Is there a good way to do this? I could find surprisingly little information about it online.

Hello beautiful people of this community!

I asked for your help a month back about setting up OPNsense on Proxmox. I went through all the comments in the post.

I got a bit distracted by IRL commitments but I sat down with it properly last week. After a lot of studying, and a bit of trial and error, I have done it!

My Journey

This was my first time with Proxmox, so I spent a few weeks with Proxmox initially before undertaking OPNsense. OPNsense took me a week to install and deploy. I did a staggered deployment over multiple days, i.e., installed the VM first, check connectivity, check DHCP, and then make it part of my homelab.

Architecture

The diagram might look complicated, but it's simple.

My host has 3 interfaces, onboard NIC and a dual NIC card. I made a LAN and WAN interface out of the dual NIC card, and made the onboard NIC as a management interface. I connected all of the interfaces to dedicated Linux bridges and the underlying OS/VMs only use the Linux bridges. The onboard NIC is only used to configure Proxmox in case something catastrophic happens. The other VMs can communicate with the OPNsense VM via the virtual LAN interface.

I initially was thinking of going through the pass-through option, but after some research, I saw the upsides were very low and you lose a bit of flexibility.

Challenges

1. KEEP TRACK OF YOUR NIC TO LINUX BRIDGE MAPPING - This caused me a lot of stress and trails. I thought I was trying to ping the LAN interface, was connected to the WAN bridge.
2. The Chicken & Egg Problem - During boot, Proxmox needs an IP but the DHCP service inside OPNsense is not up yet. Without that IP, I cannot log into Proxmox. I solved it using a hard-coded IP for Proxmox.
3. Options galore - Coming from standard routers, OPNsense is a different beast; it has so many options that it becomes a crazy labrynth. Had to read again and again to understand what the options meant.
4. Where is dark mode? - The first change that I wanted to do was set dark mode and I don't know why but it an ungodly amount of time for something so simple. It's present in such a weird location (System -> Settings -> General -> Theme)
5. This ain't Kansas anymore - This is OpenBSD, not Linux. So the same commands won't work. There is drill, no dig.
6. PLEASE CLICK APPLY - Many times I just forgot to click Apply after making a change and I got super confused.
7. DNS, YOU DEVIL - This was the setting which made me question my own sanity. I have a simple but non-standard setup for DNS. I am running Pihole (Ad-blocking + Local domains) + Adguard DNS Proxy (Supports encrypted DNS). I wanted to tell OPNsense "Hey, use this IP to resolve all internal and external DNS queries". OPNsense was just not having it. It took me two days of experimentation to finally figure out the right approach (Disable WAN populated DNS, turn off Unbound, and use DHCP options).

Thanks to these people

Their comments really helped me out (Technical and encouragement)

• @chief@lemmy.zip
• @dbtng@eviltoast.org
• @zarathustrad@lemmy.world
• @possiblylinux127@lemmy.zip

Closing remarks

I am still documenting the entire process. I will publish the entire process of how I got a bare Lenovo M720Q working as a virtualized OPNsense router. Remember, if I can do it, anyone else can do it.

Heya, I just wanted to post here before doing something that puts my stuff out on the internet for anyone to see 😅

So I have a basic, still in-configuration homelab network going on. It's Modem --> OPNsense router --> Ubiquiti switch --> Openwrt AP. DNS and DHCP (via Dnsmasq) are working right now, each VLAN (Home Devices, IoT, and Guest) can access the internet. But I'm still tinkering and doing firewall stuff, so sometimes I reactivate the ISP router and switch back to that until I have everything perfect enough to not bother my family

I have a Proxmox homelab that I've been running services like Jellyfin and Immich in a Docker Debian VM for a few months now, but I was getting tired of typing out IPs and remembering port nums, especially after bouncing between my router and the original ISP router whenever I'm having network issues. So I wanted to finally map those IPs to human-friendly domains. So like, 192.168.10.247:8096 --> jellyfin.example.com, 192.168.10.247:2283 --> immich.example.com, etc.

I quickly learned that DNS services like Unbound and Dnsmasq do what they say on the tin, DNS only, so I can't do a override to map ports to a domain, as they can only do IPs. My research led me to reverse proxies, and people said Caddy was simple on OPNsense, so I installed that and followed the official guide/documentation. But then I ran into the issue of needing the domain to be externally resolveable. Which then led me to realizing I need to use some sort of CA.

I know Let's Encrypt does it for free, plus the guide mentions them as a default so why not? Except I still need an actual external domain so... Cloudflare? DuckDNS? Someone else? I'm so lost...

The biggest concern of mine right now is, if I set up a reverse proxy, does that mean my services are externally accessible? I was using Tailscale so I could avoid that, especially since I know services like Jellyfin have had serious vulnerabilities, and everyone says it's a good rule of thumb to just not expose services. But how do I map ip + port #s to a domain on OPNsense?

For context: I have 0 programming, coding, etc. related knowledge.

