I work with a mutual aid group that currently handles communications with Signal. This is acceptable from a security and privacy perspective, but severely lacking from a discoverability and reference perspective.

I'm looking for a text chat (it's okay if it also supports voice and or video, but we don't really need that) that is kinda similar to Slack or Discord regarding rooms, but that can be self hosted (obviously). Our general workflow is to allow new volunteers to join our "General chat" and then either be invited or join via open link any of the working groups they fancy. What I'm hoping for is a software that can allow us to have all those working groups in a side bar to increase engagement with some of the more behind the scenes options. I'd also love to have the ability to easily retain posts or bookmarks so we can build up quick references where we actually communicate. I haven't found a clean way to handle the general chat for 2 reasons: 1) we would like to keep it open in such a way that anyone who wants to can join, and 2) there's currently over 800 people and we regularly add more.

All told that makes the bulleted requirements for what I'm hoping for be:

• text chat software
• rooms/channels
• ability to pin posts
• ability to add arbitrary bookmarks or links
• ability to have rooms either public or private
• ability to have at least one room anyone can join without prior approval or invite
• ability to support at least 1000 users (not necessarily concurrent client connections--that can probably be about 50)
• ideally the communications can be encrypted

What I don't need but might be nice:

• voice
• video
• file share
• polling
• reminders
• plugins

We value data ownership extremely highly hence looking for self hosting options over Slack or Discord. It's okay if the general chat exists in a separate server so long as the main server with all the other rooms can federate with it somehow.

We do have some people with IT experience, and I am software engineer of over a decade so technical barriers in setting it up shouldn't be an issue, but account creation and use for volunteers needs to be dead simple.

If anyone knows of something like this (or even a FOSS tool we may be able to extend functionally to fit the last 1 or 2 bullet points) I would love to hear your suggestions.

Thanks so much!

So I recently quitted Google Drive and downloaded all my data and hoping to keep it on Hard drives myself, They are external plug in types and I want the files synced like it was on my computer. So when I plug it in it copies/syncs the things on my computer, anyone knows somethign like that?

I'm posting this in case it'll help anyone else out that may have access to some of the old Datto switches.

I work for a business that previously used Datto extensively (before they were sold to Kaseya) and we had a lot of old Datto hardware because of that. We've since moved on to other hardware solutions for clients but we kinda got stuck with this old hardware and I ended up taking some of the switches we had (an S24 and a E48) - I took them with the expectation that I'll just use them as dumb unmanaged PoE switches. My employer tried to give these away for free through facebook marketplace and other similar sites just to get them out of their hair and would get people asking about them but nobody ultimately took them.

Well I did use them as unmanaged switches for a bit; I blocked internet access for them on my firewall just in case it was reaching out to the cloud, so nothing could potentially be modified suddenly. I recently spent some time looking into the console access on them to see if there's anything there. After a bit of searching I found that if you factory reset them and prevent access to the cloud, they have a default openmesh password ( 0p3nm3$h! ) on the admin account which you can use to gain full access to the CLI and thus some level of management of the switch.

I then examined the running config and discovered they have a local web interface (and ssh and telnet) which is disabled by default and you can enable, you can also create other users on it for management. So, through the console I obviously enabled those to see if they function and to my surprise they indeed do function. So now I have proper 24 and 48 port managed PoE switches at my disposal which made me pretty happy.

Anyway, if anyone happens to stumble upon these switches (at least the S24 and E48 models) and you can use them, know that you can now fully manage them on your own if you so desire. The console connection requires a baud rate of 115200 and then you can just login with username admin and password 0p3nm3$h!. From there you can use the contextual help (?) to figure out the commands. To enable the web interface, after logging in you can do this:

configure  
ip https  
exit  
save  

then you can simply access it in a browser at https://{ip-address-of-switch} using an existing user account. For reference, to create an account you can use a command like this:

configure  
username {USERNAMEHERE} secret {PASSWORDHERE}  
exit  
save  

I did verify that changes made via the web interface do actually work and change the configuration, I half-expected it wouldn't work but was pleasantly surprised it does.

What setups/softwares do you use to secure your server?

All I do is run the process as user with no login shell.

The topic came to mind after reading this post Is Authelia enough without fail2ban or crowdsec?

