1
 
 

Hello everyone! Mods here 😊

Tell us, what services do you selfhost? Extra points for selfhosted hardware infrastructure.

Feel free to take it as a chance to present yourself to the community!

🦎

2
 
 

Every public request to one of my sites used to go through a Cloudflare tunnel. I had a cloudflared deployment in my cluster, some routing rules, and everything just worked. And it was free! But that bugged me. TANSTAAFL right? The whole point of selfhosting is to not rely on big cloud company, and there are few bigger than Cloudflare. And Cloudflare’s tunnels decrypt every single packet, so they see everything you do. I really don’t like that.

So I’ve replaced Cloudflare tunnels with Erwan Leboucher’s towonel, a selfhosted tunnel implementation. I still have my DNS on Cloudflare, but no data is moving through them any more.

...

3
 
 

title: "Internet centralization and the original sin of NAT" url: "https://dreamstation.systems/personal/ntppost.html"


File Transfer, Randall Munroe, https://xkcd.com/949, Creative Commons Attribution-NonCommercial 2.5

In this comic, the concept of an ordinary person having an FTP server is quickly dismissed. And yes, it’s not common. To the average computer user, the idea that someone could just… connect to your computer feels exotic, or even dangerous — see the very common ironic fear of your IP address being known to other people on the internet.

If you take someone who’s “good with computers” but not a networking person, their mental model of The Internet probably involves a definition of “servers” or “the cloud” that distinguishes them from personal computers in some meaningful way. True peer‐to‐peer, if they ever think about it, is an endeavor: WebRTC, STUN, TURN, ICE, what have you. Given that we live in a world of NAT, CGNAT, and restrictive ISPs, this isn’t entirely wrong, but it breaks the elegant design of the original Internet.

Why you don’t have an FTP server

Network address translation (NAT) was first formally proposed in RFC 1631 in 1994. In its abstract, it says:

The two most compelling problems facing the IP Internet are IP address depletion and scaling in routing. Long‐term and short‐term solutions to these problems are being developed. The short‐term solution is CIDR (Classless InterDomain Routing). The long‐term solutions consist of various proposals for new internet protocols with larger addresses.

Classless interdomain routing is not the point of this post, but basically we started giving people more options for network sizes, and while complex in implementation, it was philosophically virtually uncontroversial.

RFC 1631 proposed a second short‐term solution to IP address depletion and scaling in routing: NAT. While it is not exactly the same type of NAT omnipresent on home routers today, the basic idea is the same: it allows multiple devices to share an IP address (from the perspective of a device on the other end of a routing device) by modifying the network address information in the IP packet headers while transferring the packet across a traffic routing device. We then later reserved certain addresses for private use, and these things are used in conjunction on most IP networks — private addresses within the network, NATing to one public address at the router. On your typical home router, here’s how you usually connect to an external server with NAT 1:

  1. Your computer sends a packet like this:

    | Source IP | 10.11.70.21 | | Source Port | 50413 | | Destination IP | 67.215.249.229 | | Destination Port | 70 |

  2. It hits your router, and it modifies it to this:

    | Source IP | 146.7.15.85 | | Source Port | 60612 | | Destination IP | 67.215.249.229 | | Destination Port | 70 |

  3. The server replies:

    | Destination IP | 146.7.15.85 | | Destination Port | 60612 |

  4. Your router rewrites it back:

    | Destination IP | 10.11.70.21 | | Destination Port | 50413 |

If you’ve thought this through, you might be asking: in the situation that an external server wants to talk to you first, how does that happen? It sends a packet to 146.7.15.85, and your router…

Oh no. It has no idea where to send it.

Working around it

Naturally, people noticed this was a problem almost immediately, because people have wanted to run game servers, FTP servers, and web servers from their bedrooms since roughly the beginning of time. So a whole ecosystem of workarounds grew up around NAT, none of which restore the fundamental intention of the internet, and none of which work for everything.

