Thanks for this post, something I miss from earlier selfhosting communities.

I have simply running two SFF Lenovo Thinkcentres—one for all local services and another for all online services. They could run on one but I keep them separate for security and stability reasons. I often crash the local one by running out of space…

I finally got to building a second backup recently which I am happy about.

Honestly, since moving and downsizing from several services at home and at work, this solution works. I run out of space frequently but it forces me to not hoard things I will not actually use. My previous rack server seeded something like 50tb as I kept everything I leached to benefit the community, now less possible.

This has also made me move away from services that are not needed.

• [ ] I would like to offload all my home videos to an external drive as I am running out of space for actual services and Jellyfin media.

• [ ] I would like to consolidate all of my local and online databases rather than run a new one for each container stack.

The only PHP vuln I had was from parts-db which I deployed recently to check it out. Haven’t set it up yet seems like a lot of work. I keep a running record of my electronics parts in obsidian hoping maybe I can bulk add em or something.

Added no-new-privileges to all my outward facing containers :P

Feeling better every day having my stuff under my control and away from prying eyes of trackers and other unsavory stuff.

This week, I’ve mainly been handling the fallout from the PHP vulnerability that occurred in late October. Following that incident, I made a few changes: I’ve opened only the necessary ports to the outside world, and the admin panel is now accessible only via VPN. I’ve created an inventory list for each server, clearly detailing which services are running and their versions, so that the next time a CVE is released, I’ll know immediately which servers are affected. In addition to running daily automatic backups, I periodically restore them to a clean machine to verify they work.

Remember: Always treat your servers as if they might be lost tomorrow, and make sure to have a thorough recovery plan in place.

Just completed my set of needed services by adding nextcloud to the list. Now life is good. Jellyfin: check. Navidrome: check. Pihole: check. Invidious: check. Nextcloud: check. What else? lol

I got new rack gear. I don’t 3d print so I ordered metal face plates for my 10 inch rack. got them here https://www.rackmountplates.com/

I am not affiliated. just a happy customer that stumbled on a solution to a problem. Sharing in case others have similar needs

After the recent plex player debacle I’m once again trying to come up with a way for me and my diaspora to share media using Jellyfin, but without relying on Tailscale. We have several media libraries, and some of the library hosters are not too tech savvy, so coming up with a solution to replace the ease-of-use of plex hasn’t been easy.

Upgrading one of my powerhouse Dell R410 proxmox nodes to 128GB of smoking hot PC10500 DDR3 ECC Ram from 64.

Now it’s cutting edge.

Last week I had to update everything to make sure that it didn’t fall back on DST because the fucking idjits in my backwoods province decided that they needed to create a new time zone.

OMG patching all the vulns. I actually pulled my wordpress offline overnight for that one. Still waiting on the Ubuntu patch for that IPv4 kernel CVE.

That reminds me - It’s time to do No NAT November again. This CVE gives me an excuse. Last year, the Nintendo Switch Switch and Steam were the big standouts. I think the Switch 2 will actually work with it now.

Oh, and my workplace is shifting offices, so my offsite backup is not offsite. Must take care to not burn the place down. I just put new fans in my PoE switch and now I can hear a server fan is dying too. There’s a lot of maintenance work to all this.

I recently got around to setting up OIDC for my internal apps using Pocket ID.

Sonarr v5 adds OIDC support, currently only in beta

Jellyfin SSO plugin

Nextcloud with the Nextcloud OIDC app

Mealie, Paperless, and Immich natively support OIDC

Calibre-Web I migrated to AutoCaliWeb, which supports generic OIDC

Sadly Navidrome doesn’t natively support OIDC and forward auth is a bit jank due to the subsonic API

i have an asustor nas and i set it up with my hdd raid 1 drives as volume1, and installed my ssd later as volume2. now docker is constantly making my hdds tick and I can’t move it to the SSD because asustor don’t allow it ☠️ so I’m looking at reeeeaaallly testing my backups, wiping the device and reinstalling everything. It’s all in docker so it’s theoretically easy enough 🤞

My automatic weekly backup ran for the first time last night. Everything worked nicely.

I’ve been a Joplin user and using their Joplin Sync server for a few years now. Last night, I migrated everything over to Obisdian and just finished setting up a self hosted obsidian sync. I will say that the self hosted sync was nothing short of a puzzle for me but finally nailed that down between my phone and desktop app. So, I have the same as Joplin now for that functionality.

What got me started on this little side journey, is I’ve been seeing more and more pretty cool uses for Obsidian and have a lot of great things about it. I’m not dumping Joplin yet, but am giving this a solid try before I make any hasty decisions.

Finally took the leap and wiped my NUC to start doing things over. Originally had a family member who works in IT set everything up, but he did the absolute bare minimum and I screwed some stuff up along the way the first time around, so I figured now was as good at time as any to teach myself to set things up from scratch!

I also have moved from Portainer, to Dokploy, to Arcane for docker management, and I actually really like Arcane. I’ve also accomplished something I’m really damn proud of, which is getting HTTPS working on Tailscale (so, for example, arcane.(my subdomain).ts.net but with HTTPS!) alongside Pocket ID for all of it. Maybe it’s just me, but I had trouble finding clear documentation on how to do this, no matter how much I searched. But I documented it for myself, at least. And it’s probably that I lack a lot of knowledge in this field, too.

I have some questions, and although I know there’s a chance this gets buried, I figured I’d try asking anyway. Little skittish about making a thread myself.

My NUC is running Debian 13, and I was wondering some security things. Everything is behind Tailscale and I don’t plan on exposing anything to the internet (even through Tailscale Funnel, I’m using Tailscale Serve for the HTTPS.)

• How valuable is a firewall in this case? I’ve never used one, and I’m wondering if it’ll just make adding services more of a hassle than it’s worth for the security since everything is staying local.
• Similarly, what about Fail2Ban? I have it on my RPi and it’s not a big deal to set up, but I was reading a firewall is more important?
• Is it okay to run unattended updates for security OS stuff on the NUC? I don’t always check updates, admittedly I’m easily distracted and forgetful. I’m a little worried about auto restarting it to finish the updates up just because I utilize a NAS and sometimes it’s annoying to get them to reconnect to each other (even with the fstab edited) when there’s a restart for either of them.
• Thoughts on auto updates on docker containers? I know this is pretty personal preference, but I mostly ask because I’m forgetful and distractable. I know this is kinda my own problem, but I want to know other people’s thoughts if possible.

Thank you for reading my very long update! And any answers to my questions are very appreciated. Hope everyone else is doing well!