Podman is no longer supporting iptables so I am trying to learn how to set up nftables in its place. It's been a struggle to get it to work properly. I can not ping my own server after starting the nftables rules. I am using Alpine Linux v2.24.1 and nftables v1.1.6 (Commodore Bullmoose #7).

nftables has a config file with basic rules which include receiving pings:
/etc/nftables.nft

#!/usr/sbin/nft -f
# vim: set ts=4 sw=4:
# You can find examples in /usr/share/nftables/.

# Clear all prior state
flush ruleset

# Basic IPv4/IPv6 stateful firewall for server/workstation.
table inet filter {
	chain input {
		type filter hook input priority 0; policy drop;

		iifname lo accept \
		comment "Accept any localhost traffic"

		ct state { established, related } accept \
		comment "Accept traffic originated from us"

		ct state invalid drop \
		comment "Drop invalid connections"

		tcp dport 113 reject with icmpx type port-unreachable \
		comment "Reject AUTH to make it fail fast"

		# ICMPv4

		ip protocol icmp icmp type {
			echo-reply,  # type 0
			destination-unreachable,  # type 3
			echo-request,  # type 8
			time-exceeded,  # type 11
			parameter-problem,  # type 12
		} accept \
		comment "Accept ICMP"

		# ICMPv6

		icmpv6 type {
			destination-unreachable,  # type 1
			packet-too-big,  # type 2
			time-exceeded,  # type 3
			parameter-problem,  # type 4
			echo-request,  # type 128
			echo-reply,  # type 129
		} accept \
		comment "Accept basic IPv6 functionality"

		icmpv6 type {
			nd-router-solicit,  # type 133
			nd-router-advert,  # type 134
			nd-neighbor-solicit,  # type 135
			nd-neighbor-advert,  # type 136
		} ip6 hoplimit 255 accept \
		comment "Allow IPv6 SLAAC"

		icmpv6 type {
			mld-listener-query,  # type 130
			mld-listener-report,  # type 131
			mld-listener-reduction,  # type 132
			mld2-listener-report,  # type 143
		} ip6 saddr fe80::/10 accept \
		comment "Allow IPv6 multicast listener discovery on link-local"

		ip6 saddr fe80::/10 udp sport 547 udp dport 546 accept \
		comment "Accept DHCPv6 replies from IPv6 link-local addresses"
	}

	chain forward {
		type filter hook forward priority 0; policy drop;
	}

	chain output {
		type filter hook output priority 0; policy accept;
	}
}

# The state of stateful objects saved on the nftables service stop.
include "/var/lib/nftables/*.nft"

# Rules
include "/etc/nftables.d/*.nft"

I also have a small config file:
/etc/nftables.d/firewall.nft

#!/usr/sbin/nft -f

define WIREGUARD_PORT = 51820
define WIREGUARD_ADDRESS = 10.0.0.0/24
define SSH_PORT = 5025
define SSH_ADDRESSES = { $WIREGUARD_ADDRESS . $SSH_PORT, 192.168.40.204 . $SSH_PORT }
define PUBLIC_PORTS = { 5050 }

table inet filter {
	chain input {
		udp dport $WIREGUARD_PORT accept \
		comment "Accept WireGuard connections"

		ip saddr . tcp dport $SSH_ADDRESSES accept \
		comment "Accept SSH connections from known devices or WireGuard"

		tcp dport $PUBLIC_PORTS accept \
		comment "Accept public connections"
	}
}

After loading the new rules, I get the following output while listing the ruleset:

21:23 server-pi:~ $ doas nft list ruleset
table inet filter {
	chain input {
		type filter hook input priority filter; policy drop;
		iifname "lo" accept comment "Accept any localhost traffic"
		ct state { established, related } accept comment "Accept traffic originated from us"
		ct state invalid drop comment "Drop invalid connections"
		tcp dport 113 reject comment "Reject AUTH to make it fail fast"
		ip protocol icmp icmp type { echo-reply, destination-unreachable, echo-request, time-exceeded, parameter-problem } accept comment "Accept ICMP"
		icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, parameter-problem, echo-request, echo-reply } accept comment "Accept basic IPv6 functionality"
		icmpv6 type { nd-router-solicit, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert } ip6 hoplimit 255 accept comment "Allow IPv6 SLAAC"
		icmpv6 type { mld-listener-query, mld-listener-report, mld-listener-done, mld2-listener-report } ip6 saddr fe80::/10 accept comment "Allow IPv6 multicast listener discovery on link-local"
		ip6 saddr fe80::/10 udp sport 547 udp dport 546 accept comment "Accept DHCPv6 replies from IPv6 link-local addresses"
		udp dport 51820 accept comment "Accept WireGuard connections"
		ip saddr . tcp dport { 10.0.0.0/24 . 5025, 192.168.40.204 . 5025 } accept comment "Accept SSH connections from known devices or WireGuard"
		tcp dport 5050 accept comment "Accept public connections"
	}