For some months I've been dedicating time into setting up a Homelab that hosts music, movies, maybe home security (Frigate, I suppose), minecraft servers (or maybe other games too) and maaaaybe local AIs (if I get a better system), in that order, from more to less important. Some of the caractheristics that I prioritize are: privacy first, Zero third-party exposure, disk data encryption, self-hosting, FOSS priority perspective, trying not to compromise in any way my home network-using devices through all the process. Since, as I said, I have 0 programing or even Linux experience, I've done all this process guided by a local ran AI (Qwen 3.6), YouTube videos and forums (not the perfect formula for a cybersecurity safe environment, I know).

In an old laptop (Acer Aspire ES15-... with AMD A6-6310 / 16GB RAM) I've installed Linux Debian Trixie 13 (GNOME) with Docker and CasaOS with Jellyfin (for movies, it worked), Navidrome (for music, also worked) and recently Netbird, this one to connect into the local network from outside my home net, which kinda worked, but not as I expected it to work.

And this is where I feel I'm stuck. My main absolute priority the whole time setting this all up was being able to stream music from my homelab in my phone from everywhere in the world as long as I had internet connection, but when I managed to achieve that connection after soooo many hours and even stream music from my phone only with mobile data, it needed like 1 minute to load 3 seconds of a song, so it's not enough at all. After seeing this, I've reseted all netbird data so I can do a clean install.

I need help with the process of setting this (I believe it's a VPN) up in a way that it is Self-hosted, secure and fast enough so I can make it all achieve my expectations. Any video, forum thread or personal recomendation that you can give me will be so much appreciated.

Summarizing it a little, this is what I was trying to achieve:

CasaOS Architecture: Netbird (FOSS WireGuard mesh) + (maybe) Caddy Reverse Proxy + (maybe) Internal PKI + (maybe) LUKS Encryption Security Model: Zero port forwarding, outbound-only private tunnels, device-by-device approval, end-to-end HTTPS, full data-at-rest encryption.

Let me know if I'm missing any important information and I will do my best to share it.

Thank you so so much in advance!!

Fathom is an all-in-one client for Jellyfin, on Linux, Windows, and now Android. It brings movies, shows, music, and Live TV into one window, with most of Jellyfin's server-side management built in, plus optional Seerr requests and a full YouTube client. Everything plays through mpv (via media_kit), so you get direct play, hardware decoding, and real subtitle and audio track control. Free and open source (AGPL-3.0).

Feedback is very welcome. Bug reports and feature requests both belong on GitHub Issues, and questions are fine in Discussions. Fair warning: the new Android TV build is still rough around the edges, so testers and reports there especially would help a lot.

This is my first update post since the 0.9.0 launch, so here's everything added since then.

New platforms

• Android phones and tablets, from a single universal APK.
• Android TV, experimental for now: D-pad navigation and a 10-foot interface, still being refined.
• Android Auto (audio-only): browse Jellyfin music, internet radio, and YouTube, search by voice, and control playback from the car.
• ARM64 (aarch64) Linux builds alongside x86_64.

Player

• Up Next over the credits (a poster card or a compact Netflix-style pill) that rolls into the next episode, with configurable timing and autoplay.
• Skip Intro, Skip Credits, and Skip Recap.
• Audio passthrough: bitstream Atmos, Dolby Digital, and DTS to a receiver on the desktop player.
• Playback Info overlay: play method, codecs, resolution, the live hardware-decode path, and dropped frames.
• Display Sync for smoother playback on high-refresh displays.
• Chromecast casting from Android.

Library and management

• A per-item menu on posters, episode rows, and the detail page: Play or Resume, mark watched, favorite, add to a playlist, refresh metadata, and delete.
• Delete media from the app (with the right server permission): a whole series, a season, a single episode, or a movie.
• In-app plugin configuration as a real form with toggles and fields, instead of a raw JSON blob.
• Backup and Restore your settings to a portable file, by group.

Beyond Jellyfin

• Internet radio: add stations by URL or from the radio-browser.info directory, organize them into groups and favorites, with live time-shift to pause and rewind a live station.
• OS media controls: system media keys and on-screen controls on Linux (MPRIS) and Windows (SMTC), covering video, Live TV, YouTube, and radio.
• The built-in YouTube client gains a Shorts viewer, background audio, a playlist queue, and much faster browsing, on top of the existing SponsorBlock, DeArrow, and downloads.

Quality of life

• Unified search, drag-to-reorder lists, and a customizable Home and navigation.
• Diagnostics screen with exportable logs, internal/external server address auto-switching, and a documentation site.
• Reliable HTTPS on Windows, and in-app updates that verify the download's size and architecture before installing.

Platforms: Linux and Windows (self-contained downloads) and Android (APK; Android TV experimental). macOS and iOS need Mac hardware I don't have yet.

• Code and releases: https://github.com/Fathom-Media/fathom
• Latest release: https://github.com/Fathom-Media/fathom/releases/latest
• Docs: https://fathom-media.github.io/fathom

AI Disclosure

Per Rule 7 / [AIP] disclosure requirements AI was used during development as a coding assistant. Level per category:

• Design (architecture, system design): Hint — I make the architectural calls; AI suggests trade-offs and edge cases I might have missed.
• Implementation (production code): Pair — roughly 50/50. AI drafts, I review, adjust, test on real hardware, and only commit what I've verified. Every commit is manually reviewed before it goes to my dev repo.
• Testing (writing tests, test plans, QA): Assisted — real-device testing is manual (I test on my own PC and mobile devices before every release). AI helps draft test plans and think through edge cases.
• Documentation (docs, comments, README, CHANGELOG): Pair — release notes and changelog entries are drafted with AI then edited for tone; comments and code docs are mostly Pair as well.
• Review (code review, PR feedback): Assisted — I'm the reviewer; AI helps with security sweeps, audit passes on complex changes, and consistency checks.
• Deployment (CI/CD config): Hint — the GitHub Actions build and release pipeline (Linux AppImage, Windows, Android APK) is largely conventional; AI-suggested improvements only.

