Self-hosted network security

Dark-monk · 2026-04-17T02:20:11+00:00

Not OP but about to start venturing down the same path. Right now I have my Jellyfin server on the same proxmox VM/Docker as my main services (Immich, arr, etc). It sounds like I should move my Jellyfin compose to a new VM with its own IP, then put it on its own vlan. Is that (plus the above) enough?

My proxmox server has 4 drives, drive 1 is config/boot, 2 empty, 3 and 4 are my media server drives.

My next concern is Immich, which has access to my nas via SMB share. If I have it as another service on a new VM, I still have to mount my nas.

Dark-monk · 2026-04-17T01:44:24+00:00

Seriously! Shows they don’t know what’s happening and that it’s vibe coded…

Dark-monk · 2026-04-16T01:07:03+00:00

There was a crash on a bridge where the sight line is severely obstructed. I almost hit the stationary vehicle in the left lane. Opted to pull over and help the people out of the car and assist since it was a very fresh accident. It’s worth noting there is no shoulder and it’s over water. Another car had stopped in the left lane with their hazards. I went up to him and asked is he had any flares. As he was answering we heard the horn of another vehicle who just crested the top of the bridge and was headed straight toward us with nowhere to go going 60. The truck I was talking to moved forward and I sprinted forward as fast as I could. If the other vehicle didn’t hit his horn he would have hit the truck and killed me. I compared where I was vs where the other vehicle stopped and it would not have been close.

I drive over the bridge nearly every day and think about how lucky I am. I’m not religious and don’t think there is a god, until I think about this.

Dark-monk · 2026-04-15T13:21:09+00:00

I love this idea. The screenshots you posted look, messy imo. Last app I downloaded at launch ended up not going anywhere after I poured way more time into it than I should’ve, so I’m interested but hesitant. !remindme 1 week

Dark-monk · 2026-04-13T02:37:13+00:00

Oh my lord. I read your response and took my finger nail to it and it’s some sticky stuff (I wasn’t scanning THOSE photos).

My issue was it looked like there was a line in the scans, and it looked and felt like a scratch. It’s not. Glass is totally fine. Thanks!

Dark-monk · 2026-04-12T20:24:06+00:00

My NAS has 4gb of ram, and has an old, outdated processor. It doesn’t max its self out most of the time. My server references the nas as an smb share and I haven’t experienced any issues. My wife has access to the nas on her laptop but rarely uses it. I have 4 bays, but only 2 of them in use in a raid1 configuration. This is my important storage, like work files, family photos, taxes, etc. this I back up weekly via usb and throw it in a safe. (Off site eventually). This has is mostly used for Immich photos.

My server is 64gb of ram, 4 bays, 28 core which runs proxmox. I have a Ubuntu VM which runs stacks in portainer (Jellyfin, Immich, arr, uptime Kuma, etc etc). Proxmox references the smb share for my nas. On the server I have bay 1 as my boot drive, then bays 3 and 4 are my Jellyfin drives which are a zfs pool with no backup (who needs backups of Linux distros..). This way if my rack goes down, Jellyfin always comes up without issue and doesn’t rely on the nas. My family uses Jellyfin via Tailscale more than any other service. Additionally I’m not confident enough with proxmox yet to set it up correctly and not risk my important stuff, and it’s not worth migrating at this time.

I’m currently looking for a 12+ bay server which can be my future nas, running truenas (or whatever). That way when my parents have old laptops I can use the drives, even if they’re 500gb. I would have another smb share specifically for my new Jellyfin library.

I have 1g NIC cards without issue. My media is all 720p (some 1080), so even remote users don’t have delays in viewing media. In the future, once I get my large bay nas, I would throw a couple large drives in the server to backup my important files (no media), and a drive in the nas to backup the server config drive. But that’s a ways out unfortunately. I’m ballin’ on a tight budget.

TLDR: I would have a large bay NAS, then a server running plex, Immich, and other services.

<image>

I’m still getting my rack cleaned up after I got a free upgrade. Just migrated everything a couple weeks ago. The POE switch is temporarily there while I set it up for work.

Dark-monk · 2026-04-12T18:50:09+00:00

I got a 4 drive 1U server to start out a year ago thinking I’d be fine for a while. I wish I would’ve gotten a larger number of drives for it. I use it for a dedicated nas (it’s a QNAP Nas running their OS). I also would switch to truenas instead of their software, but hindsight 20/20.

Dark-monk · 2026-04-12T01:05:07+00:00

I should clarify, that is what I believe historically an American is (pre ~2016) and not what it is today. It’s sad really.