	chain forward {
		type filter hook forward priority filter; policy drop;
	}

	chain output {
		type filter hook output priority filter; policy accept;
	}
}
21:23 server-pi:~ $ doas netstat -tunlp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 127.0.0.1:8000          0.0.0.0:*               LISTEN      3515/rootlessport   
tcp        0      0 127.0.0.1:8080          0.0.0.0:*               LISTEN      3584/rootlessport   
tcp        0      0 0.0.0.0:5025            0.0.0.0:*               LISTEN      3743/sshd: /usr/sbi 
tcp6       0      0 :::5025                 :::*                    LISTEN      3743/sshd: /usr/sbi 
tcp6       0      0 :::5050                 :::*                    LISTEN      3515/rootlessport   
udp        0      0 0.0.0.0:51820           0.0.0.0:*                           -                   
udp6       0      0 :::51820                :::*                                -                   
21:23 server-pi:~ $ 

I can connect perfectly fine with SSH, WireGuard and my reverse proxy on port 5050 but if I ping the server I don't get any response at all. Pings worked as normal when I was using iptables so I am not sure what I am doing wrong with nftables. I've tried to keep the rules as simple as possible to figure out what is happening but I have not been able to make any progress. Any help would be appreciated.

I have everything I host and expose behind authelia (which requires 2fa) as middleware or as the only login method with oicd, thus far it seems to work well, of course I get a bunch of malicious traffic and spam but this gets to authelia and stops there, I don't even see multiple tried login tries ever so I felt pretty safe. However it does seem that everyone uses either fail2ban or crowdsec in addition so I have been wondering if it would really add any security in my setup or if I'm missing something. I'm sure it wouldn't hurt but crowdsec always seemed a little too complex for me and I don't want something I don't fully understand in my security layer and I never saw a nice way to setup fail2ban so never bothered. Afaik there's no webui or such things and you have to manually make working regex for everything. I'd like to know if I'm missing something or if anyone has tipps to give

cross-posted from: https://discuss.online/post/45517222

Over the last year I've been customizing my applications like Castopod and Dokuwiki, in order to make them easier to navigate by my users. I'm trying to build a sustainable setup where upgrades don't break things I've manually customized in a text editor and I don't waste hours reapplying changes. I'd rather invest time in doing it right this time.

This is my first time managing a self-hosted wiki long-term, so I want to establish good practices early... before I start telling everyone to join up. I also intend to share my findings with the larger Dokuwiki and Castopod projects, because I can see where I could submit some pull requests eventually.

Thanks for any advice!

Purely a hypothetical for me; I don't have the means for a VPS or that many files. But in the future, if I'd want to use the 3-2-1 rule with a VPS subscription, what sort of software would I need to ensure that my files can't be accessed on the VPS and need off-site decryption keys? What kind of setup would allow you to access said files from a different device if the decryption keys are stored locally on it? People who've done something similar, how has that gone for you?

I've seen so many 10" servers that look amazing from the front and very polished, but then having a rats nest of cables and a mess at the back.

After 62 iterations and many 3D prints, blood, sweat, profanity and tears. I my design and implementation is finally done.
I used Hexagons where possible, because as you know, Hexagons are the bestagons

This is Before:

And the After:

The ducky adds 200MHz

The front of my mini-rack is actually still somewhat of a mess, I thought I'd focus on the back first.

I've published it in excruciating detail on my GitHub Leave a Star if you like what you see.

I self host a bunch of stuff on here to get away from Big-Tech, and because I find it fun. For a lot more details see https://erasmus.works/

It always bothered me the the fronts of racs are modular, but not the backs, this solves that
If you have any questions feel free to ask, hopefully this helps other clear up their rats nests.

This is something that seems to happen randomly to my little RaspberryPi 4B homeserver, like once every few months maybe.