Port forwarding

The most direct fix is to just tell your router “hey, when a packet comes in on port 60612, send it to 10.11.70.21 on port 50413, no questions asked.” This is port forwarding, and it’s the workaround to NAT that the most people are aware of. One of the problems with port forwarding, conceptually, is that one public IP+port can still only map to one device at a time, which means that two devices can’t operate a service on the same public IP+port at the same time. This is more of a problem than it sounds like; on big enterprise or university networks that choke down to a small number or even just one private IP, this basically kills on‐prem hosting without doing even more complicated shit. And sometimes, your ISP has put your external IP behind NAT too — which is called carrier‐grade NAT (CGNAT) — and now you don’t control the device doing the translation, so you can’t forward a port. You’re getting a fraction of a fraction of an IP address.

Also, another problem with NAT is that nobody wants to bother with it, which is why we invented:

UPnP

UPnP, and its modern cousins NAT‐PMP and PCP, tried to solve the “nobody wants to bother with it” problem by letting software ask the router directly to forward ports. Like manual port forwarding, it’s a request to your router — if your ISP is screwing with you, you’re out of luck. It’s also frequently disabled because of misguided security thinking — partially because of a couple buggy early implementations, and partially because the idea that someone could just connect to your computer feels exotic or even dangerous to a lot of people. There are plenty of valid reasons to want a firewall, but if you do, intentionally implement one instead of relying on NAT just not knowing where to send packets.

STUN, TURN, and ICE

STUN

Session Traversal Utilities for NAT (STUN), instead of trying to get cooperation from the firewall, simply asks a server on the public internet “what does my packet look like by the time it gets to you?” The STUN server hands back the public IP and port your NAT assigned, say, 146.7.15.85:60612. Under a “cone NAT”, where the router uses an identical external port mapping for all outbound connections, this works great. You can tell this mapping to a peer, and then they can send packets directly to you. This technique is known as hole punching. However, under a “symmetric NAT” — common on CGNAT and institutional networks — you get a different public port for every distinct destination. In this case, the STUN mapping is useless for connecting to a peer, since they'll see you differently than the STUN server..

TURN: giving up

Traversal Using Relays around NAT (TURN) is simply just passing traffic through a relay server, with both sides speaking to it outbound. This works mostly everywhere, but since someone has to run a server that should be unnecessary and you have to eat the added latency of every packet detouring through a third party, this really sucks.

ICE: trying everything

Interactive Connectivity Establishment (ICE) accepts that no technique is reliable and tries all of them in order of preference. Consider everything: direct connect, STUN‐discovered external address, a TURN relay), exchange the list with the other side, and throw shit at the wall until something works. This is what WebRTC does, and it’s the best you’ll get on today’s internet. But we’ve replaced a simple direct connection with, mostly, external infrastructure.

The long‐term solution that wasn’t

The principal “long-term solution” in the works that RFC 1631 was referring to was IPv6, and it was supposed to fix this; give everyone a real globally unique address and obviate NAT. However, the sigmoid function of IPv6 adoption seems to be stalling out too early, and even where it is implemented, many ISPs and institutional networks keep doing NATy stuff out of inertia and even more misguided security thinking: firewalls that refuse inbound because that’s we’re used to NAT doing that, or completely unnecessarily applying actual NAT to IPv6  — often deploying Unique Local Addresses (fc00::/7) the way they use private RFC1918 space on IPv4 — which is baffling to me.

The consequences for the Internet

There’s lots of things you can blame for killing the open Internet, but I think NAT was one of the earliest. Running a server used to be trivial: run an executable, tell people your address, done. Now, if you’re lucky, you probably have to configure port forwarding, which you often can’t even do if you’re behind CGNAT or on an institutional network.