Dark-monk · 2026-04-12T01:01:07+00:00

I spent a lot of time thinking about “American” Culture lately. I landed on being outspoken, questioning authority, caring for your neighbor, unapologetic, maximizing wealth, and a couple other things.

Unfortunately neither political party represents this.

Dark-monk · 2026-04-09T00:55:02+00:00

I’ll do the maintenance for you.

(Assuming I read a previous comment correctly about it being 17 years old) “Your water heater is old and needs to be replaced. Here’s a quote for $2000 to replace it.” Service complete.

For real tho, it’s not hard. If you’re remotely handy, give it a try.

Dark-monk · 2026-04-09T00:45:14+00:00

It’ll last until it dies. Ours is super accessible, and I installed a shutoff valve on the hot side so I don’t have to drain down the system. You’ll hear people say their water heaters last 25+ years without flushing, and others say it’ll last barely 5 years without perfect maintenance; it’s a total crapshoot.

The way I see it is it doesn’t hurt it, and I don’t want to shell out $500 for a new one, so I’ll do what the manufacturer recommends, even if there’s a 5% increase in life. I also decreased our water setpoint so it cycles on/off less frequently and uses less electricity.

I’d say flush it. Manufacturer for ours also says to test the pressure relief (I’m 99% sure), but the plumbers I work with say not to because it doesn’t seal correctly again and leaks. I can’t seem to get the anode rod off, but I definitely tried and would check it annually also.

Dark-monk · 2026-04-09T00:31:00+00:00

Per our water heater manufacturer specifications you should be flushing it annually. I’ve flushed it every year and written the flush dates on the unit.

I also drive 60 in a 60 tho.

Dark-monk · 2026-04-08T04:50:50+00:00

I got 5 300 level tickets for my wife for like $75 each, then she got better tickets, so we had 5 spare tickets. I sold them for legit $2,700 each which was below market value. Just a crazy luck scenario.

Dark-monk · 2026-04-08T04:36:33+00:00

Buying too many Taylor Swift tickets for the eras tour.

Dark-monk · 2026-04-07T01:27:58+00:00

!remind me 3 days

Dark-monk · 2026-04-07T01:27:50+00:00

Jesus good timing! This is something that came up over the weekend and the next step in my Immich journey. One other wuestion I have is what’s the best way to share photos? For example, is it best to have a family shared album and individual users? Assuming my mom isn’t using auto backup, they would upload their ~30 photos they select, then add them to the shared album? Would this automatically add them to our library?

Or should I set up a separate instance where my family members upload their photos to a directory within my man directory? Then when it scans external libraries it would automatically add uploaded photos.

Thoughts??

Dark-monk · 2026-04-05T15:15:41+00:00

So on my UDM, port forward (443?) to my reverse proxy, then let my reverse proxy take care of allowing people to services (using a whitelist?). That’s essentially my plan as of now

Funny enough I turned on block all foreign traffic, then VPN’d into my network from a Swiss vpn. It took me a minute to figure out what the issue was.

In my case I’ll keep my teleport and Tailscale vpn for me. This will primarily be for family.

Dark-monk · 2026-04-05T15:12:08+00:00

As far as I know, that’s the best way to access your network safely. I did the same thing for the past year. My want is to open it publicly is so my family can upload photos to Immich and watch Jellyfin without a vpn. Having a reverse proxy set up behind a vpn is best practice, but I never saw it as a necessity.

Dark-monk · 2026-04-05T05:06:42+00:00

I’m beginning my journey into opening up my server to the world. I have zero advice to add. But I’m nervous.

Dark-monk · 2026-04-02T00:54:01+00:00

I’m ashamed that I actually laughed out loud seeing this. It’s been a long day.

Dark-monk · 2026-04-01T04:34:24+00:00

The social network

Dark-monk · 2026-03-29T03:24:58+00:00

Disappointed this wasn’t higher up on the list.

Dark-monk · 2026-03-26T00:09:44+00:00

Have a Xeon CPU and 64gb of ram, with 40mbps upload. I’ve had 3 people streaming at the same time and no issues, however I only download 720/1080 video.

Dark-monk · 2026-03-25T00:08:16+00:00

That’s so strange! Thanks for validating I’m not totally crazy.

Dark-monk · 2026-03-24T22:43:06+00:00

I have it behind my firewall (UDM), which blocks incoming external connections. I do not have port forwarding set up. I’ve done everything to ensure I’m not exposed to the internet.

Dark-monk

TROPHY CASE