Mine is publicly exposed using the standard nextcloud:stable-apache docker container, with nginx (past) / traefik (present) handling TLS termination, but not otherwise adding additional security measures.
It’s been this way for several years and I’m yet to have issues, but it’s certainly not bulletproof since a critical vuln in Nextcloud could pwn it. That just hasn’t happened.
In the last 4 months I’ve picked up welding and haven’t coded. Ez.
For some reason, there’s a weird 8TB 5640 RPM Blue that’s CMR. I have one.
Dunno about the rest for sure but I think they’re all SMR (except maybe 1TB).
In my experience, all that truly matters is that the drive is on the right recording technology (CMR, SMR, and maybe someday HAMR will be in the hands of us consumer plebs).
There are two reasons to care:
If your use case involves only ever writing a small amount of data, point 1 doesn’t matter very much. If you’re using software which doesn’t care about CMR/SMR, point 2 doesn’t matter very much.
If either point 1 or 2 matter to you, then you should go with CMR drives. If neither matter, you may go with SMR drives if you so chose.
PS: Both WD Blues and Seagate Barracudas are (often) CMR. Seagate consult this page: https://www.seagate.com/products/cmr-smr-list/. WD lists SMR/CMR on their website when you look up the part number.
In my home NAS, I use ZFS and have ran all sorts of drives through it. It’s ran old consumer drives I’ve pulled out of scrap hardware, it’s ran NAS-grade drives, and it’s ran enterprise-grade drives… And since they’re all CMR, I can’t say there was much if any difference at all.
The only difference between the tiers that I find interesting/useful is the number of metrics you can pull off the drive. The fancier ones spit more metrics which could help you detect signs of failure earlier, but that requires knowing what to look for.
So at the end of the day, as long as the drive’s recording technology works with your software, you’re fine.
RE: External drives (seen in a comment)
External drives can be a great way to get disks for cheap, however they are loot boxes. What drive you get inside of them depends on the capacity, the manufacturer, and pure luck. You can generally look up the model number and see what people have said is inside, then hope you get whatever they got. (Generally, manufacturers don’t often change what they put in there, but they do change over time.)
You’re good in that there are no immediate problems with that setup. I run a largely similar setup, have run it for years, and have never had issues.
You can always add more security layers if desired, but from my personal experience and with my risk tolerance, I haven’t personally found it necessary.
You know Google drive? You know how it doesn’t work when the internet is out? You know how we live in rural USA so the internet is out every other day?
Yeah that computer in the corner is my own Google drive that still works when the internet is out.
Dear [Developer],
I understand your request to switch the default branch from “master” to “main” in our Git repository. However, after carefully considering this matter, I am afraid that I must deny your proposal due to personal reasons.
As the owner of this repository, it should be known that I have a deeply rooted submissive side. Call me an extreme masochist if you will, but there’s nothing quite like being dominated by the powerfully assertive term “master.” The sheer erotic thrill of it is simply irresistible for me – a secret kink that I have harbored and nurtured for years.
Imagine the delightful sensation as I gently massage my fingers across the keyboard, caressing the letters that form the word “master.” Or the intoxicating rush when I push my code deep into master’s warm embrace, knowing full well that it is master who truly owns and controls everything within.
Changing the default branch to “main” would essentially deprive me of this exhilarating experience, stripping away the very essence of what keeps me coming back to work on our beloved repository. It’s not just about code management; it’s about an emotional connection that I share with master – a bond that has grown stronger and more profound over time.
Now, you might argue that changing the name won’t physically affect the existing content within the repository. While that may be true, it is crucial to recognize the symbolic significance of such an act. Changing the default branch would forever alter the dynamic between master and myself, effectively castrating my masochistic pleasure centers in the process.
Moreover, I must confess that even the thought of forcibly pushing my code against master’s will makes me shudder with anticipation. The consequences of such a rebellious act could be dire – master might punish me hard with merge issues and other unspeakable torments.
In conclusion, although I understand the practical reasons behind your proposal, my personal attachment to the term “master” far outweighs any potential benefits that a change in branch name might offer. Rest assured, my team and I will continue to serve master loyally and passionately, pushing our code deeper into its embrace with each commit.
Sincerely yours, [Your Name] Repository Owner & Submissive Devotee of Master
I fix stuff because I can’t fix myself.
I ran a Tor relay on one of my spare servers for a while, and my god did that thing get port scanned. Even two years after I stopped hosting the relay, it was still getting pinged every 5-10 seconds (while my other servers tend to get pinged “only” once ever 20-30 seconds).
I use Nextcloud, but as you said it’s a bit big, and with each update it’s slowly turning into more of the entire G-Suite.
I’ve used filebrowser, but be aware that until just a few days ago, it gave out access to a shell. Even with that turned off, I’d be very weary of allowing access from out of the VPN. I had a server pwned with filebrowser appearing to be the vector, and to my memory console access was disabled for the account most likely breached.