It also trained everyone to think client‐server is natural. “My device talks to The Cloud which talks to other devices” feels normal, when that feeling originated as an artifact of address scarcity. The problem the people in the XKCD comic at the top are facing is the absurdity of trying to establish a one-to-one communication using only outbound connections on both sides. Even more ironic is that NAT got normalized as a security feature  — “your devices are hidden!” — which is one of the things that made people resist the thing that would fix it.

NAT certainly isn’t the only reason why the modern internet is full of centralized walled gardens, but it was the first — it’s why it’s hard to send a file to someone, it’s why you don’t run your email on your own computer, and why running your own services at all is difficult and often expensive (if you can’t port forward from your own internet connection, you have to buy a VPS instead of using hardware you already have).

4
 
 

I've been increasingly getting into the idea of hosting some servers for classic PC games like Counter Strike 1.6 and various Half-Life mods, but I'm curious what the consensus is for what the best options are for doing so right now.

I have some experience hosting servers at home in a "homelab" kind of context (mostly for stuff like Jellyfin, Samba, etc.), and I know how to spin up docker containers and administer a Linux computer decently for LAN use. Right now I use tailscale to access my homelab stuff remotely, but I don't know if that would work well in the context of hosting a public game server.

Generally I don't have much knowledge about safely exposing my local hardware to the wider internet for my circle of ~20 friends to join.

So basically I'm wondering what you all would do for hosting game servers if you were going to start today...

Would you use local hardware with port forwarding? Or would you go with a VPS (and if so, can you recommend one for North America)?

5
6
 
 

I currently use Borg for all my backups. To have a remote backup I placed my old Synology NAS at a family member and connected it to tailscale (via a tailscale docker container). That way I could also can do Borg backups to that remote NAS.

Though I have problems with the stability of the tailscale connection from the NAS. And honestly, I'm a bit tired to fix these problems.

I would like to have a self hosted backup solution, that can reach the synology NAS. I would like to avoid port forwarding at my family members network (for obvious reasons). I have a VPS in the internet that I can use for a common self hosted contact point (like I setup headscale there instead of using official Tailscale servers).

What would be your way for handling these remote backups?

7
 
 

So, just as the title says, I wanna know if anyone here uses a proxy as a way to access a private network instead of a VPN.

In my server i just use nginx to reverse proxy through different webapps, and now the time has arrived for nextcloud, now I'm thinking that I'd rather have such services more isolated from the wider web, and I like the simplicity of a proxy login. Though I am skeptical of the user/password model for proxying into a server. Afaik all proxy server logins work within that framework.

So, does anyone do this??

Edit: I know I can find a config wherever in the web, the post is more about experiences or thoughts about using a proxy instead of the common recommendation of a VPN. Thats all. :)

8
 
 

Hi, folks! I was happy to finally get my domain set up and directing traffic to a couple of hosted services. Unfortunately, my domain only works from external networks and not my own. I can ping my domain from my internal network just fine, and I can see a response time of 0.12ms against my public facing IP address, but putting the URL into my web browser to hit my web apps just times out. If I run the test on my phone, same thing; however, if I disconnect from wi-fi and do the same thing over cell network, the page works as I'd expect. My friends are able to access my hosted services via URL as I'd expect.

Given that I can ping the address and it resolves to an IP, I'm guessing this isn't a DNS issue. My OPNsense setup is that I've got my 192.168.1.X VLAN and my hosted services are isolated on the 192.168.10.X VLAN. The 1 VLAN can reach 10, but 10 can't reach 1. I can still use my hosted services via IP address and port, but I'd rather just use the URL and hit my reverse proxy so that I don't have to change the server address while navigating in and out of my apartment on my phone.

I've got two goals here in resolving this problem.

  1. I'd like to understand why it won't resolve my URL on my local network and fix it. This is mostly just a learning experience thing given goal #2.
  2. After that's working, I'd like to set up local DNS so that calls to reach my reverse proxy will never leave my home network, because I want to have access to my full bandwidth without running into my ISP's bandwidth limits. After this is setup, I'm curious how I would verify that my call to the server is not leaving my apartment.

