Thanks for sharing. I would definitely be interested in a write-up on how you solved the DNS+certificate problem please, as this is a problem I’ve run into on my self-hosting journey.

Ironically I wasn’t able to get EAC working on my Windows 10 installation due to the WinFSP clash, whilst CUERipper errors out on WINE (something to do with how it interacts with the ODD).

However, CUETools works fine and so I was able to compare the same CD ripped by CUETools/CUERipper on Windows with EAC under WINE. I used an ABBA CD as the test case (100+ matches in CTDB, 10+ in AccurateRip).

The CUE sheets are functionally identical (barring the differences in extra metadata stored between the two, as CUERipper included the IRSC where EAC has a Composer comment instead) – the gaps and indices are all the same. The raw rip itself is also identical - I ripped the CD to a disc image (with offset correction in both cases) and the md5 checksum of the WAV file from both applications is the same.

In both tools the rip validated against AccurateRip and CUETools DB as well. I double-checked the EAC rip afterwards using CUETools (again under WINE), as a further test.

Finally got around to testing out EAC on WINE (prompted by my previous comment a few hours ago).

It seems to work without major issues on WINE 11 in a 32-bit prefix (at least on LMDE 7). Plugins need dotnet20 and dotnet48 installed, otherwise only the in-built AccurateRip meta engine shows up. I’ve only tested ripping to WAVE and FLAC, though.

In short, I’d say it’s worth a try now.

I’ve been looking into this myself recently. EAC still seems to be the top option (followed by CUERipper/CUETools). CUETools itself runs under WINE, but CUERipper doesn’t (at least for me). Haven’t tried EAC on WINE yet.

https://wiki.hydrogenaudio.org/index.php?title=Comparison_of_CD_rippers

Good to know, thanks.

You can indeed: https://tailscale.com/docs/integrations/identity

That sounds like it may be a good fit for my use case, then. Thanks again and I’ll definitely look into it!

Thanks for the suggestion. I’m trying to move away from Google, but the idea of a shared account for tailscale (which seems to support a lot of different SSO options) may be useful.

Good to know, thanks. Not keen on Cloudflare, so it’s good to see that there’s now multiple recommendations for Pangolin and Tailscale in this thread.

Thanks - appreciate another recommendation for Pangolin + crowdsec, plus I didn’t know about authentik (which sounds super useful if the services behind it are compatible). I’m thinking I need to have a play around with tailscale and then Pangolin to see how they work and whether either will be appropriate for my use case.

Thanks. I think I’ll need to do a bit more reading - I have no experience with any of the wireguard technologies (my VPN experience is with OpenVPN and enterprise-grade networking hardware that uses IPsec tunnels), but Pangolin’s abilities do sound useful.

I guess I need to work out if something like tailscale (as per one of the other comments) set up on just the small group I want to share with will do the job, or whether I really need to expose services to the Internet and hence would benefit from a VPS with something like Pangolin.

Thanks, sounds like a potential option. I’ll add to the list of things to look into and test out.

Yeah, I don’t like the thought of worrying about vulnerabilities either, hence my asking this question!

I haven’t heard of Pangolin cloud before – I’m assuming this is a competitor to tailscale. Are you self-hosting it or using one of their paid plans, and if you’re self-hosting, how hard was it to set up?

Thanks. My main concern is needing to have the tailscale client set up on my relatives’ devices, so it’d need to be easy to do and the configuration straightforward.

If I wanted to route just traffic to Vikunja and Immich through it, so all their other apps (if on a phone) or web browsing (on a PC) didn’t go through tailscale, is that straightforward to do and is it something that has to be done in the client-side configuration?

Thanks. I had forgotten about setting up a DMZ and appreciate the reminder!

Thanks, didn’t know about Immich proxy. Sounds useful.

On the VPS point - beyond protection against DoS, I assume the main benefits only arise if you host the services on it? My understanding is that, if I open a port and forward it to nginx, then the largest attack surface would be nginx itself and the services it is acting as a reverse proxy for (e.g. Vikunja). nginx is well-established and I think most of the risk is from the plugins rather than nginx vulnerabilities itself, which leaves Vikunja and any other services I’d want to expose as the main attack surface. If I’m using a VPS as a gateway (e.g. hosting nginx there and still keeping Vikunja and Immich within my LAN), then that doesn’t seem like it’s much of a risk reduction. What am I missing?

Thanks. So, just to make sure I’ve understood correctly, your recommendation would be a VPS that hosts nginx (or Caddy) as the reverse proxy and uses tailscale (or equivalent) to access my home LAN and make services (e.g. Vikunja) available?

Thanks for the recommendation. I have no experience with Proxmox, so this might be part of a longer-term project once I’ve got the Vikunja access working (at least that’s on a separate Pi and so would be similar to a distinct VM in that regard).

Good call. I’ll have to play around with certbot using DNS validation (only ever tried with HTTP validation), but certainly worth including in my plan. Thanks.

Ah, my mistake, I’m getting mixed up between minidiscs and the 8cm mini CDs.

You can get multi-layer M-disc BD-Rs, though, up to the triple layer 100GB BDXL (although you need one of the BDXL burners to write those; the 50GB BD-R DLs can be written by most burners). They cost a pretty penny, though!

The biggest problem now is the disappearance of Bluray burners/writers. Here in Aus there are no internal drives available on the market any more. I’ve had to stock up with a few second-hand spares before they get too pricey.