Adding my voice: Podman is great

Ah, thanks for the idea. I’ll look into Traefik, I’ve heard of it, but wasn’t sure what it could do.

I’m already running Headscale, and it works great. But to expose individual services to individual devices it feels like an overkill. I don’t actually need all these devices to connect to the tailnet all the time, and some of these devices I don’t even want to be able to access the entire tailnet.

My thinking is to put Immich, Matrix, and CalDAV/CardDAV behind mTLS. So the clients practically do connect via native mobile apps rather than a browser. The devices belong to a small number of users, I don’t manage them, but can distribute the keystores, and plan on doing the PKI manually as it’s really not a lot to keep track of.

Not an authentication replacement for sure, just an extra layer of protection. The goal is mostly so that if there’s a new critical exploit, I don’t have to drop everything I’m doing and immediately mitigate.

Both are arbitrary but only one is an international standard

Yes, but also a leftist…

So hard to pick a favourite. I’m especially proud of having the mail server.

I was talking about the packaging, not the brand. However setting my VPN exit node to a US location and looking up pictures of the product, most results do indeed have the same English-French labelling, funny.

Funny how my brain recognizes Canadian packaging before I consciously register the bilingual labelling.

I do for work but not for my self hosting operation, I don’t think it makes sense at least in my case. My recommendation is not to use full disk encryption on a home server, but to encypt specific directories as needed (I use fscrypt on an ext4 file system).

The accusation that Jarczak bypassed their authorization controls in violation of section 1201 of the Digital Millennium Copyright Act.

Why the fuck is the DMCA even a factor when the parties are in Poland and China?

I’ll check out sli.dev, I’ve been using Reveal.js for years now and highly recommend, I love how hugely customizable that is, but one issue for perfectionists is that it’s relatively hard to perfectly convert to a PDF, these days I use DeckTape that does a decent job. I used to be one of those nerds that used LaTeX (Beamer) but fell out of love with it.

Some time ago I tried Abrechnung and it was quite good actually.

When you run out of local storage…

If you have a single node, external USB storage is 100% fine. Even if you have more machines, if you don’t actually need a massive amount of storage, you can share that external drive as NFS.

Sounds doable, will need a bit of scripting, but I don’t really get the use case.

Arch on desktop since 2020, RH-flavoured on servers.

Used Kubuntu from 2012ish to 2020, distro-hopped in the decade before that.

The fundamental difference between GPG encryption and encrypted partition is that of asymmetric vs. symmetric encryption. Whether you mount encrypted storage or decrypt a file with GPG, there’s some “effort” in putting in the passphrase and in both cases the system’s keyring is briefly aware of it and the plaintext is saved to memory (volatile, unless you have encrypted swap or other edge cases).

Asymmetric encryption is not normally used for personal stuff but mostly to exchange material with one party holding the private key, and other having access to the public key (which is public). Of course you can act as both parties if you like. If you do, keep in mind:

1. Asymmetric encryption algorithms may be vulnerable to quantum computing attacks in the coming years. There are quantum-resistant algorithms, but to my understanding they are not necessarily quantum-proof and could potentially be broken in the more distant future.
2. If you do choose to use GPG, make sure that the plaintext never touches the disk, for example save it to /dev/shm before encryption.
3. You can also protect your private key with a passphrase.

Personally I use Joplin. On the clients it’s secure because the database is saved on encrypted storage secured by my login phrase. On the server it’s secure by Joplin encrypting the files saved to WebDAV storage. Is it 100% safe? Probably not, but probably good enough to stop all but a nation-state level actor.

I use Baïkal for card and cal and Apache for webDAV, they provide all the features I need and were easy enough to set up, never tried alternatives.

I wonder how many countries’ laws every Linux distribution violates by existing (e.g. North Korea, Turkmenistan) but these bozos at Arch Linux 32 don’t proactively block.

That is the way. I just don’t understand open source projects that have no ties to regions where these dumb regulations exist blocking users from said region. Why is it your problem? If California (for example) wants to block your website, let it be their problem.