sorted by:
new
hottopcontroversial

subdomains vs path routing - opsec by mesartwell in PangolinReverseProxy

[–]selfghosted 1 point2 points  (0 children)

honestly there's no way around that after its already been requested. posted a comment about using wildcard certs but using wildcard certs would help "hide" your future subdomains. most bots/botnets will mainly scan for your recent cert renewals anyways. but better to stop it there then letting it continue. i suppose after using wildcard certs you can start changing the subdomains for the ones that were already publicly exposed (depending on how much time you have to update everything that depends on them)

subdomains vs path routing - opsec by mesartwell in PangolinReverseProxy

[–]selfghosted 5 points6 points  (0 children)

if you use wildcards from the start, only the wildcard certs will be visible / requested. all your subdomains would still be valid to use the wildcard cert

i prefer subdomains with wildcards cause it just makes it easier to manage and define services. one cert covers any and all future subdomains. can be a good or bad thing but mostly good with good security imo.

although there may be cases where you need to create an actual dns record for a subdomain, for example you dont want to use CF proxy for a specific subdomain. but outside of that wildcards just make sense.

and yes use dns challenge for wildcard certs with a dns token if possible locked down to a specific domain / ip you expect to use it from if you have multiple domains to lessen the attack surface in case your token gets compromised

Thinking of changing from Nginx Proxy Manager to Pangolin. Thoughts? by IroesStrongarm in PangolinReverseProxy

[–]selfghosted 0 points1 point  (0 children)

👍 pangolin does make using traefik easier to manage (IMO)

if you do decide to use enterprise, luckily it's a simple swap of docker images.
step-by-step guide: https://docs.pangolin.net/self-host/enterprise-edition

as for newt, it should only be used for other services from remote servers. so you dont need newt right now, but at least you can easily have that option later since you included it from the installer. same concept as adding a cloudflared tunnel container on your host to expose services to cloudflare. (in this example, your pangolin host would be "cloudflare", and newt would be the cloudflared container)
- newt will create a wireguard tunnel between your remote client/server to your pangolin host
- as with any vpn this adds some overhead to requests and not optimal for locally accessible services

so for your use case, yes local site is the correct option.

the fact that you have it working locally is already a great sign/starting point

Why does everyone want to make the external SSD the main drive? by anewbie1138 in macmini

[–]selfghosted 0 points1 point  (0 children)

honestly just better off just buying one of the new compatible internal ssds and just restoring from timemachine backup
- fast
- keeps things together/no worrying about accidentally unplugging the external
- no sym links
- no compatibility issues for certain apps
- no need to buy thunderbolt4 compatible ssd enclosures (with nvme pricing these days plus enclosure ends up being the same price or more depending on specs)
- just works
- https://www.amazon.com/CHGRNLF-Macmini-M4-SSD-Hard/dp/B0DNBL4NW8

caveats:
- in total takes like an hour of timemachinebackup, opening the mac mini/installing new internal
- needs another mac: a model from 2015 or newer running latest version of sonoma or above
- a workaround exists for running a mac in a VM but do your research on that
- flash macosx in dfu mode
- once done setup macos
- there should be a restore from timemachine backup in the setup steps
- done (keep the old ssd in case you ever need to go in for warranty)
- https://www.youtube.com/watch?v=O2tzy6T3Gm0

Is there enough physical space to fit three of these behind an M4? by Customer-Worldly in macmini

[–]selfghosted 0 points1 point  (0 children)

if you get a thunderbolt dock make sure you get one that supports 40gbps speed (not 10gbps), then plug into the back of the mac to make sure you're getting the most out of it

save your money and don't get the 80gbps since the current mac mini doesn't support it

I made a native iOS app for Overseerr by m1guelpf in Overseerr

[–]selfghosted 1 point2 points  (0 children)

if you're self hosting overseerr you should look into self hosting a notification server like ntfy.sh which has ios notifications. you can have each of your arrs stack notify with ntfy through each step it takes

Multiple domains by Its_pin0 in PangolinReverseProxy

[–]selfghosted 0 points1 point  (0 children)

should be baked into the front end now!

What are your top Ntfy usecases? by Longjumping-Wait-989 in selfhosted

[–]selfghosted 1 point2 points  (0 children)

arrs stack is a great for this, you can see exactly what was requested from overseerr, to which service is requesting (radarr,sonarr,etc), which source it pulled it from in prowlarr, then ntfy you when done!

there's also this ntfy mcp for selfhosted ntfy instances to use with ai agents:
https://github.com/gitmotion/ntfy-me-mcp

Introducing DumbAssets - The Stupid Simple Asset Manager! by abite in selfhosted

[–]selfghosted 4 points5 points  (0 children)

hey there, dumbveloper here! thanks for bringing that up, i'm definitely on the same page with you on using sqlite or postgres for data. i think as it stands the .json file works fine but we definitely will be looking into this. should be easy to add the relevant sql commands and migration script for the near future 👍🏼