I'd appreciate any help you folks can offer!

EDIT: I believe this is solved? @redlemace@lemmy.world correctly identified this as a NAT issue. The same solution appears to resolve goal #1 and #2 at the same time. This is the part where "solved" has a question mark after it. I basically just went to the traffic graph in OPNsense and compared it before and after streaming a video. The VLAN 10 traffic matched the LAN traffic, and the WAN traffic appears unmoved. Because my new NAT rules (which I picked up from redlemace's link to OPNsense documentation) are applying the port forwarding to the WAN, VL10, and LAN interfaces, I don't believe the traffic ever leaves my home network when the destination is my external IP address. Of course, if you have reason to believe I didn't actually solve my issue, feel free to quote some part of this paragraph and point it out to me. Always good to learn!

9
 
 

So I have a new desktop PC and my old desktop PC that was broken for some time, now revived and I want to make it a home server and selfhost various apps.

I'm running Debian Trixie and plan to run the same (but headless) on the server.

My old PC had a 1TB SATA SSD (one of the Samsung EVO models from around 2013/2014). It's an old drive and it's been in use probably for 8 years in total (initially as the system disk, then for local backup). The motherboard only has 1 m2 slot with PCIe x3.

My new PC has two 2TB nvmes, the high end Samsung 9100 PRO and Samsung 990 PRO. The first disk is my system disk so it stays. But the 990 currently is almost empty and used only for a local Restic backup. I over purchased, wasn't sure which one to keep and my return window passed so both stayed.

I also have an external 2TB SSD on USB 3.

Now I have a few scenarios in mind and I'm having trouble making a decision. I need a 3-2-1 backup solution on both machines.

I won't have too many services and won't have much traffic.

I can put the 1TB SATA SSD in the server, make it the system disk. Then have the 2TB USB SSD for local backup. Or backup over SFTP to my desktop's 990. The desktop PC stays as is with two nvme disks.

I can move the 990 PRO from my desktop PC to the server and make it the system disk. I'd use the SATA SSD in one computer and the USB SSD in the other one for local backup. My server won't utilize 990's speed because of PCIe x3 being the ceiling.

There are various combinations and I suffer from decision paralysis.

Re the backup, I currently do hourly local backups and daily cloud backups.

I'd rather not buy another disk due to how expensive they are.

I don't have that much data, I won't even use 1TB. I probably have less than 250GB counting all my documents, important files, ebooks, photos.

Any hints?

10
 
 

Hello folks!

I would like to share an update about BentoPDF. It's an open source privacy first PDF toolkit that runs in your browser.

1. You can now actually edit text inside PDFs

BentoPDF now allows you to click existing text, edit it, and have the text reflow while preserving the original fonts and styling.

It also includes:

  • Bold, italic, underline, strikethrough, superscript, subscript, font family/size, colours, outlines, character spacing and line spacing
  • Left, centre, right and justified alignment
  • Bulleted and numbered lists with indentation
  • RTL and LTR text alignment
  • Find and replace across the document
  • Edit images by rotating, flipping, duplicating, resizing or deleting them
  • Object alignment, distribution, rotation, flipping, duplication

Please note this is a work in progress. You may encounter bugs, which you can report and I will look into.

2. Hyper Compress

Hyper is an open source PDF compression engine built to solve specific problems.

  • Compression sometimes returns a file larger than the original. Hyper's result is always binary: it either produces a smaller PDF or returns the original. This helps create predictable workflows.
  • Hyper includes a true lossless mode. It preserves searchable text, document structure and PDF conformance, rather than rebuilding the document from scratch like Ghostscript.
  • It runs everywhere: CLI, Node SDK, C API, self hosted service, and WebAssembly build.

Repository and benchmarks: https://github.com/alam00000/bentopdf-hyper-compress

I also compared it to Adobe's compression API, but only managed around 100 PDFs where results were within 5%. Testing on a bigger corpus got expensive.