I am fairly new in the selfhosting business. I host a few services like Jellyfin or AdGuard, but most of my data just sits on plain SMB shares on my NAS.

I am interested in setting up things like Paperless-ngx, Nextcloud maybe Immich as well. One thing I am struggling with is how to organize all this so I don't have the data scattered around multiple places or in the worst-case even duplicated. I like the simplicity of network shares and the fact that I am not relying on a third-party application to keep being maintained. I am currently not sure I am willing to give that up. However, I am also intrigued by the features these services provide. I know Nextcloud has the option to mount external storage, but I don't know which downsides come with that. It gets more complicated with Paperless. As far as I know you typically have a consume directory where you throw in your data and Paperless stores it using its own system in the media directory. This means I either throw in everything or I suddenly have two locations where my documents are stored. If I would mount that media directory in things like Nextcloud I probably wouldn't be able to find anything because of the different structure and naming scheme.

The idea that I had in mind is that I have a single directory structure of my data that can be used on its own and all these tools are just different frontends and provide different views and information of the same data. Maybe this approach is just something from the past and I should move on.

I should add that I am not planning to expose any of these services to the public. All of this is only accessed from inside my house or using a Wireguard VPN.

• How do you guys handle all this?
• How do you avoid data duplication?
• How do you avoid multiple potential file locations? Is a document in my Nextcloud, in my Paperless or just on the network share?
• Do you prepare in some ways in case an application stops being maintained?
• How has this reliance on multiple services impacted other things e.g. your backups?

Hello all,

Hubzilla version 11.4 was released recently, now has a new docker image built and should be ready for use.

On a technical note, if your setup involves connection pooling regarding your database, you will need to set system.pdo_emulate_prepares to true within your htconfig.php. The 11.4 release of the docker image, has the appropriate line in the htconfig.php commented out, for your convenience; naturally if you edit your htconfig in other ways (CLI, etc) that will still work, as well. Whichever way you choose to deploy your instance, you have options available to you.

If you are unsure about connection pooling, techbuzz has a great article on the subject, that you can access via the link at the end of this post.

Special thanks to the Hubzilla devs, and contributors for their ongoing work.

You can find their work at: https://framagit.org/hubzilla/core

Please review the new release at: https://framagit.org/hubzilla/core/-/releases

And lastly, within the next hour or so, the docker image will be ready to go at: https://hub.docker.com/r/dhitchenor/hubzilla

I hope this finds you all well; please stay safe.

EDIT: Here is the TechBuzz Online article that I mentioned earlier https://techbuzzonline.com/database-connection-pooling-guide/

So for those of you that are curious and have follow my problems on this thread

https://startrek.website/post/43045171

I’ve set up an AudiobookShelf server and so far it work perfectly, tomorrow I’ll try one of their suggested app but it worked really well in browser too

I want to expose my services publicly on my own domain name, how would you guys do that?

I have seen people using Cloudflare, but I don't want to use Cloudflare out of principle. I have also seen stuff on caddy and frp that I've done some rough researching.

What do you guys do?

Hello there my good people of self-hosted Lemmy! Dawarich got some new stuff since my last post, so here I (Evgenii) am, ready to tell all about it! Make yourself comfortable and prepare for awesome stuff :)

By the way, Dawarich — is your free (now and forever) open source self-hostable alternative to Google Timeline. And hey — we just reached 10k stars on Github! Yay! Here's a small bonus for you! https://youtu.be/-7o2WJPXMVw

AI Disclosure (as per https://lemmy.world/post/49320548):

Implementation - Generated

Testing - Generated

Design - Generated

Our links:

Github: https://github.com/Freika/dawarich

Website: https://dawarich.app/

iOS app: https://apps.apple.com/us/app/dawarich/id6739544999

Android app: https://play.google.com/store/apps/details?id=app.dawarich.Dawarich

First of all, tons of bugs were fixed. Right now I'm steadily keeping number of open issues on Github at around a hundred, and, hopefully, I'll be able to significantly reduce it in the upcoming months. It's time for Dawarich to get some more stability.

So, let's start with the big things!

Since 1.9.1, the following changes were introduced:

• Poster Studio: you can now generate posters, wallpapers or images for your social media, featuring your location history on the map, in a beautifully styled way. Check out screenshot below.

• You can also order a printed poster via our print-on-demand integration, thus supporting Dawarich development. Print quality is superb: I personally ordered two posters to test it, pictures are also can be found below. Important: it's built with privacy in mind, so nothing gets sent to our print-on-demand provider unless you explicitly click a button. Prices are 44,99€ for 30x40cm, 54,99€ for 50x70cm and 74,99€ for 70x100cm poster, printed on 200 gsm premium matte paper. Delivery and VAT included, for now — EU only.

