Most of these backup solutions try to reduce the amount of data backed up, so the system will process each file and determine if the contents changed and only upload new data. In this case if you modify the file you may end up with 2 16 MB chunks that have slightly different data, and only when the old backup expires and the pruning process completes would one of those chunks be deleted.

Smaller chunks sizes means you get more files written to S3, but less duplicate data when deduping without compression.

If I had to guess, the container station might be giving the docker container a new network/ip address, one that the NAS is not using so that port 443 works and doesn’t conflict with the NAS. If you start the container station then inspect the container you might see how they do it, but macvlan is typically how you would configure it.

services:
  my-lan-service:
    image: nginx:latest
    container_name: lan_container
    # 1. Attach the service to the custom macvlan network
    networks:
      lan_network:
        ipv4_address: 192.168.1.200  # The dedicated LAN IP for this container
    # 2. Ports are exposed directly to the LAN; do NOT use the "ports" block
    restart: unless-stopped

networks:
  lan_network:
    driver: macvlan
    driver_opts:
      parent: eth0                  # Change to your host's physical network interface name
    ipam:
      config:
        - subnet: 192.168.1.0/24    # Matches your physical local network setup
          gateway: 192.168.1.1      # Your physical router IP

They finally added the last bit of data to this Session store that broke the whole application. 16MB of data being read/written from store on every http request. 50% of all http request processing was handling the Session middleware.

I hate developers who don’t spend the very minimum to understand the environment they work in.

When connected to your internal network, what is the results of:

nslookup sub.domain.tld AGH.IP.Address

This should respond authoritative with the IP you need to access NPM’s VIP IP address. If that is not the case, let us see your AGH configuration for your sub.domain.tld.

If that does return the correct IP, verify that it responds to https using curl on Linux or windows (replace curl with curl.exe)

curl -vvvI https://sub.domain.tld/

If this is not connecting or showing a cert error then there’s a misconfiguration on the NPM side. Screenshots of your site configuration for one of the sites would be helpful. The domain name should match sub.domain.tld (not your duckdns) and be bound to the let’s encrypt cert.

Instead of a default gateway you can configure just your VPN IP address to go to your gateway. You might also need DNS servers depending on your setup.

Example: ip route add 1.1.1.1/32 via 192.168.1.1 dev eth0

Note that without a script this may be flaky if you’re using DNS to resolve the VPN. It might be better to have a script that resolves the IP(s) of the VPN and then adds routes.

That being said, your VPN software is usually designed to install routes that have higher priority so that they will get used before the local network. One such way is by adding half-internet routes (0.0.0.0/1 and 128.0.0.0/1) which get preferred over the larger default route. If you run ip route once connected you may see those routes present.

While I’m not sure if it works in rootless, take a look at binhex/arch-delugevpn project which has scripts to set up a similar network isolation environment.

One thing not mentioned is that modern password hashing algorithms will iterate your password hundred of thousand of times. This makes cracking the hash much more time intensive. For example if 1 hash takes 1ms (most hash algorithms are way quicker), then 1000 iterations of that means it will take 1 second to compute your hash from the input. The server has to spend that time to validate your password when you login, but that’s a small tradeoff to make brute force attempts which will now have to calculate 1000x hashes for each input.

We updated to the NIST recommendation of 600000 iterations a few years ago when it was released, with regular increases every year. Logins take upwards of 5 seconds but it’s added security in the event the data is leaked.

I think NetworkChuck has a good set of tutorial videos about self hosting. For the most part you can search for what you want to find info on and he probably had a video on it. E.g. Nginx: https://m.youtube.com/@NetworkChuck/search?query=Nginx