorrent  
Remote Path: /srv/data/torrents/  
Local Path: /data/  

I was messing around with radarr initially, and also tried appending /movies to the ends of the Remote and Local paths to see if it needed the full path, but that didn't seem to work either. I've also read through Trash Guides, but the information there seems outdated (all references to images are just... not there). I've also read radarr's docs, but I feel like I'm missing something, and they just link to Trash Guides anyway.

Thanks for reading, happy to dig into my configs or setup more if necessary.

Hoping the brain trust can help.

Single reverse proxy? No issues at all. If I add multiple per some instructions on the caddy forums, nothing works - the docker container just continually reboots with no errors in the log.

Caddyfile:

fmd.domain.ca {
    reverse_proxy 10.179.200.199:8080
}

llama.domain.ca {
    reverse_proxy 192.168.3.199:3000
)

With only the fmd entry, works fine.

This looks interesting - would you use a virtual video store to browse your self hosted media?

Does anyone have a solution for a cheap remote KVM? All the solutions I've found are around $100 and I don't want to spend that much.

I might even settle for a portable KVM if it's really cheap.

I have a laptop and an Android tablet that I could repurpose, if that helps at all.

Use at your own risk, wanted to take the ai out of the process so I wasn't wasting hella tokens on repetitive actions. Search through and grab collections directly from internet archive. Still having the agent fix bugs and add features but it seems mostly stable now.

Useful since internet archive has a ton of old comics/magazines that you can't find on comic repos like getcomics or batcave. Cracked, I couldn't find anywhere else, tons of mad issues, carToons, every popular adult mens mag for the gooners, etc.

The update got released over 2 months ago. So sensible admins should not be getting hit by this.

Also I use Jellyfin btw.

I've got a modest homelab setup: a couple computers and a server with the pfsense router pointing all DNS queries to my pi hole on a Pi Zero W. The server exposes a few services via cloudflare tunnel. It's been working pretty well.

Then I started setting up a server for a friend. It's a big repurposed server board running proxmox and will eventually have a handful of VMs and LXCs, all on a network. It's for his business, so I'm setting up Netbird on it for his half-dozen employees to be able to access it for fileshares and stuff. I'm connecting my Linux desktop, too, so I can do sysadmin for him.

The trouble is that domain name resolution is getting hairy between my pihole and his netbird. Since it's not my network, I can't add my pihole as a DNS resource, but I do need to keep a connection to his network.

Anyone have any wisdom to share as to how to handle this properly and still be able to use my pihole for DNS filtering in my house?

Been looking for a nice ZFS UI for my NAS after ditching TrueNAS for PBS. This is developed by a former TrueNAS/iXsystems employee and looking pretty good. Set it up and it's pretty intuitive and helpful.

AI has been used for the UI but not the backend if I got it right (there's a rant about that in the README).

Small thing but it got me last week. I relay my stream to twitch through nginx-rtmp on a cheap VPS, and one morning unattended-upgrades pulled a new systemd, needrestart restarted nginx (and postgres, and everything else) and the stream dropped. OBS reconnected fast but twitch counted it as two streams.

default timer is 06:00 UTC + up to 1h random, which is exactly when I stream lol. moved it with a drop-in:

# systemctl edit apt-daily-upgrade.timer
[Timer]
OnCalendar=
OnCalendar=*-*-* 13:45:00 UTC
RandomizedDelaySec=15m

the empty OnCalendar= matters, without it you just add a second time and keep the old one.

anyone else got bitten by this?

Hi, I'm the developer. Reloop is a CRM for small teams that reads your mailbox instead of waiting for you to type things in.

What it does:

• Connects IMAP, Google Workspace or Microsoft 365 with read-only access. You pick how far back it reads.
• Builds contacts, companies and a timeline per person.
• Ranks former customers in a "win back" list. Each point of the score is shown as its own line, so the ranking is not a black box.
• Drafts a follow-up, but never sends. The button opens your own mail client.
• Since 0.22 it has a read-only MCP server, so ChatGPT, Claude or Claude Code can query your own instance.

Self-hosting:

curl -fsSL https://reloopcrm.com/install.sh | sh

Docker Compose with Postgres 17, API, web app and agent. amd64 and arm64. 8 GB RAM recommended, the agent is the heavy part. Without an AI key it runs as a normal CRM. Telemetry only exists if you set your own PostHog key.

AI disclosure: most of the code was written by AI coding agents that I directed and reviewed. The app itself uses an LLM only with a key you add.

Repo: https://github.com/reloopcrm/reloop

Feedback welcome, especially on the install and on what would make you trust software reading your mail.