• As a side-effect of the Poster Studio introduction, you can now apply same styles to your main map and customize the colors or provide custom schema for vector maps. It's pretty fancy, check it out!

• Dawarich can be installed as PWA! Pretty neat for read-only purposes on mobile, and I have some ideas on how to make it look nicer on mobile screens in the future.

• Replay upgrades — Polaroid photo pile, live photo-layer toggling, recenter & follow camera

• Google Takeout & Polarsteps imports now extract visits, named places, tracks, and transport modes, not just points (1.11.0); retroactive via "Extract additional data" on the Import page TCX/FIT/Google-takeout activity types now feed transportation-mode detection

• File imports stopped storing raw_data copies; streaming batches for large GeoJSON/Timeline files. Less space on disk taken, less memory during import consumed. Existing points are re-checked after upgrade, with tracks/stats/digests rebuilt on the lowest-priority queue. If you're updating and noticing resources consumption surge, just let it work through the background jobs.

• Self-hosted stack ~20% lighter: 452 → 325 MB app container, 843 → 690 MB total. I also have some more ideas on how to make it even slimmer later

• GET /api/v1/points endpoint now works up to 5 times faster than before

• ImageMagick removed from the image, making the docker image smaller

• Oh, and mobile app update was released, for now just for Android, iOS is following in a few days: you can now enable/disable points, routes, heatmap and visits layers, easily navigate between days and replay your daily movements. The iOS version will also include an (for now, optional) experimental tracking mode, that shown pretty good results, but it needs the famous blue arrow to be on all the time. The choice is yours. Oh, and Dawarich for mobile now eats a lot less of your phone battery. Thanks for all the detailed reports.

These are the most notable changes, but under the hood, there is a lot more. If you're interested, check our our Releases page ( https://github.com/Freika/dawarich/releases ), it's all there.

And now, that we're done with what's already there, let's talk a bit about the future.

Dawarich started as a tool to show location history on the map, but it became so much more since then (all thanks to you, by the way). In the nearest future, subjects of our primary focus are:

• Better mobile experience: UI, more feature parity with the web, better onboarding and family features
• Reworked Search UI
• Simpler and more concise UI overall across the app (I heard Timeline is not that easy to work with)
• Geofence (tell me about your use-cases!)
• Less bugs
• Two new locales (German & French, web first, mobile will follow)
• Better performance and architecture improvements
• I also want to play around MCP so your LLMs of choice could easily talk to Dawarich, improve visits detection and transportation mode detection, but the last two will take some work.

So yeah. As usual, lots of work behind us, even more is ahead of us. I want to say thank once again to all of you who are using Dawarich on daily basis, reporting bugs, suggesting features, opening PRs with fixes and new features supports us financially or just spread the word about the work we do. Without you guys there would be no Dawarich, so — thank y'all.

We also highly appreciate your donations, every single one makes a difference, whether it's a 1 time 1 euro donation or a recurring one on Patreon paid in full for the next year. Every single one of them brings us one step closer to a point where Konstantin (who is in charge of our mobile apps) and I will be able to spend more time polishing Dawarich.

If you happened to be (or know someone who is) a Youtube blogger, a podcaster or just have a blog, we'll be happy to talk to you in case you'd like to create something featuring Dawarich (or Dawarich Atlas for that matter, I'll be giving a talk on it on October's Berlin Geomob). So ping me!

As always, our links to save you a scroll:

Github: https://github.com/Freika/dawarich

Website: https://dawarich.app/

iOS app: https://apps.apple.com/us/app/dawarich/id6739544999

Android app: https://play.google.com/store/apps/details?id=app.dawarich.Dawarich

Donate: https://www.patreon.com/freika / https://github.com/sponsors/Freika/

Thanks and see y'all in a ~month!

P.S. Cooking something legendary

So I used Jellyfin mostly for series and movies, so far work great. However I got a couple of audiobooks I want to listen to on my way to work and Jellyfin stop working each time I close my screen. So yeah…

What are you using for music ?

Update : People suggest Finamp, which I installed on my phone and tried to make it work on my server. After rebuilding my audiobook library to a music library, Finamp didn’t find anything. I’ve restarted, update, etc.

Work out the problem in naming my library « Musique », now Finamp seems to be able to open it

Thanks for all your help 🤟 you rock

Update 2 : Finamp don’t seems to remember where I’ve finish my last listening 🤣 all that for this. Great app however

Hi guys! I have a frequent issue on Jellyfin, that is, whenever there's a new TV show or movie, it quickly gets buried behind by new episodes of existing TV shows, and in the case of movies, even old releases being updated can push behind a brand new release. I was wondering if there was a better theming that might prioritize better brand new movies and TV shows over repeating ones?

I see a lot of options for self-hosting RSS subscriptions and I don't actually understand what they are for. The very nature of RSS is that it tracks and connects to online content. It seems like having a home server track and download the content just so that you can download it on another device from your server instead of the original servers a bit redundant. Also, it seems like the clients are more limited, since it has ro connect to your personal host, as opposed to the many RSS readers available.

