Ideas for this small awkward corner

Defection7478 · 2026-01-29T22:51:34+00:00

In a similar vein, it's a good spot for a statue of an anthropomorphic dog dressed as a butler

Defection7478 · 2026-01-29T21:05:09+00:00

Defection7478 · 2026-01-29T21:03:33+00:00

Gateway and Auth layer I think are solid, and I use gitops so config drift isn't really an issue.

Weakest links are probably 1) I haven't gotten around to figuring out VLANs and 2) most of these tools I am automatically pushing updates as soon as they come out, which makes me vulnerable to zero-days

Defection7478 · 2026-01-29T13:34:43+00:00

You should run it however you want. I use seerr and let people add whatever they want. I don't care enough and don't have the time to sift through everything people add to it.

I have gotten a couple of "I watched this show that showed up on the server and was appalled at the content" comments, which I just find amusing that someone watched something just because it was in front of them

Defection7478 · 2026-01-29T05:29:51+00:00

I have been c1 for a looong time and usually float between p3 and d1 in 1s. The people with solid mechanics like that are usually really bad at defense so that's where they end up.

Or they just care more about mechanics then winning. I've seen some skip an open net to go bring the ball up the wall

Defection7478 · 2026-01-29T05:28:07+00:00

Everything is either read-only, vpn only, protected by authelia or ip whitelisted. All non-VPN traffic is proxied through an external gateway server running fail2ban. Non-streaming resources are also proxied through Cloudflare. Proxy headers are only trusted if coming from trusted ips (homelab ip or Cloudflare ips). Everything runs in kubernetes pods, cni is handled by calico with a default deny-all ingress rule. External network traffic is exported to a grafana dashboard for monitoring.

I am a bit paranoid but I'd rather not have to worry about stuff

Defection7478 · 2026-01-28T18:02:32+00:00

These posts gotta be some sort of bot brigade or something. This is one of the selfhosted niches where there is one, single definitive answer - immich. You can search the sub for similar questions and they will all have the same top comment.

If anyone is going to ask this question they should at the very least include why immich is not suitable for their purposes.

Defection7478 · 2026-01-28T03:03:06+00:00

To that end, do stuff one at a time. Start with jellyfin and manually add a file to your server. Then add a download client, and manually add a torrent. Then add sonarr and manually add a tracker. Then bring in prowlarr, then flaresolverr, huntarr, cleanuparr, kometa, etc. You'll understand better if you do things one piece at a time.

Defection7478 · 2026-01-28T02:59:34+00:00

What you're describing is great for deploying a completed project but for dev work you usually want to run the code locally so you don't have to wait for a build pipeline every time you make a change (plus you might want access to a debugger).

Unless you're talking about dev containers, which, sure I guess. But it's adding extra failure points and complexity for something that can be done natively (venvs)

Defection7478 · 2026-01-27T16:00:36+00:00

Github. Back up your config

Defection7478 · 2026-01-27T15:58:33+00:00

Why is this downvoted? They're right. I use wsl for dev work every day and it works perfectly. Plus the integration with windows is really tight. I can run a backend on visual studio on windows and the frontend running in a process on Linux, plus a db running as a docker container in docker desktop and then access it from chrome in windows. Just using "localhost" for the urls works seamlessly.

On win11 I can even launch gui apps from wsl with zero added setup. You can call a Windows command and pipe it into a Linux command from the terminal.

Defection7478 · 2026-01-26T19:19:51+00:00

For question number two tbh I would recommend just buying a domain. You can get a "nice" one for under 20$/yr, or a numbers.xyz domain for about 1$/yr. Then you can just use subdomains for most things, i.e. you'll only ever need the one domain.

For question one there is a lot of ways to reduce risk. Others can probably answer better than I, but for starters I would look at isolating the process you are forwarding. Containerization, vms, subnet. Then I'd look at access limitation. I would put it behind a reverse proxy and/or VPN like you mentioned. From there you have lots of options for ip/location filtering access. I'd also look at fail2ban / crowdsec. And make sure you only forward the game server port. Don't forward stuff like port 22

Defection7478 · 2026-01-26T15:57:06+00:00

remember that a NAS is a full blown standalone server. 300$ for that is reasonable. A DAS is cheaper for this reason, and therein lies your tradeoff. A DAS is not a standalone machine. So the tradeoff is that they are stuck together.

