Security through what now?

Well, I guess it is obscure… Though only because the number of people who have a full grasp on how the code works is highly limited.

Hey there. I don’t have anything to say which is actually helpful. I’m just here to say that you are throwing yourself into the deep end a bit since authentication / access control is actually one of the more advanced topics there is.

Once you do get it figured out, you’ll look back and it’ll make sense. I don’t use Cloudflare services for my projects, so I can’t actually help you. Auth/access control settings vary highly depending on what you chose to use (cloudflare, tailscale, netbird, etc),

Having skimmed over the other guy’s PDF, I’ll say that where Cloudflare provides instructions, follow those over his steps 1 and 5 (since if anything will be outdated and not work/no longer recommended, those would be it), but I otherwise don’t have complaints. As with everything computers, everyone has their own way of doing things which they insist is the correct way. I’d do things very differently, but I also won’t say there’s anything wrong with their way.

Mine is publicly exposed using the standard nextcloud:stable-apache docker container, with nginx (past) / traefik (present) handling TLS termination, but not otherwise adding additional security measures.

It’s been this way for several years and I’m yet to have issues, but it’s certainly not bulletproof since a critical vuln in Nextcloud could pwn it. That just hasn’t happened.

For some reason, there’s a weird 8TB 5640 RPM Blue that’s CMR. I have one.

Dunno about the rest for sure but I think they’re all SMR (except maybe 1TB).

In my experience, all that truly matters is that the drive is on the right recording technology (CMR, SMR, and maybe someday HAMR will be in the hands of us consumer plebs).

There are two reasons to care:

1. SMR has horrible write speeds. Data can read off the drive at the same speed as a CMR drive, but writes will be unbelievably slow.
2. More importantly, for some reason or another (I assume the write speed), SMR drives might get rejected by ZFS. There was some pretty loud talk about it several years ago, but I haven’t heard much since and do not know if this is still true (I assume it is).

If your use case involves only ever writing a small amount of data, point 1 doesn’t matter very much. If you’re using software which doesn’t care about CMR/SMR, point 2 doesn’t matter very much.

If either point 1 or 2 matter to you, then you should go with CMR drives. If neither matter, you may go with SMR drives if you so chose.

PS: Both WD Blues and Seagate Barracudas are (often) CMR. Seagate consult this page: https://www.seagate.com/products/cmr-smr-list/. WD lists SMR/CMR on their website when you look up the part number.

In my home NAS, I use ZFS and have ran all sorts of drives through it. It’s ran old consumer drives I’ve pulled out of scrap hardware, it’s ran NAS-grade drives, and it’s ran enterprise-grade drives… And since they’re all CMR, I can’t say there was much if any difference at all.

The only difference between the tiers that I find interesting/useful is the number of metrics you can pull off the drive. The fancier ones spit more metrics which could help you detect signs of failure earlier, but that requires knowing what to look for.

So at the end of the day, as long as the drive’s recording technology works with your software, you’re fine.

RE: External drives (seen in a comment)

External drives can be a great way to get disks for cheap, however they are loot boxes. What drive you get inside of them depends on the capacity, the manufacturer, and pure luck. You can generally look up the model number and see what people have said is inside, then hope you get whatever they got. (Generally, manufacturers don’t often change what they put in there, but they do change over time.)

You’re good in that there are no immediate problems with that setup. I run a largely similar setup, have run it for years, and have never had issues.

You can always add more security layers if desired, but from my personal experience and with my risk tolerance, I haven’t personally found it necessary.

I recently moved from X11 (BSPWM) to Wayland (Hyprland) and while I did get rid of a very annoying bug with bspwm, it did come with a few of its own quirks/annoyances:

• Hyprland does not yet have the ability to load ICC profiles
• Marking a monitor as variable refresh rate capable forces my GPU to idle at maximum clocks and draw 100W (this one really makes me wtf, but it is nvidia so idk who to blame here)
• Dragging and dropping can be very unreliable for some windows (IIRC, only with Chromium based applications so far)
• Some apps deadlock when attempting to read the clipboard (Again, only Chromium based applications so far)
  • EDIT: Maybe a recent update fixed it, however I also just switched wl-clip-persist from regular or primary mode (I can’t remember) to both. Either way, the issue appears to be gone now.

Maybe if I wasn’t a masochist and installed something normal, such as KDE, I wouldn’t have any of these issues. However, I apparently and unfortunately get great pleasure out of plopping my testicles onto an anvil and smashing them like a blacksmith forges raw iron.

Rust, however, is cool. I like Rust. I can’t say that I approve of replacing everything under the sun with a Rust rewrite for no good reason, but the language itself is fine.

You know Google drive? You know how it doesn’t work when the internet is out? You know how we live in rural USA so the internet is out every other day?

Yeah that computer in the corner is my own Google drive that still works when the internet is out.