Sorry if this is a stupid question, but I genuinely don't get it. What am I missing?

Hi everyone

I'm looking to expand my storage. I have a case capable of 8 bays and I don't think I'll exceed that soon (currently at 3 drives).

I bought a m.2 slot with a bunch of sata ports on it but it doesn't work. I've researched and read an HBA is a much better solution anyway.

If I'm going to get the HBA I might as well run all 8 ports on it.

Aside from the clearance on the card in the case, are there any other considerations I need to he aware of? I justbeant to get something that works from the get go. For my uses I have a good amount of apps and I stream media from the server

CPU- i5-10400f 2.90ghz

MOBO - asrock h570m-itx/ac

RAM - gskill f4-3200c16-8gvkb

GPU - Quadro k620 (gm107gl) rev a2

CASE - Jonsbo N3

It's been a while! Let us know what you're currently working on, what exploded, what cool stuff you found, or just brag that everything is running fine unattended.

I haven't been doing a lot, renovate auto upgrades for patches and sometimes minor updates work great so far. I got involved in my union to spin up a mastodon server soon, so there's a new project, but I already run mastodon so it shouldn't be much of a deal, I just need to get comfortable with the infrastructure. I also set up ntfy but only sent some test notifications and didn't configure any app yet - planned for Element Chat.

[Meta] I'm not sure how to apply the new tags. In the recent versions of this thread, people sometimes posted about their ollama setup or the like, but I'm not mentioning AI in the post body (except this meta thingy) and it shouldn't be much of the discussion, but it's an open post. Maybe curbstickle can chime in to let me know if I should apply one of them.

Heyhey everyone,

I am going to switch from my Synapse instance (back) to Continuwuity in a month. The main reason I've been using it is to chat with family who are only on Whatsapp and iMessage (Yes, I tried getting them someplace else. Whatsapp ended up being that other place). Though I'm also in groups on other Matrix instances.

The main annoyances I had with using the bridge until now are:

1. I need to open the app every two weeks on my second phone (which tends to get lost when I need it).
2. The time my server went out for a couple of days also made me unsure of self hosting a bridge. I don't mind if I can't see some support messages for a couple of days, but I do mind not being able to get texts from family.

Compared to just using the app it's a difficult proposition. But on the other hand I don't have anything proprietary installed on my phone and I'd like to keep it that way if possible.

There is technically a third option by hosting an iMessage bridge, but I don't have a spare Mac. And while my second phone is an iPhone, there is no documentation on how to bridge via a 64-bit iPhone. In this case however, there would be no two weeks access requirement.

I'd love to hear you guys' thoughts and maybe some other way to tackle this!

Cheers!

Edit: Thanks everyone for the help! I've heard some awesome suggestions. I opted to keep using the bridge. Apparently you don't need to open the app to refresh the biweekly timer, just run it in the backgroud. I happen to have a device that is on more than often enough for Whatsapp to refresh that timer in te background.

I don‘t know if this is the right place to ask, but is this an OK build for a first start in selfhosting? Is there anything obvious I could improve? I‘d mainly run Nextcloud, Immich, some Docker containers and smaller web applications and cronjobs.

Consider the following setup:

An NFS server exports the directory /srv/nfsv4 to one client. It is exported with the option "fsid=0" for use with NFSv4.

/srv/nfsv4              192.168.0.10/24(ro,sync,secure,root_squash,subtree_check,fsid=0)

The bind-mounted directory within it, foo, is exported as well. Client 192.168.0.10 can successfully mount and write to it.

/srv/nfsv4/foo          192.168.0.10/24(rw,sync,secure,root_squash,subtree_check)

"foo" has multiple subdirectories. While client 192.168.0.10 should have full read-write access to all of them, another client, 192.168.0.20, should only see a specific subset of these directories. Everything else should not only be read-only, but not mountable at all.

At first, I did it like this:

/srv/nfsv4              192.168.0.10/24(ro,sync,secure,root_squash,subtree_check,fsid=0) \
                        192.168.0.20/24(ro,sync,secure,root_squash,subtree_check,fsid=0)

/srv/nfsv4/foo          192.168.0.10/24(rw,sync,secure,root_squash,subtree_check) \
                        192.168.0.20/24(ro,sync,secure,root_squash,subtree_check)

/srv/nfsv4/foo/dir1     192.168.0.20/24(rw,sync,secure,root_squash,subtree_check)

/srv/nfsv4/foo/dir2     192.168.0.20/24(rw,sync,secure,root_squash,subtree_check)

With the effect that client 192.168.0.20 could still mount all other subdirectories of foo (even though read-only).

So, in an attempt to achieve the desired behavior, I created a second parent directory /srv/nfsv4/bar/ that has only the intended set of subdirectories bind-mounted to it:

srv/
└── nfsv4/
    ├── foo/
    │   ├── dir1
    │   ├── dir2
    │   ├── dir3
    │   └── dir4
    └── bar/
        ├── dir1
        └── dir2

And changed /etc/exports to look like this:

/srv/nfsv4              192.168.0.10/24(ro,sync,secure,root_squash,subtree_check,fsid=0) \
                        192.168.0.20/24(ro,sync,secure,root_squash,subtree_check,fsid=0)

/srv/nfsv4/foo          192.168.0.10/24(rw,sync,secure,root_squash,subtree_check)

/srv/nfsv4/bar          192.168.0.20/24(rw,sync,secure,root_squash,subtree_check)

Now, when I mount nfs-server:/bar on client 192.168.0.20, everything seems as expected. Except that I could still mount nfs-server:/ (the exported root) and have read access to foo. My understanding was that, unless I explicitly exported foo to 192.168.0.20, it should not be visible to it.

