posts
Last winter I finally moved family photos off Google Photos. Not for ideology, just tired of Google One getting more expensive every year.
Hardware: old Dell Optiplex 7040 (i5-6500, 16GB, 1TB SSD + 4TB HDD) in the bedroom closet, running Proxmox. LXC with Immich for photos, Nextcloud for docs, and Matrix for family chat.
It was messy. I set up Immich, told family it's done, but forgot to set up proper backups. In January the HDD had errors and I almost lost a month of kid photos. No 3-2-1, only local copy. Wife still brings it up.
Now: Immich with daily backup to external USB, weekly rclone to B2, and Nextcloud with versioning. Matrix is still half-used because sister is on Messenger.
Cost is now about $6/mo for B2 vs $15+ for Google One family, but time cost is higher.
For those who run Immich on similar old Optiplex / small box in closet — how do you handle backups without making it a second job? And how do you keep noise/heat down? My closet is warm and wife is not happy about second heater.
Happy to share docker-compose if anyone needs.
nitter.net is currently replaced with a message about the C&D until zedeus (lead dev) gets legal advice on how to proceed. Other instances are probably ok for now (or at least until an API break). Not a great sign for anyone else who hosts it, but hopefully it gets resolved without development permanently stopping.
If it helps others this was my config. To be honest I have a weak grasp of what it actually does so there might be some security issues with it.
Apparently you can also add lemmy as a search engine. Will work on that later.
config
# docker-compose.yml
name: searxng
services:
core:
container_name: searxng-core
image: docker.io/searxng/searxng:latest
restart: always
network_mode: "service:gluetun"
volumes:
- ./core-config:/etc/searxng
- core-data:/var/cache/searxng
gluetun:
image: qmcgaw/gluetun:v3.41.3
container_name: gluetun
cap_add:
- NET_ADMIN
environment:
- VPN_SERVICE_PROVIDER=custom
- VPN_TYPE=openvpn
- OPENVPN_CUSTOM_CONFIG=/gluetun/custom.conf
ports:
- 8080:8080
restart: always
volumes:
- ./gluetun:/gluetun
devices:
- /dev/net/tun:/dev/net/tun
nginx:
container_name: nginx
image: nginx:latest
ports:
- 80:80
- 443:443
volumes:
- ./nginx:/etc/nginx/conf.d
- ./cert:/etc/nginx/cert
valkey:
container_name: searxng-valkey
image: docker.io/valkey/valkey:9-alpine
command: valkey-server --save 30 1 --loglevel warning
restart: always
volumes:
- valkey-data:/data/
volumes:
core-data:
valkey-data:
# nginx/default.conf
server {
server_name localhost;
listen 443 ssl;
ssl_certificate /etc/nginx/cert/cert.pem;
ssl_certificate_key /etc/nginx/cert/private.key;
location / {
proxy_pass http://gluetun:8080/;
proxy_set_header Host $host;
proxy_set_header Connection $http_connection;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
}
server {
server_name localhost;
listen 80;
location / {
return 301 https://$host$request_uri;
}
}
Good day everyone!
I finally got arround to hosting my own lemmy instance and I decided to make it all about my island. You are free to look (TW: Spanish).
So to help start things up I decided I'd grab an RSS bot and populate a couple communities with local newspapers. This one seems to be very promising as all the others I've found had the typical unmaintained errors and had 2+ years on their belt.
So now that I've had one tool on my belt I wonder what's in everyone's toolbelt. What do you use to manage the instances?
Unusual request, so let me be straight about what it is before I ask for anything.
The short version: I pay for MLB.tv, but the league geo-restricts games depending on the IP you watch from. The one setup that unlocks every game (no local blackouts, and none of the "this game is a Netflix/Roku/Peacock exclusive" carve-outs) is MLB.tv International, which needs a UK or EU IP. I've built a small Raspberry Pi that lets my stream appear to originate from a home internet connection over there, and I'm looking for someone willing to plug one into a spare ethernet port and forget it exists.
The honest part: this works around MLB's geo-restrictions, which is against their terms of service. I'm doing it with a fully paid subscription to watch games I've already paid for, but if that's not something you want on your connection, totally fair, no hard feelings, stop reading here. I'd rather you pass than feel misled.
Still with me? Here's everything.
First, the thing you actually care about: it barely touches your connection
It is NOT a 24/7 relay, and it does NOT stream whole games through your line. MLB only checks your location at the moment a stream starts. So my usage is:
- I switch it on only at game time, for a game I'm actually blocked from.
