This is… Pretty stupid. There are things to be careful about but it’s pretty straight forward to use iptables.

But absolutely none of the issues you listed are issues with iptables.

point is, firewalld and iptables is for amateur hour and hobbyists.

Which is weird for you to say since practically all of the issues you list are mistakes that amateurs and hobbyists make.

Containers run “on bare metal” just as much as non-containerized applications.

guess what, I know how these work.

Neat. I don’t care.

so please tell me “how to do things right”, or shut up if you can’t tell any useful info

WTF? I’m not trying to tell you how to do anything. I’m sick of selfhosted twerps bitching about “how hard it is to self host” when they think everything should be like an app on their phone. You need to learn how networks, dhcp, dns, ssl, certificates, etc. work.

They’re cheap. You can also generate your own certs and use your own ca. But otherwise yes - quit yer bitching and learn how to do things right.

You don’t need to if you’re just using things locally.

But also - domains are cheap.

That’s a lot easier said that done for hobbyists that need a certificate for their home server.

I’d you’re going to self host you need to learn. I have no time for kids who just want “Google but free” and don’t want to spend any time learning what it takes to make that happen.

It’s being deiven by the browsers. Shorter certs mean less time for a compromised certificate to be causing trouble.

https://cabforum.org/working-groups/server/baseline-requirements/requirements/

Will we need to log in every morning and expect to refresh every damn site cert we connect to soon?

Automate your certificate renewals. You should be automating updates for security anyway.

“Bare metal” has traditionally meant without any os either. Your code executes directly on hardware and has direct control over everything. Like a micro controller.

Code in a container executes on the hardware in exactly my the same way as code not running in a container - with the os as an intermediary.

“not running in a container” is not “running on bare metal”. It’s just running outside a container.

enough, a lot, more demanding.

You need to give some sort of guidance here.

How much money are you willing to spend? Resiliency is expensive.

Self-hosting is trivial and everyone can do it.

So is open heart surgery. Unless you want it to end successfully.

Have you forgotten that you too started at 0?

Not at all. In fact I remember the day my server was hacked because I’d left a service running that had a vulnerability in it. I remember changing passwords, calling my bank to ensure there had been no fraudulent charges, etc. I remember “war driving” to find vulnerable WiFi networks. I remember changing default passwords on a service setup by a client of mine.

As I said - it’s not gate-keeping it’s experience.

Yes, it sometimes can be difficult and frustrating, but so long as someone, anyone, is willing to try and learn and fail and retry, they can get my help

Teaching is “gate-keeping” apparently. You can’t tell somebody that they need to learn something! You just need to give them a link to a url and say “run this thing as root and your stuff will work - totally not a scam tho”.

“Has anyone noticed that medical doctors gate-keep people doing open heart surgery?”

Why do you assume self-hosting is and can be trivial? It is NOT for everybody. You should have some base level of technical knowledge. You should expect to need to learn some things. It’s not a badge of honor, it’s experience.

My project focuses on building a tool that makes self-hosting more accessible without sacrificing data ownership

Good luck with that. Don’t get your users pwned in the process. You’re now responsible for the security of people who think “opening a command line” is too difficult.

I’m happy you’re discovering the Linux CLI, but this is pretty ridiculous. mpv, vlc, mplayer, etc. all serve very different uses from jellyfin.

I don’t.