I want to try out some things with a secondary domain. I’d prefer ethical and non-shady providers. I have a fixed IP and a VPS to go with it, so it’s really only about the domain. A subdomain of my current domain is not enough. A subdomain of the provider would be OK but not ideal.
Even paying very little is not an option right now - maybe later.

Doing some preliminary research, the keyword seems to be Dynamic DNS even if I have a static IP. There are providers but those that pop up easily do not instil much confidence.

I want to hear the Fediverse's opinions! I haven't found any recent posts about this.

TIA

So I've been running a home media server with the arr suite on it, but it only has about 2 tb storage. The storage has been full for a couple months now which has rendered my server useless. Now I've bought a used nas with 32 tb on 7 disks. I've been advised to set it up in RAID. I've learned how to do that in OMV and it's setting that up now.

It takes a while though, so that leaves me some room to think. Why do we do this? I understand that it gives me more unified storage, but I also want to run other things on this machine. Like k8s to deploy my own applications and play around with devops stuff. Or even just regular file storage and photobackup next to the films and series. I thonk I would like to keep those things seperate though, is that still possible with RAID? Or is it better to put 5 disks in RAID and keep the other two for other stuff? I think my question is, how do you use RAID "practically"? How do you store different things on there? Do you compartmentalize the disks again, or do you just make different folders?

tinyfeed is a CLI tool that generates a webpage from a collection of feeds. It's dead simple: no database, no config file, just a CLI and some HTML.

This release focuses on making tinyfeed a more stable and deterministic program. A stable experience is always better for users, and it also allowed us to design a new snapshot-based test suite, so regressions are much less likely to slip through.

It also included a bunch of fixes related to the --order-by option that was added in the previous release and was, sadly, quite full of bugs 😬.

Main items on the menu today:

• Stable ordering: Feeds and items now come out in the same order on every run.
• Discoverable sorting: --help now lists the values --order-by accepts: publication-date, update-date, feed-name and author.
• Lighter dependencies footprint: upgrad to gofeed v1.5, which removes 6 indirect dependencies.
• Lots of refactoring and a brand new test suite.

And the cherry on top: tinyfeed now publishes an Atom feed, so you can follow its releases! WHY DIDN'T I THINK OF THIS EARLIER? A FEED FOR TINYFEED!

AI Disclosure:

• Implementation - Pair: I like directing IA when I have a refectoring in mind. On new feature I prefere avoiding it. I find that using IA for feature mean I spends less time time using the software myself during dev and then I miss the bugs.
• Testing - Hint: the new integration tests suit is 100% me, but the new unit tests are often generated by IA then reviewed / refactor by me.
• Review - Pair: for contributions it's 100% myself, I don't have much MR but I take a lot of time to review them. For my own code, as im a solo maintenr, the IA is the only one giving me reivew.

Howdy self-hosters!

I've got a huge pile of eBooks flying around here: poetry, scientific literature, magazines, comics, teaching materials, RPG rule books - it's a wildly mixed bag. I'm still looking for a self-hosted solution to make it more accessible and get an overview of what I actually have. (Calibre looks promising!)

My question here is not about software, though, but about organisation at the filesystem level: what folder and file name structure have you established for your eBooks? Do you just dump everything into one single folder and let the software do the rest? Do you create sections by genre ("Crime", "Fantasy", "Young adult", like the libraries do it) or application (job-related, hobby-related, cooking, ...)? Does it matter at all?

From the blog post

obtaining an ARIN ASN and a portable /24 IPv4 block for a home networkI’ve wanted my own Internet address space for a long time. Not “my ISP gave me some statics” space which I’ve had for well over a decade now, but a block that belongs to me, announced into the global routing table by equipment I own, and ideally sitting in the rack in my house. Type the prefix into bgp.tools and see my own ASN sitting there as the origin. How cool! (ok, cool for some, but not most)

Does anyone run their own AI service?

If so,

Which one?

What hardware?

Do you have a way to access it from outside or from a phone?

And, if you're open to sharing, what do you do with it?

I know AI-enabling hardware is insanely expensive right now, but some of the smaller (<32GB) more efficient models (think deepseek- or qwen-based) don't absolutely need specialized hardware to run and perform well enough for many purposes.

I am so aware of the absolutely abysmal privacy practices of basically all AI companies that I'm not comfortable using them to help me with web searches and the such, because there's no way that all this information won't be going into a profile. This makes me want to have my own "helper" service.