- The stream starts, the check passes, and after under ~5 minutes I switch it back off
- The game then keeps playing over my own connection, not yours.
Net effect on you: a WireGuard handshake and a few minutes of video per game I watch. A few MB, not hours. I use a Home Assistant script to enable/disable the VPN Client in UniFi, so it's guaranteed to shut off after a few minutes. No accidentally leaving it on forever and using your connection
Why a residential UK/EU IP, specifically
I've already done the homework, and residential is the only door left open:
- I already run this through a family member's connection in the US, and it works flawlessly. But a US IP still leaves me blocked from national-broadcast games (the ESPN/Fox/Peacock/Apple/Netflix exclusives), because those are carved out of US MLB.tv at the product level no US IP fixes them. MLB.tv International has no such carve-outs, hence UK/EU.
- Commercial VPNs are blocked. I tried Mullvad, Proton, Nord and others... MLB blocks their IP ranges outright; streams fail to start.
- Datacenter/VPS IPs are blocked too. Hetzner, OVH, etc... same story, flagged as non-residential and refused.
A real residential connection is the only thing MLB treats as a legitimate viewer. That's why I need a person with a spare port, not a server I can rent.
How it works (the technical bit)
- The Pi runs WireGuard, dialing outbound to a small cloud relay I rent (it never listens for inbound, so your router never needs to forward a port to it).
- It also runs Tailscale as an independent, outbound-only management door, so I can maintain it without ever asking you to touch it.
- The OS is a hardened Raspberry Pi: deny-all-inbound firewall, key-only SSH, no passwords over the wire, automatic security updates, and self-healing tunnel watchdogs.
[ my home, Starlink / CGNat ]
│ WireGuard (encrypted, outbound)
▼
[ small VPS I rent ] ◀─ only forwards encrypted frames; sees nothing
│ WireGuard (encrypted)
▼
[ My Pi in your home ] ── dials OUT only, never listens; firewall blocks your LAN entirely
│
▼
[ your home internet ] ──▶ MLB.tv (only ever sees your residential UK/EU IP)
( my paid stream flows back up the same path to my TV — I switch the tunnel
off after the first few minutes, so most of it never crosses your line )
What I'd send, and what you'd do
A Raspberry Pi in a small case. You give it power (~3–5 W, ~£0.50/month of electricity) and one ethernet port. That's the entire job... no router config, no port forwarding, no software on your devices, no accounts.
What it can't do on your network
The firewall denies all inbound, and for forwarded traffic it drops every private-network destination before allowing anything out. In plain terms: traffic from my tunnel physically cannot reach your LAN... not your PCs, NAS, printer, or router admin page. It can only reach the public internet.
Two things make trusting me cheap:
- Put it on a guest/IoT VLAN if you have one. Isolating it costs it nothing and then the guarantee above is enforced by your gear, not my word.
- Unplug it whenever. Nothing on your end depends on it.
Trust but verify
Send me your SSH public key and I'll set you up a read-only account. One command, sudo host-verify, prints the live firewall rules, the tunnel status, and every connection the box currently has open — so you can confirm all of the above any time. That account can't change anything or reach the rest of the box; it's there purely so you don't have to trust me blind. Happy to walk through the whole config with you too.
What's in it for you
Mostly my genuine gratitude willingness to reciprocate in kind: host something for you, help on a homelab project, or whatever feels fair.
If you're in the UK or EU and up for it (or just have questions) reply or DM. Cheers, and thanks for reading either way.
What do others use for ensuring the authenticity of images after downloading them with docker pull?
We’ve setup our CI build process to use docker for consistent, cross-platform builds. To ensure that our builds don’t use a malicious docker image (because the surface area of attack with TLS is enormous if you’re using X.509), we’ve been using DCT (Docker Content Trust).
Unfortunately, I just discovered that the official docker documentation says that DCT is being deprecated. Apparently this was announced last year, and in June this blog post was published with advice:
Cosign is not secure
We spent some time looking into cosign, but we discovered that the private keys aren't actually in the hands of the developer.
Rather, they use this complicated setup using very insecure X.509 to issue temporary certificates.
The result is that the OIDC identity provider (e.g., GitHub) extends the vector of attack significantly -- to probably tens of thousands of people -- that can publish a malicious image that will be accepted by cosign as "trusted"
Notation (Notary v2)
I also looked at Notation (aka “Notary v2”), but there’s no way to bootstrap the software safely, since (perplexingly) their tool for verifying the authenticity of images using cryptographic signatures itself can’t be verified using a cryptographic signature.