What did I do wrong?

CookTrace is a self-hosted recipe, pantry, and cook-diary app. Single Docker container, PWA + native Android app, no accounts on external services, no telemetry. Third app in the Trace family alongside NutriTrace and LiftTrace.

v1.1.1 rolls up everything since v1.0.3 (a couple months of work, went straight from 1.0.3 to 1.1.0 to 1.1.1).

Added

• In-app updates. New Settings → Updates panel checks GitHub Releases for a newer version. On Android, downloads the signed APK and hands off to the system installer via FileProvider. One primary button drives the whole flow: Check Now → Download & Install → Downloading X%. Skip This Version link when an update's available, inline "What's new" markdown panel, opt-in Stable or Dev channels. Silent shade notification when the OS notification permission is granted; top-of-app banner as fallback.
• Full i18n retrofit across the app. Every hardcoded UI string extracted into src/i18n/en.json and reads via svelte-i18n. ~460 new keys, Weblate-ready. Covers Settings, Pantry, Recipes, Cook Diary, Shopping, Trace AI, and every shared widget. Chicago-style title case for labels/buttons/headings, sentence case for body prose. Column-aligned values and paired <key>_desc sibling keys so translators get inline context.
• Pull-to-refresh sync (Android). Swipe down from the top of any page to trigger a manual sync in native server mode.
• Smart connection banner. When sync fails, the banner explains what actually went wrong (no network vs cellular-only vs server unreachable vs HTTP error) with a Retry button, instead of a generic "sync error".
• Cloud icon in hamburger menu goes red on server disconnect. Previously only lit up when the OS reported offline; now also triggers on server-side outages and cellular-vs-LAN routing mismatches.
• Pantry page: configurable default search source. New setting under Settings → Food Sources → Pantry Search picks which chip the Pantry page opens with (All, My Pantry, OFF, USDA). Sticks across sessions + devices.
• Optional email on Create Admin Account form. Shows up when SMTP is configured via environment variables. Stored on the admin user record for password-reset and invite emails later.
• Accent-tinted browser chrome. The browser tab bar picks up the current accent color via <meta name="theme-color">. Running CookTrace alongside NutriTrace / LiftTrace? Distinct accent per install makes tabs visually distinguishable at a glance.
• Docker Hub mirror. Images now publish to both ghcr.io/traceapps/cooktrace (primary) and traceapps/cooktrace on Docker Hub. Identical multi-arch tag set on both registries.

Changed

• Bitwarden and other password managers show a real app identifier instead of "localhost" (Android). The Android app used to serve its WebView from https://localhost/, so autofill entries saved as "localhost" and were indistinguishable from any other localhost app. Now identifies as app.cooktrace.local, which reads clearly in autofill dialogs and saved-credentials lists. One-time upgrade cost: the origin change orphans locally cached web-only state, so on first launch after upgrading you'll re-enter your server URL + log in again (server-connected users) or lose theme / accent / display prefs (standalone users). Recipe, pantry, and shopping data is unaffected (that lives in a separate local SQLite DB).
• SMTP "Username" field relabeled to "Email or Username". Most providers want the full email; the label change removes the guesswork.

Fixed

• OFF country filter works again + picker expanded 15 → 30 countries. The Pantry's Open Food Facts country filter was being passed with the wrong query shape (countries_tags_en=<slug>), so selecting Norway or any non-World option silently had no effect. Fixed by using search-a-licious's native inline Lucene syntax. While in there: alphabetized the picker and added Argentina, Austria, Belgium, Chile, Denmark, Finland, Ireland, Netherlands, New Zealand, Norway, Poland, Portugal, Singapore, South Africa, South Korea, Sweden, Switzerland.
• App icon no longer shows a white halo. Bundled icon PNGs had ~15px of solid white padding baked into their corners; on tinted browser chrome the halo was visible around the tab favicon. Corners now clear cleanly. Icon URLs cache-busted with the app version so future icon fixes take effect without a browser cache clear.
• Create Admin form password field no longer crushed. The password input on the Enable User Management form was rendering as a colored sliver because of a flex-layout bug. Password + Confirm now sit symmetrically side-by-side, each with its own eye toggle sharing show/hide state.
• Server-connection banner no longer covers the phone's notification bar (v1.1.1). The red "server unreachable" banner sat edge-to-edge at viewport top:0, which on Android slid it up over the status bar / clock. Now floats as a rounded card below the status bar and the compact header.