What happens is that out of nowhere (meaning I didn't make any change to config or installation) I cannot reach any services I host on it (i.e. Jellyfin, Anchor notes...). I cannot access it via SSH at all, connection keeps timing out.

Ping however gives a signal. I can see/hear its running and doing something, since I hear the external HDD working. It is running headless and I have no monitor and/or keyboard I could connect.

So far my only way out is to just switch its power off, which is obviously not good for the hard drive. It has happened now like half a dozen times over the past few years, so I am wondering what a better way is to handle this. This was on RPI OS and now its happening on DietPi, so seems not related to the OS version.

I tried sending a shutdown signal via SSH but that also just times out, so how do I get it to shutdown properly?

Secondly, what kind of logs could I look at or start collecting to make sense of this?

I've now managed to get the stream of my HiWatch Series, model HWI- T641H-Z 2.8-12 mm by accessing via browser to rtsp://USERNAME:PASSWORD@192.168.30.50:554/Streaming/Channels/101. Working nice. But on its own, very unusful unless I get storage and image detection going. So, I need something like Frigate.

I believe the Frigate docs suggest running in a docker container installed on a VM. Very convienient as I have Proxmox (installed on a optiples 7070 micropc with 32MB ram) running a VM on which i have a few containers. The idea is to mount a "frigate" dataset created on my Truenas server on Proxmox which is then mounted to the VM. Lots of layers but hoping it should be ok.

I heard that the Google Coral TPU is not sold anymore. Is this going to be a problem for Frigate image recognition? Are there alternatives to the Coral TPU?

Portainer is changing to a mostly AI and kubernetes supported app.

It was way easier than I thought it would be to get started. I put Sparky Linux on an 18 year old laptop and moved a bunch of movies and shows over to it, got Tailscale squared away, and now I can watch my media ANY WHERE IN THE WORLD. The only problem is storage. Jellyfin doesn't recognize my external drive for some reason and says the path is invalid. Is there a simple solution I'm missing?

Also I'm just stoked I was able to do this. I know I just followed a recipe, but it's a pretty cool feeling having all my music and shows right there, and I don't have to pay some middle man one red can't to access media I already own.

Cliparr 2.0 is out now

What is Cliparr?

Cliparr is a browser-based, simplified video editor with a single purpose: to create and export clips from Plex, Jellyfin, and local video.

What's new?

Check the blog post for the full breakdown, but the biggest change is the new canvas-based timeline editor.

While adding support for editable subtitles, I discovered the timeline component we were using was highly inefficient. Also, no other free or open-source timeline editors existed.

So... we now also have https://canvastimeline.com/ which is a new open-source headless video editor for JavaScript.

Canvas Timeline allows us to load and render literally hundreds of clips without any performance issues.

Also new:

• Subtitle editor
• Export size estimation
• Mobile UI updates
• Maintenance automations

Aside: When making the Export Size Estimator, it made sense to also release a fully in-browser video converter: https://cliparr.dev/convert/

• GitHub: https://github.com/TechSquidTV/Cliparr
• Website: https://cliparr.dev/

AI Disclosure:

Implementation - Generated Testing - Generated Documentation - Assisted Review - Assisted Deployment - Assisted

As I start to host more and more services on my home server, my family and friends are interested in using some of the services I host as well. Up to now, all of my services have been internal-only, and my wife and I just use Tailscale to access everything. Getting others set up with tailscale isn’t an issue, but I can only have up to 4 other users before I have to pay to add more, and I have more than 4 people I would like to have access to some of the things I host.

Right now I’m using cloudflare tunnels to make some services available externally. I’m behind CGNAT, so I’m forced to use something like tunnels or similar. I’ve always read that if you are going to open things up externally to use a reverse proxy (which I use internally), but does this still apply with cloudflare tunnels? What else should I be looking at to make sure I have everything secured properly?

This is not strictly self-hosted per se, but I am looking for your guidance.

I am standing up a wiki. I want it to use available FOSS wiki frameworks, all our self-hosted loving things.

However: the probably of this becoming a moderately trafficked page are high. So I also need to consider scale (cloudflare, captcha, auth, do I use Vercel? etc.), light-weightness (this is a Wiki but not too massive), and all that jazz. This is also someone who won't like alt-wikis and is a very layman, mainstream audience. So "wikipedia but SEO friendly/article style" is also a plus. It will be less deeply linked than Wikipedia across pages, but is still a repository for info that will be revisited for its different components for a long time.