3. Kura

Kura is a PDF standards, conversion and preflight engine.

It supports:

  • All 11 PDF/A conformance levels: PDF/A-1a, PDF/A-1b, PDF/A-2a, PDF/A-2b, PDF/A-2u, PDF/A-3a, PDF/A-3b, PDF/A-3u, PDF/A-4, PDF/A-4e and PDF/A-4f
  • Accessibility: PDF/UA-1 and PDF/UA-2
  • Print production: PDF/X-1a, PDF/X-3, PDF/X-4, PDF/X-4p, PDF/X-5g, PDF/X-5n and PDF/X-5pg
  • Engineering and variable data printing: PDF/E-1 and PDF/VT
  • E-invoices: Factur-X, ZUGFeRD, XRechnung and Order-X
  • 396 bundled print-preflight profiles

It has been tested against several standards suites, including the veraPDF corpus, Isartor, BFO, Ghent Output Suite 5.0, the PDF/UA Reference Suite and Cal Poly's PDF/VT suite.

Across 30,677 PDF conversions it had zero crashes and zero timeouts, with a 0.05 second median conversion time.

Like Hyper, it ships as a CLI, C library, npm package, Docker image and WebAssembly build.

Repository and benchmarks: https://github.com/alam00000/bentopdf-kura

The release also contains other improvements and bug fixes: https://github.com/alam00000/bentopdf/releases/tag/v2.8.8

Thank you and have a great weekend!

11
 
 

Fathom is an all-in-one client for Jellyfin, on Linux, Windows, and Android (with experimental Android TV). It puts movies, shows, music, and Live TV in one window, with most of Jellyfin's server-side management built in, plus optional Seerr requests and a full YouTube client. Everything plays through mpv (via media_kit), so you get direct play, hardware decoding, and real subtitle and audio track control. Free and open source (AGPL-3.0), built by one person. This is my first update post since the v0.11.0 rundown, so here's what's new across v0.11.1 and v0.12.0.

Feedback is very welcome: bug reports and feature requests on GitHub Issues, questions in Discussions.

Downloads

Downloads is now a full offline library instead of a flat list: separate Movies, TV Shows, Recordings, and Music sections, with the same poster covers and rating badges as the regular library.

A downloaded title opens the same detail page as its library page (backdrop, cast, ratings, overview), scoped to what's downloaded: only the episodes you have, with local-only play, mark watched, and remove that never touch the server.

Download a whole series or season in one go, picking a scope, plus a download option on every episode's own menu.

Download music too, a single track or a whole album or artist, and it plays in the music player with the familiar album view, fully offline.

Live TV recordings can be downloaded as well, and can be found in their own Recordings section.

YouTube

Fixed playback being blocked entirely by YouTube's "confirm you're not a bot" gate.

Fixed multi-language videos defaulting to a dubbed audio track instead of the original.

Shuffle and repeat for background audio, plus skip back to the previous track.

Live streams start in a couple of seconds instead of tens of seconds.

Account and updates

Change your own password from the Profile screen (current, new, confirm). Leaving the new password blank removes it, the same option the official Jellyfin clients offer.

Update checks now have a frequency setting: on or off, plus Every Launch, Daily, or Weekly.

A new build is announced with a floating banner and a native system notification on Linux and Android.

Also since v0.11.0

Tapping an episode row opens its page; the thumbnail or play icon plays it directly.

Background audio no longer freezes on an unplayable track, and recovers from brief network drops.

Saved radio stations are no longer left out of settings backups.

Importing YouTube subscriptions on Android no longer greys out cloud-storage files.

Settings and your Jellyfin login now persist on minimal Linux desktops where the system keyring starts cold, such as Hyprland.

In-app updates on Android work again; a build-numbering issue was rejecting newer builds as a downgrade.

A Nix flake for Linux, so you can build and run Fathom with nix build / nix run.