Built when Netflix first took away password sharing. Thanks for the heads up Netflix! Would not want to start this project now 😂

Edit: adding temp and specs

I9 11900k Z590I Vision D ITX mobo 64gb memory The 16x lane is bifurcated to run: Intel a310 & Lsi 9305 16e into a hp dl380

Drives are 10x 14 tb wdd in raidz1, 6 256gb sata ssds in a pair of 3 wide mirrors for special vdev metadata, a 512gb nvme for read cache, and a 64gb optane for slog

I have a GLInet travel router that is a peer connected to my Netbird network, I'd like to have any client that connects to my router to have access to the peers the travel router has access to, but still be able to access the regular internet that is being passed through by my router. Is this possible?

Ultimately I'm trying to get the TV at my girlfriend's place to be able to access my Jellyfin instance over Netbird. According to the Netbird documentation, exit nodes and routes are depricated and should not be used, but I'm struggling hard with getting it to work with Networks.

• I've created a group with my GLInet router, my Jellyfin instance, and my home server (Which hosts Jellyfin) all in the group called "Travel".
• I've created a Network called "Home" in Netbird
• Within the "Home" network I've created a resource called "Jellyfin" with the IP address set to it's Netbird IP address, and an access control group where all members of the "Travel" group have access to all ports of the "Jellyfin" resource.
• I've created two routing peers within the network, one is the GLInet router and the other is my home server. Both of these are Netbird peers with Netbird installed on them.

I am very confused overall, and could use a hand if anyone wanted to walk me through what I'm doing wrong.

So I'm relatively new to server hosting. (But experienced with remote web hosting from providers.) After about a year of fighting to run Nextcloud on a hosting company and finally losing everything from the cPanel vulnerability a few months ago, I broke down and launched my own home server. I'm looking for advice to maximize security.

CachyOS Linux with ClamAV Docker via Portainer Nextcloud (E2EE), Immich, DocuSeal and NoteTrace Routed through a domain and subdimains via Zero Trust Cloudflare Tunnel and Cloudflare DNS.

I have regular redundant backups both onsite and offsite with Duplicati.

My passwords for OS and all admin dashboards are extremely long, unique, random strings managed by Bitwarden.

I know just enough about this stuff to get into trouble. What else should I setup? I have little to no monitoring going on and don't know much about that direction.

My Jellyfin config has some YAML like this.

# Sometimes work  
devices:  
- /dev/dri/renderD128:/dev/dri/renderD128  
- /dev/dri/card0:/dev/dri/card0  

Occasionally when I reboot my server, I end up with no card0 and instead I have /dev/dri/card1. This breaks my Jellyfin server...

I noticed there is also dri/by-path, which I'm guessing is a more stable path than a card index... however, doing this doesn't work for me.

# No work  
devices:  
- /dev/dri/by-path/pci-0000:00:02.0-render:/dev/dri/renderD128  
- /dev/dri/by-path/pci-0000:00:02.0-card:/dev/dri/card0  

I tried with and without quotes and the result is the same. Error to start. I'm guessing Docker is failing to correctly parse the string because of the colons in pci-0000:00:02.0-card...

How's everyone else handling this problem? I've been updating my compose.yaml every time the index switches, card0 to card1 to card0... but this is getting annoying now. (This is a worse problem now that I'm running Fedora IoT!)

Any thoughts?

Hello everyone.

I'm getting a hard time with Qualcomm Atheros AR8151 onboard LAN with Debian. It usually drops to 100Mb/s and freezes the network altogether

Settings for enp1s0: Supported ports: [ TP ] Supported link modes: 10baseT/Half 10baseT/Full 100baseT/Half 100baseT/Full 1000baseT/Full Supported pause frame use: No Supports auto-negotiation: Yes Supported FEC modes: Not reported Advertised link modes: Not reported Advertised pause frame use: No Advertised auto-negotiation: Yes Advertised FEC modes: Not reported Speed: 100Mb/s Duplex: Full Auto-negotiation: on Port: Twisted Pair PHYAD: 0 Transceiver: internal MDI-X: Unknown Supports Wake-on: pg Wake-on: d Current message level: 0x0000003f (63) drv probe link timer ifdown ifup Link detected: yes [ 3.004591] atl1c 0000:01:00.0 enp1s0: renamed from eth0

[ 37.754972] atl1c 0000:01:00.0: atl1c: enp1s0 NIC Link is Up<100 Mbps Full Duplex> [ 45.071291] atl1c 0000:01:00.0: atl1c: enp1s0 NIC Link is Up<100 Mbps Full Duplex> [ 45.799689] atl1c 0000:01:00.0: atl1c: enp1s0 NIC Link is Up<100 Mbps Full Duplex>

any tips of what can be done around here? I'm using kernel 6.12.111+deb13-amd64