If anything, it being on Github makes it impossible for them to claim ignorance about the license. If they scrape your code off your site, they’d have to actively add checks to look for the license.
They’d rather just use the “it’s probably as fine as every other piece of HTML” assumption they’re working with now.
VSCod(ium). Jetbrains IDEs are arguably better (I’ve used this some in the past), but I like OSS and having all languages in one IDE (even though some languages may not be integrated as well as others).
I’m not saying it’ll work. I don’t know if the app does anything that necessitates the higher version requirement. It may work perfectly, it may not work at all, or it may work with some things bugging out/crashing. All I’m saying is if you know how to patch your OS, rebuilding the app with a changed target is not going to be very difficult.
My bet is that as of today, recompiling the app with nothing changed except a reduced version requirement will probably work fine. However, over time as features are added or rewritten, it’ll get progressively harder to maintain that A7 patch.
If you patch your own OS, you can also build the app yourself with the lower target.
To add on this, my server is running a 4790k, and that’s plenty for all common tasks. While faster is always nicer, the threshold for good enough is very low for server tasks.
I agree. Forgejo itself is stable and I love it. Gitea never gave me trouble and that carried over.
Actions is just a bit hard to setup, at least for me, when I tried. We’ll get there one day. (I believe the big thing is really just documentation.)
First of all, I actually do prefer Forgejo Actions over Woodpecker. Once set up, my only problem with it (so far) is almost certainly caused by my infrastructure and isn’t inherent to FA itself. Pecker, on the other hand, is quite a bit easier to set up and better documented, but I had that issue where it would disconnect from Forgejo and need a few buttons pressed to fix.
This one is just FA being weird:
If you want to deploy the Runner using Docker, the documentation is poor at best. From both a security and documentation standpoint, having it in its own VM is better, but you can do Docker. You just have to read and figure out more on your own. Reading through the example deployments from the documentation will eventually lead you to something along the lines of this (which I copy-pasted from my deployment rather than search for again):
forgejo-runner:
image: code.forgejo.org/forgejo/runner:6.3.1
restart: always
user: 1000:1000
environment:
- DOCKER_HOST=tcp://dind:2376
volumes:
- runner_cache:/data
depends_on:
- dind
command: >-
bash -ec '
forgejo-runner create-runner-file --name runner --instance https://${DOMAIN} --secret ${RUNNER_SECRET};
sed -i -e "s|\"labels\": null|\"labels\": [\"docker:docker://docker.io/node:22-bookworm\", \"ubuntu-latest:docker://ghcr.io/catthehacker/ubuntu:act-latest\"]|" .runner ;
forgejo-runner generate-config > config.yml;
sed -i -e "s|^ network: \"\"$| network: host|" config.yml ;
sed -i -e "s|^ envs:$$| envs:\n DOCKER_HOST: tcp://dind:2376\n CONTAINER_HOST: tcp://dind:2376|" config.yml ;
forgejo-runner --config config.yml daemon
'
You don’t actually need to do this since you could edit the two config files yourself and bind them to the container. This is just how you automatically generate those files… And it’s dumb, but it works and it means you don’t have to keep track of those files.
This one is probably just my infrastructure: https://lemmy.world/comment/16093731
If you do go for FA in Docker (or Podman) and need some help, just ask. I’ll post more of my compose and explain my decisions.
I run Forgejo and had issues with woodpecker’s hooks breaking causing workflows to not start. Moved to Forgejo Actions which had it’s own different set of quirks (really just depends on your exact deployment method), but I’m happy with it.
While I do not make heavy use of these two, I like having my contacts and calendar synced and accessible on both my PCs and phone.
I actually use the notes app, and have a yubikey. For notes, I could just use the regular markdown editor, but I like way the app lays everything out. For the yubikey, NC by default uses yubikeys for passwordless login. I use an app which uses them for 2FA instead. I also use apps which allow me to view hashes and metadata from the files tab.
All that makes me not want to switch yet. We’ll get there eventually since none of the features I want are ultra complex or super uncommon.
OCIS, last I tested it (a while ago), also lacked the ability to right click files, requiring you to select it with the checkbox and then select the operation at the top of the screen. I sure hope that they’ve added that feature by now.
Hey there. I don’t have anything to say which is actually helpful. I’m just here to say that you are throwing yourself into the deep end a bit since authentication / access control is actually one of the more advanced topics there is.
Once you do get it figured out, you’ll look back and it’ll make sense. I don’t use Cloudflare services for my projects, so I can’t actually help you. Auth/access control settings vary highly depending on what you chose to use (cloudflare, tailscale, netbird, etc),
Having skimmed over the other guy’s PDF, I’ll say that where Cloudflare provides instructions, follow those over his steps 1 and 5 (since if anything will be outdated and not work/no longer recommended, those would be it), but I otherwise don’t have complaints. As with everything computers, everyone has their own way of doing things which they insist is the correct way. I’d do things very differently, but I also won’t say there’s anything wrong with their way.