Alternatives
Are there any other alternatives that I can use to replace DCT to ensure the authenticity (using cryptography) of the container images that I download -- where the keys are actually held by the developer (thus significantly reducing the "insider threat" risk)?
What do you (or does your org do) to ensure that you’re not using maliciously-modified containers after pulling a new docker image?
Update your Keycloak
For community, version 26.7.2 has the fix:
https://www.keycloak.org/2026/08/keycloak-2672-released
Are mini stick PCs practical to set up as a media player, eg with jellyfin? Some advantages are the small form factor that plugs straight into the HDMI port, and flexibility/privacy vs using a dongle from a shitty company like amazon/google/roku.
Are there any things to watch out for to ensure it has enough compute power and hardware decoding? I just want it to play HD video with a jellyfin app/browser page.
I'm assuming it's no big deal to install Linux on (x86 hardware?), do you need to watch out for specific device support? Thanks
Continuwuity, the Matrix homeserver with an incredible name, has gotten a new version!
The highlight of this release is a brand new way to track remote server health, in order to recover faster from federation issues. Previously, an unreachable remote triggers a very naive retry loop with increasing timeouts (i.e. sender backoff), which by itself can present cascading problems.
Now, such a loop can be reset when the remote is detected back online (e.g. when they send something new), and any retry attempts also redo the server destination discovery instead of using potentially stale cache values. The result is better, more reliable federation recoveries, especially towards servers with dynamic IP addresses rotation.
Experimental support for Sticky Events has also been added behind an opt-in toggle. These special event types allow for efficient, ephemeral user states that can expire later, such as someone's participantship in a video call. Alongside the drafts for Delayed Events and embedded Livekit token service, it is one of the building blocks to support calling in the MatrixRTC 2.0 era.
Futhermore, various bugfixes to OAuth2-based logins, client-server syncing, and room state resolution allows for a smoother, more correct experience. The docs have also been updated in some aspect. Finally, the new version also contains a security fix in store, so please update after checking the changelogs accordingly.
Still reeling in from the June update where a third of the codebase was refactored, the homeserver's development remain steadfast as ever, despite any recent downtimes on the git forges or community rooms. The maintainer team yet again delivered with speed and excellence, so Continuwuity can be a Matrix server you can run!
DISCLAIMER: All the code was written by humans until December 2025. Since then, we have started using AI as an assistant, mainly to speed up debugging and for low-value-added tasks (UI and some simple logic). However, all code is reviewed by a human, and the architecture is designed exclusively by humans.
Hi everyone,
We’ve just released Portabase 1.29, with another round of improvements focused on configuration, reliability and reducing the amount of manual setup required.
Repo: https://github.com/Portabase/portabase
Quick recap if you’re new to Portabase
Portabase is an open-source, self-hosted backup and restore platform designed for data retention, disaster recovery and homogeneous database migrations. It uses a central dashboard with lightweight agents deployed close to your databases and workloads.
We currently support 9 database engines (PostgreSQL, MySQL, MariaDB, MongoDB, SQLite, Redis, Valkey, Firebird SQL and Microsoft SQL Server) as well as Docker volume backups.
What’s new
You can now add new databases directly from the dashboard! Until now, databases were only declared through the agent's configuration file (databases.json). Both approaches can be used depending on how you prefer to manage your infrastructure.
Portabase now checks whether backup files are actually still available in the configured storage. If a file has been deleted, moved, or is otherwise unavailable, it is now marked as unavailable instead of being presented as a valid restore candidate.
The new version of the agent (v1.19) adds support for MongoDB SRV connections, making it easier to connect to MongoDB deployments using mongodb+srv://, including managed/cloud MongoDB environments.
What’s next
We’re now working on several areas:
- Deploying a public Portabase demo
- Improving and restructuring the documentation
- Enhancing the agent retry and resilience system
- Additional dashboard UX/UI improvements
- A database-specific options system, allowing advanced parameters to be configured for each supported engine
- Audit logs across the ecosystem for better traceability
As usual, feedback is welcome. If you find bugs, have trouble with the new dashboard-based configuration, or need database-specific options we don’t support yet, feel free to open an issue on GitHub.
Thanks!
I read today about VyOS and I really like the idea and approach but I am not sure how it compares to Opnsense in terms of performance and features. I know it doesn't have a GUI, which is a bit of a bummer for me.
I have purchased a mini router PC and I was thinking to build a dedicated router and firewall on it. I also have another PC that I am planning to run as a Proxmox host and install a couple of VMs and LXC containers, as well as Home Assistant along with Omada, as I am thinking of purchasing some TP-Link AP compatible with Omada.
