[–] 1 point 1 hour ago*

My "script" to update the blocklist from time to time was literally

curl <blocklist1 link> > templist
curl <blocklist2 link> >> templist
grep '^0\.0\.0\.0' templist | awk '{print "local-zone: \""$2"\" always_refuse"} > blocklist.conf
systemctl restart unbound.service

and an include blocklist.conf at the bottom of unbound.conf (awk to convert it from the "0.0.0.0 " format to "local-zone: always_refuse").

  • source
  • parent
  • context
  • [–] 1 point 2 hours ago* (last edited 1 hour ago)

    It literally is a cron job or systemd timer to load an updated blocklist from time to time and I haven't looked at it for years (well... other an changing a path when I switched from unbound to dnsproxy, because that one is even simpler, doesn't even need a config other than a few parameters at startup and can provide DoH, DoT and/or DoQ access for when I'm not at home)

  • source
  • parent
  • context
  • [–] 30 points 5 hours ago* (1 child)

    Merz-Forderung nach Abbruch kommt zu spät

    Merz hat keine Forderungen zu den Koalitionsentscheidungen anderer Parteien, schon gar nicht auf Landesebenen, zu stellen, und daher ist deren Timing völlig egal.

  • source
  • [–] 5 points 5 hours ago

    Er macht doch seinen Job, und kämpft fleißig gegen die Demokratie und für mehr neoliberalen Kahlschlag und mehr Geld für seine reichen Kumpels...

    Oh, Moment... dachtest du etwa er arbeitet für Deutschland oder gar für dich?

  • source
  • parent
  • context
  • [–] 5 points 5 hours ago

    Das mag so stimmen, aber repräsentieren die in deinen Augen den typischen Ton des ÖRR?

    Wenn man die eher linken Teile des Programms gegen rechte ersetzt und die die rechten beibehält, bewegt man sich als Ganzes eben aus der Mitte weg nach rechts.

  • source
  • parent
  • context
  • [–] 1 point 7 hours ago*

    If you just want simple ad blocking you don't actually need pi hole for it's web interface you don't ever look at once it runs. Unbound alone can do the job with minimal configuration.

    Nowadays I even changed my setup to dnsproxy, which doesn't even need any config. It's just a handful parameters when you start it. And it does all the filtering for my home network as well as providing DoH access for when I'm not at home and connected from somewhere else.

  • source
  • parent
  • context
  • [–] 2 points 7 hours ago (4 children)

    I never understood pihole in the first place. It's just a fancy web interface you do never look at if the thing does its job quietly in the background. And unbound alone is perfectly able to use blocklists with one line of configuration (and an onliner script to convert the common lists into the right format).

  • source
  • parent
  • context
  • [–] 10 points 7 hours ago (2 children)

    That's generally good advice but not actually security related.

    Removing all the stress on your ressources by using a non-standard port is good for your ressources, But those automated scanners looking for unsecured devices and trying out password like admin/admin are not actually a risk. It's just a case of security by obscurity and never actually serves its purpose.

  • source
  • parent
  • context
  • [–] 10 points 7 hours ago*

    Als jemand, der sein Leben lang abwechselnd Sätze wie "Du must aber doch mal was Essen!", "Ist das alles?" und "Wie kannst du um diese Zeit Hunger haben?", "Du willst wirklich noch mehr?" hören muss, kann ich dir mit Bestimmtheit sagen, dass Essen nach persönlichem Hunger offenbar nicht mit den gesellschaftlichen Normen vereinbar ist.

  • source
  • parent
  • context
  •  

    As this will -thanks to me being quite clueless- be a very open question I will start with the setup:

    One nginx server on an old Raspi getting ports 80 and 443 routed from the access point and serving several pages as well as some reverse proxies for other sevices.

    So a (very simplified) nginx server-block that looks like this:

    # serve stuff internally (without a hostname) via http
    server {
    	listen 80 default_server;
    	http2 on;
    	server_name _; 
    	location / {
    		proxy_pass http://localhost:5555/;
                    \# that's where all actual stuff is located
    	}
    }
    # reroute http traffic with hostname to https
    server {
    	listen 80;
    	http2 on;
    	server_name server_a.bla;
    	location / {
    		return 301 https://$host$request_uri;
    	}
    }
    server {
    	listen 443 ssl default_server;
    	http2 on;
    	server_name server_a.bla;
       	ssl_certificate     A_fullchain.pem;
        	ssl_certificate_key A_privkey.pem;
    	location / {
    		proxy_pass http://localhost:5555/;
    	}
    }
    #actual content here...
    server {
    	listen 5555;
    	http2 on;
        	root /srv/http;
    	location / {
            	index index.html;
       	} 
        	location = /page1 {
    		return 301 page1.html;
    	}
        	location = /page2 {
    		return 301 page2.html;
    	}
            #reverse proxy for an example webdav server 
    	location /dav/ {
    		proxy_pass        http://localhost:6666/;
    	}
    }
    

    Which works well.

    And intuitively it looked like putting Anubis into the chain should be simple. Just point the proxy_pass (and the required headers) in the "port 443"-section to Anubis and set it to pass along to localhost:5555 again.

    Which really worked just as expected... but only for server_a.bla, server_a.bla/page1 or server_a.bla/page2.

    server_a.bla/dav just hangs and hangs, to then time out, seemingly trying to open server_a.bla:6666/dav.

    So long story short...

    How does proxy_pass actually work that the first setup works, yet the second breaks? How does a call for localhost:6666 (already behind earlier proxy passes in both cases) somehow end up querying the hostname instead?

    And what do I need to configure -or what information/header do I need to pass on- to keep the internal communication intact?

    view more: next ›