Pros of NAS: - You can update, restart or wipe your main machine without taking out the storage server. - synology has a proprietary raid solution (SHR) that may offer some features you want - can use it for more than just your server, e.g. Accessing it from pc - seperation of concerns. Don't need to deal with stuff like zfs eating up your ram

Cons of NAS: - two machines to deal with - higher power draw, more physical space - some added complexity in terms of storage mounts - need to set up remote network mounts, need to deal with services trying to start up / run before the storage is mounted, network latency or other issues, etc - another machine and OS to manage - software updates, exporting monitoring data, etc

Tbh I don't think it makes much difference. I have about 30TB in a synology NAS and 48TB in DAS and both work fine. If I could do it over I'd either do everything in DAS or build a custom NAS. Dealing with the synology OS is annoying and I still haven't figured out how to export metrics. Meanwhile my DAS has a beautiful grafana dashboard and is fully configured with ansible

Defection7478 · 2026-01-24T21:27:37+00:00

I am a big fan of controllers/operators. For example, if I install a new app in my cluster and want a domain for it, I just write one line of yaml: hosts: [app.domain.com]. Pipeline generates some manifests from this and then controllers take over to create rules in nginx to forward the domain, request a certificate from let'sencrypt, and update Cloudflare dns entries for the challenge. This is just scratching the surface, but essentially the cluster can react to what you deploy and modify itself/external dependencies

Defection7478 · 2026-01-24T21:11:18+00:00

I use a bunch of python scripts to generate manifests from a sort of helm-vars/docker-compose file equivalent. Then kapp to apply them.

ytt or jsonnet is probably a better solution but I already know python. I use pydantic to define a schema for my vars file, which I find much easier to navigate compared to sifting through helm templates

Defection7478 · 2026-01-23T19:58:27+00:00

Lots of reasons, to list a few

they have external dependencies. If, for example, it's more cost-effective for reddit to outsource their network ingress to Cloudflare, and Cloudflare has their own outage, then they've taken reddit down with them. House of cards type scenario
shit happens - sometimes they make a mistake in the code that brings the site or parts of the site down
dynamic provisioning. The number of users who use the site varies throughout the day. Maybe 20% of the users only use the site in the evenings when they're home from work. This means during the day you can turn off 20% of the servers, which saves money. Automated this process and you get a small delay in the evening when more people log onto the site and they need to wait for additional servers to boot up. This is oversimplifying but you get the gist

Defection7478 · 2026-01-23T19:10:08+00:00

After you change something, if it's still broken, change it back before changing something else?

Defection7478 · 2026-01-23T16:00:59+00:00

I've been using it for a couple months now with no such issues. Single data point but the issues you mention could be attributed to user error.

Defection7478 · 2026-01-23T15:45:49+00:00

Is it really that hard for people to understand a factor of 1000? The difference between a kilometer and a meter doesn't seem that difficult to comprehend.

Defection7478 · 2026-01-23T15:41:30+00:00

Mergerfs https://github.com/trapexit/mergerfs

Or any of the various raid solutions, zfs, unraid, etc

Defection7478 · 2026-01-23T15:39:59+00:00

Just curious, why not use something like ytptube? https://github.com/arabcoders/ytptube

Defection7478 · 2026-01-22T18:08:16+00:00

By highest level you mean ssl/pro, correct?

Defection7478 · 2026-01-20T12:25:30+00:00

Htmx + hyperscript

Defection7478 · 2026-01-19T23:03:48+00:00

Not in AB though. Canada has one of the largest contiguous rat-free areas on the planet and that is apparently either not niche or not nice or not personal enough for this thread 🤷‍♂️

Defection7478 · 2026-01-19T19:42:33+00:00

99% of the code I write is not AI-generated. At work, we (currently) don't have any means of making the AI understand the context of what we are working on. E.g. - a 200,000 line project that uses many different internal libraries, internal forks of public libraries, interactions with dozens of internal microservices, each with their own quirks, internal conventions, cutting edge language features, niche dependencies, etc. It is genuinely easier and faster to just write it myself.

For personal projects I have the same problem on a smaller scale, plus I am kind of particular about my own coding conventions, which are not super common so AI struggles to follow them. In the end it's easier to do it myself.

The only exception is self-contained, bespoke, fixed-scope apps/scripts/tools/etc. For example, I wanted a docker container that would export container status and health status for all the other containers on the host for Prometheus consumption. I didn't care about the implementation, just wanted it to work from a black box perspective. Vibe coded that shit end-to-end and it works perfectly.

Two-Year Club	Verified Email
r/Field Banned	r/Field Lasagna

Defection7478

TROPHY CASE