Where to Get It

Docker Compose:

services:
  cooktrace:
    image: ghcr.io/traceapps/cooktrace:latest  # or traceapps/cooktrace:latest on Docker Hub
    container_name: cooktrace
    ports:
      - "3003:3001"
    volumes:
      - ./data/db:/data/db
      - ./data/uploads:/data/uploads
    environment:
      JWT_SECRET: change-me-to-a-long-random-string
      DB_PATH: /data/db/cooktrace.db
      UPLOADS_PATH: /data/uploads
    restart: unless-stopped

Then docker compose up -d and open http://localhost:3003/.

• GitHub: https://github.com/traceapps/cooktrace
• Docs: https://traceapps.github.io/docs/cooktrace/
• v1.1.1 release notes: https://github.com/traceapps/cooktrace/releases/tag/v1.1.1
• Full CHANGELOG: https://github.com/traceapps/cooktrace/blob/main/CHANGELOG.md
• Android APK: signed, on the Releases page (shared TraceApps keystore, in-place upgrades work)

AGPL-3.0. No accounts, no telemetry, no external cloud unless you opt in (Open Food Facts, USDA, or an AI provider you supply the key for).

AI Disclosure

Per Rule 7 / [AIP] disclosure requirements AI was used during development as a coding assistant. Level per category:

• Design (architecture, system design): Hint — I make the architectural calls; AI suggests trade-offs and edge cases I might have missed.
• Implementation (production code): Pair — roughly 50/50. AI drafts, I review, adjust, test on real hardware, and only commit what I've verified. Every commit is manually reviewed before it goes to my dev repo.
• Testing (writing tests, test plans, QA): Assisted — real-device testing is manual (I test on my own PC and mobile devices before every release). AI helps draft test plans and think through edge cases.
• Documentation (docs, comments, README, CHANGELOG): Pair — release notes and changelog entries are drafted with AI then edited for tone; comments and code docs are mostly Pair as well.
• Review (code review, PR feedback): Assisted — I'm the reviewer; AI helps with security sweeps, audit passes on complex changes, and consistency checks.
• Deployment (CI/CD config): Hint — Docker/GitHub Actions/release pipeline is largely conventional; AI-suggested improvements only.

I’ve been building an /*arr stack of apps to automate manga and comics. Together, they allow you (and ur users) to request media, then automate and organize it for you.

• Edit: This was made with AI! My apologies for forgetting to state that. I spent a lot of time testing and iterating these apps, but they are very much built with Claude and Codex!

Mangarr — manga library automation

Mangarr helps you keep a manga library current and tidy.

• Search for series with cover art, descriptions, and up-to-date chapter lists.
• Choose which series and chapters you want to follow, then have new chapters added to your library automatically.
• See a clear “wanted” view so you know exactly what is missing.
• Browse your collection in a poster-style library and see each series’ chapter progress at a glance.
• Works alongside an existing collection: it can recognize what you already have, so it focuses on the gaps instead of starting over.
• Scan your folders for newly added files, review anything it could not identify, and match it manually when needed.
• Preview and apply consistent filenames without overwriting or deleting your existing files.
• Keeps each chapter neatly organized and ready for a separate reader such as Komga or Kavita.

Pullarr — comics library automation

Pullarr is the western-comics counterpart to Mangarr.

• Search comics by series, with cover art, publisher details, issue lists, and release dates.
• Follow the issues you care about and have newly released issues added to your library automatically.
• See missing issues in one place instead of manually checking long-running series.
• Keep your comics in a clean, consistent folder structure, ready for Komga or Kavita.
• Bring an existing library with you: Pullarr can scan your folders, recognize files you already own, and avoid downloading them again.
• Preview renames before making any changes, find duplicate files, and clean up mismatched items.
• Manually match collected editions or trade paperbacks to the issues they contain, so your library progress stays accurate.
• Offers more detailed creator, story, and collection information when available.

NextPanel — a request app for your library

NextPanel gives other people an easy, friendly way to discover and request manga or comics from the library.

• One place to search across both manga and western comics.
• A Discover page with trending manga, seasonal picks, favorites, newly released comics, and new comic series.
• One-tap requests for titles that are not already in the library.
• A simple approval queue, so the library owner can approve or decline requests with a reason.
• Clear request progress: people can see when a title is being processed, partly available, or fully available.
• Notifications when a new request needs approval, or when a requested title becomes available.
• Separate accounts so people see their own requests while admins can manage everything.
• Installable on a phone like an app, with a layout designed to feel comfortable on mobile.

I built these because I wanted the convenience of a well-organized media library for manga and comics. Feedback, feature ideas, and bug reports are very welcome.

AI Project Disclosure [AIP]

AI was used in the development of these projects as follows:

• Design — Assisted: I drew up the designs and used AI to help turn those designs into the applications.
• Implementation — Generated: I defined features, tested the apps myself, and identified bugs, while AI produced most of the production code.
• Testing — Generated: AI generated much of the testing work. I also tested each app myself, identified issues, and guided what needed improvement.
• Review — Generated: AI handled most code review, while I provided direction based on the features and issues I found.
• Documentation — Pair: AI generated the initial documentation, and I refined it for accuracy and clarity.
• Deployment — Pair: AI drafted the Compose files and helped set up the automated image builds and Docker Hub publishing; I worked with it to configure and validate that setup.

I remain responsible for the projects’ direction, feature decisions, testing, and final validation.