But would love to hear some feedback from people who used both what they think.
Keep in mind that although I am technical and have a fair understanding of networking and VLANs I am not exactly an expert in networking. Does it make sense to go into the VyOS route in that case?
The end goal is to have a dedicated network and routing for the IoT network, dedicated Wireguard, guest WiFi, etc.
This questions goes to the immich-wise people around here.
I have just some pics from my wife's google phoots that I want to import on our immich account. What's the best way to bring it with the correct metadata? Just save locally onthe desktop than import into immich?
another doubt is how adequately import old scanned photos on immich. I have scanne some thru an self-loader scanner. they are somewhat bent, in the wrong direction and need cropping and other minor adjusts. Would be better to make this on the desktop with some tool and than import to immich OR import everything in the way they are and then edit them inside immich?
Wireguard is blocked in my country, so I no longer can use Tailscale or other Wireguard-based solutions. My home server is behind a NAT. What other ways of secure private connection can I use?
Floppy seems cool. I am curious about how/why people use these types of tracking services for their media.
didn't see it mentioned here, so a brief YSK.
stefano marinelli is working on #littleFedi, a self-hosted, single-binary activitypub/fediverse peer that hosts a mastodon-like instance with, in my mind, three killer features.
one, the thing can run on your premises completely, no need for paying for a VPS, domain name, nothing, bypasses NAT/CGNAT, encrypted comms to other instances by way of lighthouses that do the initial intros.
dos, the thing runs on something as light as a Pi zero 2W, with a miniscule memory footprint and immense CPU optimizations due to running on the weakest hardware there is (also running off SD storage).
finally, a blog-like view of your long-format tweets/toots/posts, naturally with replies appearing as comments.
original post introing the thing: https://littleone.littlefedi.social/@stefano/4252ae6f-b949-42f8-a021-fd2b698f8b37
no code available atm (coming soon) same goes for binaries. the first instance is at https://littleone.littlefedi.social/ if you want an invite code to check things out (the settings page's got a lot of cool stuff), hit up stefano.
I am beyond stoked, this clears the two biggest hurdles for selfhosting your shit - the VPS/domain expense and hassle, and the hardware requirements for running it.
edit: missed that the website is up, explaining everything way better: https://littlefedi.org/
So...I was wondering. Is there any backup tape system that would be advisable to use for backing up some TBs? I guess I need it to be USB, as the server is a micro PC, one of those tiny ones you can hang from behind a monitor. It's an HP ProDesk.
Thanks!
DISCLAIMER: This is pretty much 100% AI generated. The project is kept really simple. Before you downvote, make me a generic webui for printers. 😉
I made this project to fill a need I had. I am not collecting internet points here, I don't care if you don't like it.
I found Akronae's repo laying half broken on github, made it work, and thought it was a simple enough project that it could have a rewrite (it needed). I can not participate in Github so here you go, full new repo on an unreliable self-hosted forgejo instance. If you are interested, take it before my hardware fails again. :)
What is it?
It's a web UI to upload documents and print them. I wanted that to print from any device in my home with zero config on device (think guests, family...). It pairs very nicely with scanserv.js.
It looks like this:

Remarks are welcome, but I do not guarantee maintenance. As we have seen the trend of AI projects not being maintained in time, I don't expect this project to escape that fate.
And now an attempt to tag: @Shimitar@downonthestreet.eu
Edit: added one screenshot here and 2 other to the repo/readme and added the license GNU AGPLv3.
Edit2, 20260822: After many headaches, I started hosting also a registry (that thing needed to host container images ready to be pulled) and made prebuilt images for amd64/arm64 and started a proper release. You are welcome. Professional stuff, I tell you 😂.
Edit3: Do NOT expose to the internet as of v1.0.0, critical security fixes incoming.
tl;dr- my favorite container is the firefox browser. My work browser is seriously locked down, so I just go to my Homer page and click firefox and a firefox instance opens inside my edgelord browser with all my bookmarks and extensions. It's a simple thing, but easily the service I use more than any other.(compose pasted at bottom)
Anyway, I started with docker desktop on winblows 11. I learned the ropes and then when docker desktop inshittified in an update, I switched to Rancher. All my services are picked up on their local ports by nginx-proxy-manager and then sent through a cloudflared tunnel to the domain I bought, with a customized homer page and strict access controls. Because the VM on windows was running my poor little refurbished Thinkstation too hard, I recently deleted winblows (such a good feeling) and moved over to a headless Debian server, which I run through SSH on my refurbished thinkcenter. 97% usage down to 13% (seriously). I'm only in this computer game for about $500 total and I have more than a few TBs of storage (used SAS drives were really cheap a little while ago and the hardware/learning curve is worth it). If you don't game, old stuff works just fine for pennies on the dollar (I have unplugged backups of all my really important stuff).
