Eh, i just use pubkey only Auth config (so password entirely disabled as an option) and put ssh on a non standard port to reduce script kid noise. (and no 2222 is not non-standard it may as well be the default)

Fail2ban triggers false too often for my taste in a high traffic environment.

If you ran nginx as a non privileged user it wouldn’t be able to bind to 80/443 as those are privileged ports. So you would need to use iptables to forward them to an unprivlaged port

I mean it WOULD work you would just need a von on every device you wanted to use.

The REAL answer is never host them DIRECTLY, always use a reverse proxy like nginx. Many projects (i believe jellyfin is one of them) explicitly recommend this for better security. Which it looks like you did so congrats

For extra bonus points you can setup nginx to run as a non privileged user and use iptables to forward the lower ports (80/443). A pain but closes out a large chunk of nginx as a risk.

https://spartanhost.org/ owner is super chill will make custom spec deployments and they actually have a really nice management panels with nice easy custom iso support

One end is a local VPS with insanely good peering pretty much round the damn world, other end is my opnsense router. I actually pass a block of ipv6 through the vpn and my router hands it out to devices which is a nice little bonus

That sounds like a lack of port forwarding on at least one side. Ensure the vpn port is properly open on both sides. There is also an option you can add to the wireguard config for keepalive set it to something like 1min

I feel like im missing something here. This is pretty trivial and the comments i see are over complicating the hell outta everything. All you need is your VPN tunnel working. Personally i use wireguard for this. Then you just use nginx as the reverse proxy it talks to services on the other side of the VPN.

The nginx server config looks like

server { listen 443 quic; listen [::]:443 quic; listen 443 ssl; listen [::]:443 ssl; server_name my.domain.tld; http2 on; http3 on; quic_gso on; tcp_nodelay on; error_log /var/log/nginx/jellyfin.access.log; ssl_certificate /path/to/ssl/fullchain.pem; ssl_certificate_key /path/to/ssl/privkey.pem; ssl_protocols TLSv1.2 TLSv1.3; add_header Alt-Svc ‘h3=“:$server_port”; ma=86400’; add_header x-quic ‘h3’; add_header Alt-Svc ‘h3-29=“:$server_port”’;

location / {
    proxy_pass http://10.159.4.12:8096/;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_set_header Host $http_host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forward-Proto http;
    proxy_set_header X-Nginx-Proxy true;
}

}

I have no idea how to do the proper code block i guess so have a paste from my reverse proxy hosted pastebin lol https://paste.kitsuna.net/upload/snail-seal-pig

What? As long as it’s a good not Telegraphed twist it will be able to still be a good moment even if you know to expect one. You’ll be trying to figure it out the whole time and you’ll probably get it wrong multiple times along the way lol

I feel like this all started around that time that there was that article that mentioned the most popular desktop environments on Arch Linux from repo stats where KDE plasma was the highest with over double gnome.

Clearly gnome foundation salty

There’s nobody for me to join, the only family that are not horrible manipulative monsters are beyond my means of travel, currently it’s just me and the dog so there’s really no point in making an elaborate dinner for myself. So today is just me being bored and alone till friends become available again.

I don’t not celebrate it because Christian or whatever. I don’t celebrate it because there’s nobody to celebrate it with

Imagine not having an opnsense firewall deployed as an IT professional

Can you not just setup an nginx reverse proxy at the network edge to handle the ssl for the domain(s) and not have to worry about the app itself being setup for it? That’s how I’ve always managed all software personal or professional

Every time I get rid of them i almost immediately need to ship something and wish i had them. I keep them not because i need them but because I’ll need them if they aren’t there

No but there is a semi work around.

When using the app if you select all images one of your options will be delete from device when you click on that it will say hey some of these might not be backed up and one of your option is to only delete the things that have been backed up. It’s not automatic but it is a way you can kind of just Mass do it to everything

It requires neither of those upgrades though? Unless you’re still using Windows XP I guess for some reason. It’s just an update to the image decoder

In its default state i think thats fair. Example docker bypasses most firewalls as it runs before iptables rules process. So if you don’t either use 127.0.0.1:port:port (many compose files offered by projects do not do this) or add specialized iptables rules to fix that up you can end up directly exposing services with meaning to or even realizing.

And yeah privilege escalation etc. There are solutions like what you mentioned but it can be a lot of work to set all that up so most people won’t

There is literally a thread somewhere on my Lemmy I need to try and find just recently that shows this perfectly. Someone made a thread asking how they can self host their images for backup from their phone and naturally everyone pointed them to immich. And they immediately started complaining and bitching that they could not access it from outside their local network. Instead of asking how to fix that they were like what the hell is the point if I have to be on the same Wi-Fi this is stupid. And they basically did not want to engage with the people being like hey you need to either make a reverse proxy or open a port on your router. They should not be self hosting

You need to open a port on your router for it to be accessible from the outside world (example your phone on LTE or a different wifi) , this is not a limitation of the software but a security feature of your router

You know it’s funny I actually find that I like the esoteric Flags more . They just stick in my head as unique and I’m never wondering whether I do update or upgrade or anything else that might sound right. It’s Syu, always has been :)

Sounds more likely that AUR fucked you. Which isn’t pacman. I’ve often found people who hate “pacman” usually just hosed their system with the AUR