• Fixed issues in the RUDP library: memory leaks when using shutdownHook, deadlocks, handling of corrupted UDP packets, and many other issues that were identified during testing.
• Added the display of the connection protocol to the peer list.
• Added an experimental build that compiles a .jar file into an executable using native-image in GraalVM. For now, this is for the headless version of the application on Linux x86_64. To avoid running Lanemu as root, you also need to do

sudo setcap cap_net_admin=eip Lanemu-headless

• Updated dependencies.

[AIP] Disclosure: https://github.com/Supernova3339/changerawr/blob/master/AI-DECLARATION.md

Hello c/selfhosted! I'm Nova (known as Supernova3339 online) and was told to post here by my friend fccview. Admittedly, I have made this post before (apologies for not noticing the rule) and hope my second attempt will be much more favorable for all of you. I'm just facing constant rejection and hate on Reddit, it's not like it used to be anymore unfortunately, and I'm hoping you’re willing to give me a chance :)

You can find Changerawr's source code here
With that out of the way, let's get started with the release notes!

Features

• Extensions – Extend the functionality of Changerawr's beloved Markdown editor. Comes with four extensions installable from the get-go thanks to the official Changerawr Extension Store! If you'd like to make your own, download the official Changerawr CLI!
• Spellchecker – Adds Spellchecker functionality to the editor via integrating with the LanguageTool API! You can configure all related functionality in system configuration. This feature is disabled by default
• Editor History – Provides a git-like editor history for your changelog entries! You can make them memorable as well by assigning icons, titles, and color!
• RSS Feed Extension – Full control over RSS feed content, layout, and styling!
• Maintenance Mode – Put any public changelog into maintenance mode. You can also set your own message
• More Project Personality – You can now set an accent color and icon that will be used throughout the application to identify a project!

Improvements

• Moving some functionality to local AI – Tagging with AI has been moved to a brand-new Tag AI service that runs alongside Changerawr. Also introduces some improvement to the tag selector itself with a redesigned UI. Please note that the model has training, it is, however, fully local and transparent and will never leave your device!
• Request System Enhancements – You can now attach comments to a request as well as request changes! Updated the design of the staff-side requests page as well
• API Page Redesign - Redesigned the API page to make better usage of screen-space and improved accessibility
• Better mobile support – Improved mobile support by separating the project and main sidebar
• Overhauled API Documentation – Improved API documentation generation to be easier to consume and understand
• Administration UI Spacing – Improved screen-space usage and cut out unnecessary clutter. Also added some badges to the sidebar that show up if you have pending actions for certain pages
• Import Tool Rewrite – Improved the import tool to support more options, platforms, and ways of importing. I'll try to add to the next release where you can fully export ALL of your Changerawr instance's data! I honestly hate vendor lock-in, you should be able to choose your software and not be forced to keep using it.
• Content Editor Improvements – Improved mobile support in the content editor, the renderer, as well as a lot of internal components to provide an overall better user experience. (v2.0.0 of Changerawr Universal Markdown)
• Slight Settings Redesign for Projects – Made some slight improvements to the UI, as well as adding more deletion controls and hinting at an upcoming feature

Bug Fixes

• Bug Fix Extravaganza – Fixed a bunch of bugs in this release, way too many I can't remember all of them.
• Fixed development-leaving of false-secure in project email configuration – No matter what you set, it would always send as unsecure due to hardcoding false instead of respecting user-input

Other

• Dependency Updates – Standard update of dependencies, npm audit, the usual maintenance
• Rewrite of a Secret - Rewrote a secret completely to be a much better experience. Also added another one, best of luck in finding it! I will most likely redo the sprite-sheet in 1.0.8/1.0.9 to better fit Changerawr. If you'd like to make it, please reach out!

I aim for a Changerawr release every month or so due to my unavailability with work and other projects. The goal is to ship one major feature per-release until I'm at a point where I can focus on smaller, generalized improvements. Apologies for such a late release, I hope all the effort is worth it! :D

What is Changerawr?

Changerawr is changelog management software. Changerawr lets you write down what you changed, then share those changes with people. You write entries about updates you made, and Changerawr gives you ways to display them - like widgets for your website, public pages people can visit, or APIs to use however you want.

Have a rawrsome day!

If you aren't able to click the link, copy-paste the below URL:

https://github.com/Supernova3339/changerawr

If your looking for screenshots, you can find them here - as well as a rotating gallery on the project README!

https://github.com/Supernova3339/changerawr/tree/master/screenshots

Hi good people... just looking for some feedback ...

I have a couple of Raspberry Pi 3 with audio amp outputs (one has a touchscreen as well).

They're currently running Volumio (v2) which we can control remotely with our phones, but that software is old, insecure, and could really do with an update...

Volumio (v4) doesn't inspire me much, plus, it's good to check out the alternatives.

So, I'm looking at replacing the local-audio playback with perhaps Moode ... or maybe piCorePlayer and perhaps adding Navidrome for remote access??

I'd need to be able to play radio streams too, with a sleep timer / wakeup function, so not sure if that's a deal breaker (it's hard to find these features on their websites)

Any alternatives that others can suggest (rAudio?) or other feedback?

Or am I ahead of the curve and I have found the Best Solution™️?

TIA