Platforms: Linux and Windows (self-contained downloads) and Android (APK; Android TV experimental). macOS and iOS still need Mac hardware I don't have yet.

Links

Repo: https://github.com/Fathom-Media/fathom

Latest release: https://github.com/Fathom-Media/fathom/releases/latest

Bugs and feature requests: https://github.com/Fathom-Media/fathom/issues

Docs: https://fathom-media.github.io/fathom

AI Disclosure

Per Rule 7 / [AIP] disclosure requirements, AI was used during development as a coding assistant. Level per category:

  • Design (architecture, system design): Hint — I make the architectural calls; AI suggests trade-offs and edge cases I might have missed.
  • Implementation (production code): Pair — roughly 50/50. AI drafts, I review, adjust, test on real hardware, and only commit what I've verified. Every commit is manually reviewed before it goes to my dev repo.
  • Testing (writing tests, test plans, QA): Assisted — real-device testing is manual (I test on my own PC and mobile devices before every release). AI helps draft test plans and think through edge cases.
  • Documentation (docs, comments, README, CHANGELOG): Pair — release notes and changelog entries are drafted with AI then edited for tone; comments and code docs are mostly Pair as well.
  • Review (code review, PR feedback): Assisted — I'm the reviewer; AI helps with security sweeps, audit passes on complex changes, and consistency checks.
  • Deployment (CI/CD, release pipeline): Hint — GitHub Actions and the release pipeline are largely conventional; AI-suggested improvements only.
12
 
 

I'm interested to hear what do people use as their cloud backup and the cost of it. I currently use idrive e2 storage at 5$ per TB a month. Trying to see if there is any better deal anywhere and just curious on everyone's thoughts.

13
 
 

This seems like what I wanted on my first rpi over a decade ago.

Install, add ~15000 games from archive.org romsets, maybe a few bios files.

Shit just works.

~1970-2000, done

14
15
submitted 1 day ago* (last edited 1 day ago) by to c/selfhosted@lemmy.world
 
 

Rasputin app catalog released today and, with it, Rasputin is moving from pre-alpha to alpha. Sixteen apps, each installed and opened on real Raspberry Pi and amd64 hardware.

(edit) ai-disclosure added since I forgot initially: https://github.com/geekdojo/rasputin-os/blob/main/AI_DISCLOSURE.md

16
 
 

Hi,

I finally got around to migrate PdfDing from github to Codeberg. Hopefully, I will see some of you over there.

PdfDing is a PDF manager, viewer and editor that you can host yourself. It offers a seamless user experience on multiple devices. It's designed be to be minimal, fast, and easy to set up using Docker.

17
Why homelab? (aussie.zone)
submitted 4 days ago* (last edited 4 days ago) by to c/selfhosted@lemmy.world
 
 

I was reading a homelab discussion about NUTs (Network UPS Tools) that left me scratching my head and wondering "...why? Is complexity for complexities sake part of homelabs? Isn't this a huge overkill for one machine? Just...use a UPS? "

Then I got to thinking more broadly about homelabbing and I started to wonder if there weren't maybe (at least) two different schools of thought.

Using home media as example -

  • Store the original.
  • Detect the client.
  • Transcode when required.
  • Monitor the GPU.
  • Add reverse proxy et al
  • Track bandwidth.
  • Add user accounts
  • Add failover.
  • Graph the result.
  • Dashboard.

Vs

  • Store a common compatible file for your devices.
  • Play it directly.

Which school of thought are you and why?

PS: not throwing shade. I get it; for some people, complexity, learning infrastructure, practicing skills for work etc is part of the why. For me, complexity as recreation is suspiciously like work after work.

Perhaps there's an odd Venn diagram between homelabbing, interest in ownership / useful capability and infrastructure that could make for a fun discussion. For you, is homelabbing a means to an end or is it an end in itself?

EDIT: Feel free to consider "home-lab" and "self hosted" as synonyms for the purpose of this discussion (although I am aware they are somewhat different in scope).