I use AI for the CLI stuff I down have memorized. Linux is still frustrating- File ownership is foreign and super irritating to me, being my most recent source of frustration. My Filebrowser instance broke itself and I haven't gotten it back, and of the 30 times I've tried to get Nextcloud to work, I've been successful zero times.
Anyway, it has been hours of my life arguably wasted but it has been fun and educational, and I get to give the finger to big data for the most part. I don't like the cloudflared thing, but free is hard to beat and unless I start torrenting again, I really don't need or want to pay for a VPS. I search this forum and others for new containers to spin up. I marvel at other folks' setups and the money they have spent. I'm a rusty and recycled guy, not a new and shiny guy, but man some of this custom-built, laser-cut, 3d printed stuff is cool.
I just wanted to share my experience and hopefully encourage anyone who is just starting or is on the fence.
firefox: image: jlesage/firefox container_name: firefox ports: - "5808:5800" environment: - TZ=America/Chicago - PUID=1000 - PGID=1000 #- VNC_PASSWORD=${VNC_PASSWORD} - DARK_MODE=1 - WEB_AUDIO=1 - WEB_FILE_MANAGER=1 - WEB_FILE_MANAGER_ALLOWED_PATHS=ALL - WEB_HOST_CLIPBOARD_SYNC=1 volumes: - ./firefox/config:/config:rw - /SWAP:/downloads shm_size: "2gb" restart: unless-stopped networks: - web
My payment processor just terminated my account and i am reminded once again too self host literally everything.
I already have a self hosted crypto rail but for many people that is not an option, bank transfer is quite easy to do with just checking against my bank's API, but remembering from the data before i got terminated it was around 40% transfer, 40% ideal, 20% card.
Is there anyway to self host those other payment ways outside transfer?
Does anyone have experience with this?
If you do thank you very much!
So, I've got a homelab thing going, with NextCloud and Immich and other things... using Docker. But the one thing I can't seem to wrap my head around is how to get my calendar needs met behind the scenes. I'm hoping there's some sort of calendar syncing server I can use.
The problem: I use NextCloud and another android app to use my calendar. Easy. Historically, my household has used a single Google Calendar shared amongst members.
The real problem: They won't ditch Google. But I need a solution so that I can:
- Sync their calendar events to my NextCloud calendar.
- Sync my calendar events to their Google Calendar. I think that the issue here is, the share links that the calendars give, can only be used to list a new separate calendar on each of the respective platforms - not sync the events between the existing calendars...
I'm hoping that there's maybe a syncing solution out there that can play middle man and sync the two calendars directly, rather than having separate calendars for the two environments?
...and this is why
- pihole ain't enough
- you dont buy skeezy shit off aliexpress
- if your pirate box isn't self hosted, it's a prostitute :P

.
Honestly.... I'm kind of impressed at the level of fuckery that vSeeBox goes into. This is not just a random crypto mining bot... someone with real skills went to a fair bit of trouble to obfuscate things.
Impressive. Most impressive.
PS: don't buy vSeeBox - or do, with eyes wide open.
I've been setting up my first nas and set up DNS routing from my router to adguard home, which then routes traffic to nginx-proxy-manager, which then routes to the docker container for the intended service. I've spent days pulling my hair out, trying to figure out what the issue was - why all my services behind NPM were periodically unreachable on my browser. after a wifi reset on my laptop they'd come back online, but why? today I found out that although my router correctly had the DHCP setting correctly set up to route IPv4 traffic to adguard, there was a separate section in the router settings that handles IPv6 settings, and that this was set up to look for my ISP's assigned DNS provider. Just posting on the off chance anyone finds this helpful or entertaining. I am extremely tired (I have a 3 month old baby) so please bare with the poor formatting of the post!
I run a quite large vps. now and i want to monitor it ive been using beszel an uptime kuma, does anyone know a better solution ive tried grafana an prometheous. but it was not as good as i was hoping. i saw netdata on selfh.st does anyone have expierance with that.
I have a headless raspberry PI 4 8GB connected to my TV setup with Kodi and the Jellyfin add-on. Now I would like to have a convenient option to watch Youtube in a privacy-friendly way on the TV.
The experience should be similar to Freetube: creating playlists, search videos, follow subscribed channels. I don't mind running it either directly on the PI or install it on my server.
Thanks for any recommendations of what you folks use!