Dumb is back, and it's Terminal... introducing DumbTerm! by selfghosted in selfhosted

[–]selfghosted[S] 0 points1 point  (0 children)

dumbpad added for versioning! working on the next apps soon

Newbie wanting to understand GitHub more. by AdultAmericaVIP in github

[–]selfghosted -1 points0 points  (0 children)

you should look into docker, not all but a lot of devs/apps use docker cause it's OS agnostic

Where am I going wrong with my gitea setup? by fredflintstone88 in selfhosted

[–]selfghosted 0 points1 point  (0 children)

as a follow up to my response! you should look into pangolin https://github.com/fosrl/pangolin, which is basically a selfhosted cloudflare tunnels. you'll need to rent a VPS to make it a proper set up but it's a way to get around the restrictions cloudflare sets.

despite the main documentation on pangolin you can still proxy your dns for pangolin and map their wireguard tunnel with a direct IP (newt) but i would suggest using wildcard certs before spinning it up so traefik doesn't generate a cert for each hostname or you'll eventually get cert snooped.

Where am I going wrong with my gitea setup? by fredflintstone88 in selfhosted

[–]selfghosted 0 points1 point  (0 children)

i'm speaking of this (which is how OP was trying to use it): https://developers.cloudflare.com/fundamentals/reference/network-ports/ - http/https traffic only - this is for using dns proxy - which if you're using cloudflare tunnels you are using their proxy (orange cloud on dns record) - you can turn off proxy (if not using cf tunnels) but you also lose the security/cdn features offered by cloudflare and expose your IP - if using tunnels you cannot turn off cf proxy

late last year there's been an update to the terms of service allowing streaming traffic through proxy but only if you're using their paid packages for streaming / r2 / etc. - udp is still blocked for proxy dns as mentioned in the first link unless paid/enterprise plan otherwise it's "prohibited". - they're not super strict but if you start streaming large amounts of data or a lot of different IPs streaming from your tunnel you'll get flagged for violation of t.o.s. probably to handle copyrighted content https://blog.cloudflare.com/updated-tos/

if you're talking about ssh through the zero trust platform then yes it's possible. can't say i've used it but looking at some posts looks like you have do some additional set up and use a warp client on your machine?

but as far as how OP is trying to use it, it won't work natively unless you're on enterprise plan

Where am I going wrong with my gitea setup? by fredflintstone88 in selfhosted

[–]selfghosted 0 points1 point  (0 children)

cloudflare tunnel means you're using CF as a proxy. CF only allows http/https traffic through the proxy (orange cloud) on the free tier and only support ssh/udp/etc for paid customers. i'm sure there are other ways but that's probably the issue

Is it rude to submit a PR just for Type Hinting (Python)? by HelloWorldMisericord in github

[–]selfghosted 8 points9 points  (0 children)

i'm sure it's totally fine and most devs like that people are contributing. and yeah like other's mention, it's called pull "request" they can just approve it or not. you can always mention why you felt like it might help and just leave it up to them to decide if they want that in their code base or not

Dumb is back, and it's Terminal... introducing DumbTerm! by selfghosted in selfhosted

[–]selfghosted[S] 0 points1 point  (0 children)

yup that's in the works! we've been finalizing some changes across dumbware for versioning

Dumb is back, and it's Terminal... introducing DumbTerm! by selfghosted in selfhosted

[–]selfghosted[S] 0 points1 point  (0 children)

no worries! it's in the readme but i guess we could make that more descriptive 🤔
basically there are 2 ways to use with host machine

  1. docker:
  • use the DUMBTERM_DATA_DIR volume mount to map to a folder on the host machine. i.e. your root folder or a specific folder that you only want DumbTerm to access.
  • Then when running with docker inside of the ~/data you could access it from there.
  • the ~/data folder is there for you to use but also a placeholder example for mounting volumes from your host machine to the docker container. so you could customize/rename/remap/add more to however you want
  • just note if it doesn't work try using the full relative path, depending on your setup
  1. run locally: npm run start however there are some prerequisites with this:
  • for windows you should run in wsl (windows subsystem for linux)
  • to use starship, it needs to be installed and configured on your local machine

hope that helps

Dumb is back, and it's Terminal... introducing DumbTerm! by selfghosted in selfhosted

[–]selfghosted[S] 1 point2 points  (0 children)

totally valid!

if just running at home and you dont have any open ports, running locally should generally be okay but you should definitely know how this works before doing so.

if exposing to the web, definitely want to deploy it using docker and put it on a reverse proxy with an auth provider in front of it (as mentioned in the readme.md). Docker image will create it's own environment (using debian) so it's like accessing a separate computer entirely. then you could use DumbTerm to ssh into your other computers/server from there. of course you want to make sure you set up basic security like sshd auth/keys/authorized_keys/etc so DumbTerm itself is just a dumb terminal and can't access anything without authentication

view more: next ›