18
 
 

I'm looking to buy some security cameras for my mother in law. I currently have a small server with plenty of storage at my place that I'd prefer to use on at least a temporary basis to keep costs down. Are there any self hostable cameras that support a built in VPN? I currently use tailscale for my network but I'm open to learning something else. Alternatively, can they run over a tailscale subnet router? I don't use that yet but if I could place a cheap node in her place to help her access footage and my other services via subnet routing I'll do that too.

19
 
 

2.5 years ago, I migrated all my services hosted on a cloud provider to a homeserver.

This homeserver is also my workstation/gaming/dev/everything. I use QubesOS (an operating system based on the Xen hypervisor), and wrote some document about it: https://neowutran.ovh/qubes/articles/homeserver.pdf

Basically, I am hosting:

  • DNS
  • Matrix
  • Email
  • Jitsi
  • Mumble
  • Peertube
  • Screego
  • Nextcloud
  • Searxng
  • Tor
  • Wireguard VPN
  • Copy of wikipedia
  • Personal website And others.

And for TLS, to have better security, and to avoid relying on third party company/providers, I am using DANE.

https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities

https://sr.ht/~yukikoo/dane_without_root/

https://github.com/buffrr/letsdane

The "dane_without_root" is one of my projects and I am welcoming review / feedback on it

( I also posted about it on the QubesOS forum: https://forum.qubes-os.org/t/highlighting-neowutrans-technical-doc-about-qubes )

20
 
 

Pic is how I feel acquiring more software to replace my Big Tech dependency.

(Not all services could be listed here, obviously. Just the ones I personally use)

21
 
 

nitter.net is currently replaced with a message about the C&D until zedeus (lead dev) gets legal advice on how to proceed. Other instances are probably ok for now (or at least until an API break). Not a great sign for anyone else who hosts it, but hopefully it gets resolved without development permanently stopping.

22
submitted 5 days ago by to c/selfhosted@lemmy.world
 
 

Has anyone here had much success with automated book downloads and a self-hosted library? I've been pulling my hair out trying to get shelfmark and calibre-web automated to work for me.

I'm trying to use them for engineering textbooks which I realise is not the intended use-case, so any more appropriate suggestions would be appreciated. I want something that handles creating a searchable text layer on top on the book so I can search the textbooks more easily.

ShelfMark is having the following issues:

  • not connecting to annas-archive.is. I can reach it from my browser
  • the sources I want aren't covered by the indexers via prowlarr

CWA is struggling to ingest my engineering textbooks at all. I've just increased the time-out so hopefully that helps.

edit: increasing the CWA timeout setting let it get through the textbooks. shelfmark is my only problem now, assuming adding a text layer with stirling-pdf goes well 🤞

edit 2: shelfmark is now working (thanks to TheFerventLion below)! OCR in stirling-pdf is the last step

23
submitted 5 days ago* (last edited 5 days ago) by to c/selfhosted@lemmy.world
 
 

Edit: forgot to mention that I'm based in Europe, which might be relevant for which devices are easily available.

Hi, I am a newbie looking for a new router, one where I can block ads and tracking (with AdGuard, PiHole or something similar), I can choose my own DNS, and hopefully tinker more once I learn more about routers and networks. I have a home server currently running only locally and would like to access it from outside my home, but I'm afraid of letting the door open to bots, hackers, etc.
I am currently using the router provided by my ISP, which has poor customization options and is also failing a lot lately (it loses internet connection at least once a week and needs restarting).

I have searched a bit around and I think something where I can install OpenWRT or other open source firmware would be good. On the OpenWRT forum I have seen recommended the GL·INet Flint 2 GL-MT6000 https://openwrt.org/toh/gl.inet/gl-mt6000. I also looked a bit more on GL·INet's website and saw the GL·INet 3e (GL-BE6500) which has WiFi 7, and wondered if that could be a good upgrade, but seems it doesn't support (yet) installing official OpenWRT.