People with experience spinning up or hosting trafficked wiki pages: what do I do?

Thanks gang.

EDIT: So many great replies here to triage. Thanks everyone. I'll keep you posted!

I was considering something new from supermicro, but I decided to go considering grade for a change, as I mainly just need single threaded performance from this one.

My only requirement was rack mount, so I went for a Ryzen 5 build inside a rack mount chassis from Inter-Tech. My first build combining these two worlds.

I'm gonna miss IPMI, though.

I pay for the Nabu Casa subscription for remote access to Home Assistant. Mostly as a way to give them money for a great service, but it's convenient and felt pretty secure. It should be the only remote way into Home Assistant. About an hour ago I got a login attempt notice that an IP was trying to access API/config. The IP is in some bad IP databases. What I found interesting was that the log shows an AI bot. A Google Gemini bot specifically. Makes me worry that AI is going to make yet another aspect of life frustrating and unfun.

I'm looking at dusting off my motion setup. It was an old setup to monitor what my pets are doing in the house with a webcam.

However, I need cameras outside to monitor my gardens and the webcams are not really usefull for that (for one, the're not waterproof and USB cams)

I try to look for stand alone cameras, but can't find a good test of them. (probably user error) Any tips on good, safe, cameras for outside? (pref poe, wifi when it can't be avoided, not battery powered)

Thanks in advance

As my kids want their own rooms in the future I’ll need to downsize a bit. Is there a list for recommended 10” Equipment? Any help appreciated. My research so far turned always in the direction of get rack bars and a 3D printer ( or shops selling the 3d prints)

I built Versentry to scratch my own itch: I run Docker across several self-hosted boxes and wanted to know when images have updates - without anything auto-pulling or restarting my containers behind my back.

Before that, I used WUD, but at the time Versentry was created, it didn’t have a proxy for Telegram notifications, which was the impetus. As a result, I ended up with a micro‑service that fully meets my needs.

What it does: reads running containers from the local Docker socket, compares their tags and digests against OCI registries, and sends a notification when something's newer. It never pulls images or touches containers. That's the whole point - notify-only by design.

A few things that set it apart:

• Central tag-filter rules in config (regex by image repo), so you're not forced to label every container. Per-container versentry.include labels also work if you prefer them.
• Built-in proxy (SOCKS5/HTTP) for notifier delivery and registry traffic - handy behind network restrictions.
• Any OCI registry - Docker Hub, GHCR, Quay, GitLab out of the box; private/self-hosted via type: oci.
• Notifiers: stdout, Telegram, Discord, Gotify, ntfy, and a generic webhook.
• Readable notifications out of the box - sensible default messages, no template-wrangling required; Go text/template overrides are there if you want to customize.
• semver/numeric detection (cross-major updates get flagged) plus digest comparison for floating tags like latest.
• Tiny ~5 MB scratch-based image, MIT licensed.

It's probably not for you if you need: a web UI (try WUD), automatic pull-and-restart (that's Watchtower's job), non-Docker providers like Kubernetes/Podman (Diun covers more), or Slack/email as first-class notifiers.

It's a young project - fewer battle-tested deployments than the established tools - so I'd genuinely welcome feedback from anyone who runs it.

GitHub: https://github.com/BlackRaincoat/versentry

AI Disclosure:

• Design - Pair
• Implementation - Generated
• Testing - Assisted
• Documentation - Generated
• Review - Assisted
• Deployment - Generated

Note: The idea, the architecture decisions, and all real-world testing were mine - I ran it across multiple live servers and that's what caught the actual bugs. The AI wrote the implementation, the test code, docs, and CI config from my prompts. I reviewed behavior on real deployments rather than reading every line, so code-level review leaned on the AI.

I had the following issue: Stremio would open normally and even load subtitles but would not load videos at all in Linux Mint 22.3. Other people on github have had the same issue.

You can revert to an older version like 1.1.4. by downloading it from the offical Github of the stremio linux shell. You can then install the flatpak by going into your downloads and typing the following commands into terminal:

cd ~/Downloads

flatpak install com.stremio.Stremio.Devel.flatpak

You then should stop the app from auto-updating with:

flatpak mask com.stremio.Stremio

I hope this helps anyone in my situation, I'm fairly new to using Linux and it took me some time. Also can you edit text on Lemmy to be in code block?