I ran a Tor relay on one of my spare servers for a while, and my god did that thing get port scanned. Even two years after I stopped hosting the relay, it was still getting pinged every 5-10 seconds (while my other servers tend to get pinged “only” once ever 20-30 seconds).

I use Nextcloud, but as you said it’s a bit big, and with each update it’s slowly turning into more of the entire G-Suite.

I’ve used filebrowser, but be aware that until just a few days ago, it gave out access to a shell. Even with that turned off, I’d be very weary of allowing access from out of the VPN. I had a server pwned with filebrowser appearing to be the vector, and to my memory console access was disabled for the account most likely breached.

I have one of those in my car today.

Similar story here. I once had an assignment which was a part of an art contest with the theme “how to make the world a better place.”

I simply took a photo of a tree and gave it the description of “I would make the world a better place by planting more native plants.”

I got an award for it and didn’t think of it beyond that. Several years later I dated a friend from then, and it turns out I got first place in the entire school. She got second and put in effort with a drawing.

For some reason I can’t find that exact frame, but I believe this is the source. Brut makes good shit. https://youtu.be/InnwzzJa8ek

It also could be a different video from him. Looks like Brut, though.

To add on this, my server is running a 4790k, and that’s plenty for all common tasks. While faster is always nicer, the threshold for good enough is very low for server tasks.

I agree. Forgejo itself is stable and I love it. Gitea never gave me trouble and that carried over.

Actions is just a bit hard to setup, at least for me, when I tried. We’ll get there one day. (I believe the big thing is really just documentation.)

First of all, I actually do prefer Forgejo Actions over Woodpecker. Once set up, my only problem with it (so far) is almost certainly caused by my infrastructure and isn’t inherent to FA itself. Pecker, on the other hand, is quite a bit easier to set up and better documented, but I had that issue where it would disconnect from Forgejo and need a few buttons pressed to fix.

This one is just FA being weird:

If you want to deploy the Runner using Docker, the documentation is poor at best. From both a security and documentation standpoint, having it in its own VM is better, but you can do Docker. You just have to read and figure out more on your own. Reading through the example deployments from the documentation will eventually lead you to something along the lines of this (which I copy-pasted from my deployment rather than search for again):

forgejo-runner:
  image: code.forgejo.org/forgejo/runner:6.3.1
  restart: always
  user: 1000:1000
  environment:
    - DOCKER_HOST=tcp://dind:2376
  volumes:
    - runner_cache:/data
  depends_on:
    - dind
  command: >-
    bash -ec '
    forgejo-runner create-runner-file --name runner --instance https://${DOMAIN} --secret ${RUNNER_SECRET};
    sed -i -e "s|\"labels\": null|\"labels\": [\"docker:docker://docker.io/node:22-bookworm\", \"ubuntu-latest:docker://ghcr.io/catthehacker/ubuntu:act-latest\"]|" .runner ;
    forgejo-runner generate-config > config.yml;
    sed -i -e "s|^  network: \"\"$|  network: host|" config.yml ;
    sed -i -e "s|^  envs:$$|  envs:\n    DOCKER_HOST: tcp://dind:2376\n    CONTAINER_HOST: tcp://dind:2376|" config.yml ;
    forgejo-runner --config config.yml daemon
    '

You don’t actually need to do this since you could edit the two config files yourself and bind them to the container. This is just how you automatically generate those files… And it’s dumb, but it works and it means you don’t have to keep track of those files.

This one is probably just my infrastructure: https://lemmy.world/comment/16093731

If you do go for FA in Docker (or Podman) and need some help, just ask. I’ll post more of my compose and explain my decisions.

I run Forgejo and had issues with woodpecker’s hooks breaking causing workflows to not start. Moved to Forgejo Actions which had it’s own different set of quirks (really just depends on your exact deployment method), but I’m happy with it.

While I do not make heavy use of these two, I like having my contacts and calendar synced and accessible on both my PCs and phone.

I actually use the notes app, and have a yubikey. For notes, I could just use the regular markdown editor, but I like way the app lays everything out. For the yubikey, NC by default uses yubikeys for passwordless login. I use an app which uses them for 2FA instead. I also use apps which allow me to view hashes and metadata from the files tab.

All that makes me not want to switch yet. We’ll get there eventually since none of the features I want are ultra complex or super uncommon.

OCIS, last I tested it (a while ago), also lacked the ability to right click files, requiring you to select it with the checkbox and then select the operation at the top of the screen. I sure hope that they’ve added that feature by now.

I actually did not know this. Thank you! That was one of my more major gripes.

Nextcloud is more featureful (more apps like notes and hardware 2fa support). That is currently holding me to NC.

OpenCloud (fork of OCIS not original OC) is very similar when it comes to core functionality, but is missing those few apps I do not want to let go of.

Also note that nextcloud stores files in a very natural manner, where your file names and directories are stored the exact same on disk as on the interface. Opencloud does not do that. This is particularly handy if one day the app just explodes and refuses to run. With NC, you can just copy the files off the disk. Not so easy with OC.