As for me and my use case: I am comfortable with the Linux command line, my personal computer runs Linux and I have a home server running OpenMediaVault with a couple of services on Docker (Jellyfin, Navidrome, Radicale, Trilium, Calibre-Web, Wanderer), but I barely know anything about routers and networks. The router will serve to connect that server via Ethernet and use several devices (laptops, desktop PC, phones, tablets, AndroidTV...) via WiFi.

I wonder what the thoughts of people who know about routers and networks are.

  • Are these good options for a first non-ISP router?
  • Is the 3e (GL-BE6500) worth the update for WiFi 7 or is it overkill for my use-case? Maybe even a bad idea if it doesn't support the official OpenWRT?
  • Anything else I missed and should take into account?

In addition to the physical router recommendation, I have 2 more questions:

  • from what I have read in other threads I believe I might need to keep my ISP's router, or get another device to use as a modem before the router (I don't know how to do that). Is that correct or can I just replace my ISP's router with a router running OpenWRT (or similar) and be set?

  • does anyone have any good resources to learn more about networks, modems, routers, etc.? for a newbie who is comfortable with the Linux command line but otherwise knows nothing about the topic.

24
 
 

Traefik v3.7.12 deprecates the previously introduced underscoreHeadersStrategy entrypoint option and introduces a new one called aliasHeadersStrategy that rejects even more potentially spoofed headers - not just with underscores.

Reminder to adjust your Traefik config.

Add an entry point option to handle request headers with aliasing names by rtribotte · Pull Request #13720 · traefik/traefik

25
submitted 6 days ago* (last edited 6 days ago) by to c/selfhosted@lemmy.world
 
 

If it helps others this was my config. To be honest I have a weak grasp of what it actually does so there might be some security issues with it.

Apparently you can also add lemmy as a search engine. Will work on that later.

config

# docker-compose.yml
name: searxng

services:
  core:
    container_name: searxng-core
    image: docker.io/searxng/searxng:latest
    restart: always
    network_mode: "service:gluetun"
    volumes:
      - ./core-config:/etc/searxng
      - core-data:/var/cache/searxng

  gluetun:
    image: qmcgaw/gluetun:v3.41.3
    container_name: gluetun
    cap_add:
      - NET_ADMIN
    environment:
      - VPN_SERVICE_PROVIDER=custom
      - VPN_TYPE=openvpn
      - OPENVPN_CUSTOM_CONFIG=/gluetun/custom.conf
    ports:
      - 8080:8080
    restart: always
    volumes:
      - ./gluetun:/gluetun
    devices:
      - /dev/net/tun:/dev/net/tun

  nginx:
    container_name: nginx
    image: nginx:latest
    ports:
      - 80:80
      - 443:443
    volumes:
      - ./nginx:/etc/nginx/conf.d
      - ./cert:/etc/nginx/cert

  valkey:
    container_name: searxng-valkey
    image: docker.io/valkey/valkey:9-alpine
    command: valkey-server --save 30 1 --loglevel warning
    restart: always
    volumes:
      - valkey-data:/data/

volumes:
  core-data:
  valkey-data:

# nginx/default.conf
server {
  server_name localhost;
  listen 443 ssl;

  ssl_certificate /etc/nginx/cert/cert.pem;
  ssl_certificate_key /etc/nginx/cert/private.key;

  location / {
    proxy_pass http://gluetun:8080/;

    proxy_set_header   Host             $host;
    proxy_set_header   Connection       $http_connection;

    proxy_set_header   X-Forwarded-Proto $scheme;
    proxy_set_header   X-Real-IP        $remote_addr;
    proxy_set_header   X-Forwarded-For  $proxy_add_x_forwarded_for;
  }
}

server {
  server_name localhost;
  listen 80;
  location / {
    return 301 https://$host$request_uri;
  }
}

view more: next ›