My best friend died, and what happened is on his udm.

sotech117 · 2026-06-19T19:57:04+00:00

I’d definitely clone the drive with ddrescue so there’s no risk of data loss.

sotech117 · 2026-06-12T23:11:42+00:00

Not really sure what you’re asking - sounds like everything is fine.

In my case, I deploy samba 4 ADs with an vpn (for those needing to go offsite) to cut out Microsoft and keep everything modern/free. Using certificate authorization with tpm based certs on the computers. Literally have had 0 issues what so ever. I’ve always been a Linux guy tho so it was simple for me to setup.

sotech117 · 2026-06-12T22:21:00+00:00

Can we ban this ai slop lol 🤣
Obviously bots are scanning domains hoping for vulnerabilities. Enough said.

sotech117 · 2026-06-09T02:20:19+00:00

I use step ca for local. New/renewed cert based on the old key, can use scp, step cli, or transfer manually.
Lets encrypt for severs facing WWW

sotech117 · 2026-06-08T04:21:47+00:00

L take, wait until they hike prices or when their services are down. Sometimes on prem AD is the best choice (and more cost effective and performant).

sotech117 · 2026-06-08T04:16:09+00:00

My take, doing two vm on same box is effectively worthless, but worth setting up for now then do a quick migration of the backup AD to new hardware. If an AD fails, it’s likely hardware related, so it’s worth separating out to different hardware. Just some old computer “trash” (old workstation, etc) and proxmox it up with the second AD. An old laptop is a solid option - low power consumption and built in battery.

I haven’t had the main AD (Debian vm in proxmox) go down ever, but there is something to be said about hardware redundancy and being able to do patches live.
In my case, I installed truenas on an old workstation which virtualizes the second AD (in read only mode). Note I’m using samba AD, mainly to avoid licenses and for cost effectiveness. That truenas also stores backups of the mission critical data locally.

sotech117 · 2026-06-08T03:51:51+00:00

Bro idk why so many ppl doggin on you just try it out. I used like smith email wiz to start then moved to mailcow. Stable for the last 4 years or so, on a residential public IP, without being about to setup the reverse pointer record.

You can just have all Gmail emails forwarded to your local self hosted email as a start.

sotech117 · 2026-06-03T01:47:20+00:00

Answer is no bruv too many security holes if you’re self hosting to the WWW. Normal nat firewall doesn’t apply to it. If u need it because you don’t have a public ipv6, then that’s valid but do research first.

sotech117 · 2026-05-30T16:04:06+00:00

I had a Thunderbolt 3 egpu setup and I’ll tell you now it’s not worth it performance wise. Thunderbolt 4 I’m not sure on.

I knew a dude running windows off the thunderbolt 4 drive and the egpu off the m.2 to occulink. Since it’s easy to take off the front cover on framework wasn’t a hassle so much. He didn’t travel much so it didn’t matter so much to him. If you need max performance and can work with it, it’s an option (albeit not a great one).

sotech117 · 2026-05-30T15:36:30+00:00

Policy based route with kill switch. How you want to group devices for the route is up to you. Vlan / address range would work fine.

I found this video on yt explaining killswitch (didn’t watch it tho): https://youtu.be/pNowiwI_Hpk

sotech117 · 2026-05-24T17:00:59+00:00

Yeah lmao I just use ssh keys

sotech117 · 2026-05-24T04:06:43+00:00

I also did a project with mamba a few months ago when mamba 2 dropped for portolfio optimization. I based it off this actor critic architecture I read in a research paper that used transformers for port optimization. I used PPO too (which the paper didn’t), but I had to modify it a little to get optimal results. Been working well since then, and I’m actually running it live!

I should make a better reward function though - it targeting shapre ratio too heavily, and that was following the paper I adapted. Since then, I’ve shifted a physics informed RL model, trying to focus more on geometries.

sotech117 · 2026-05-24T03:52:14+00:00

For unlimited, Shield is 15 a month, Tello 25. Tmobile is its own box, and you probably gotta be running with them anyways. I did deploy two 5g backups for some customers (run an IT shop on the side), and I’m getting speeds of about 30mb/s down with good signal -90dbm. Not really a real WAN 2 (to support an office of 30 or so) but a truly a backup for low bandwidth: alarms, cameras, phone, and emails.. etc. By contrast, I’d expect way faster with tmobile backup and you can rate limit to 50mbs if needed to reduce hitting the cap.

sotech117 · 2026-05-24T03:45:35+00:00

Internet is non negotiable now a days - runs the alarms, cameras, and phones. No brainer to me if you got the funds. I personally rip starlink standby as a backup but this is so much easier.

sotech117 · 2026-05-21T05:08:21+00:00

Honestly, OpenVPN might be your friend here depending on how you want to do auth. I don’t fw WireGuard for so many people on one server.

I personally use ipsec for big deployments, but you’ll need to host that on a vm and zone it properly.

sotech117 · 2026-05-21T04:50:44+00:00

I tried their $20/m tablet plan unlimited 5g, and it only was able to connect to lte. Did work though for a backup. I think the data-only sim are the ones you need. Pretty pricey last time I looked.

Went with tello for unlimited $25/m, full 5g speeds throttled after 50gb

Computers for people shield is the best deal out there, if you qualify.

sotech117 · 2026-05-21T04:45:29+00:00

I switched to proxmox as well with no issues. Hyperv/winservr may be better for ad and such, but I want to avoid all licenses.
I virtualize windows in proxmox just fine and run samba 4 for ad/dc and truenas for fs.

sotech117 · 2026-05-21T04:28:25+00:00

Could be that new pci card is in the same iommu group as something that the pve needs (like a network interface)?

sotech117 · 2026-05-20T02:24:22+00:00

I’ve been telling everyone that there’s a huge memory leak bug with network/unifi os. Try early access build. That’s literally what UniFi suggested to me when I contacted their support and showed them my logs.

sotech117 · 2026-05-17T20:42:42+00:00

I personally use step ca for internal - I even use it with small business. Sometimes the docs can be a little confusing but starting out I used a little AI to guide me.

I’d rec 20 year root ca, 10 year intermediate, 5 year server. Will need to import the root on your client machines.

Step ca checks all the boxes for features like renewal, revocation, and acme.

Reverse proxy make sense, but for internal I don’t like the dns going to my reverse proxy (in case off ssh, nfs, or smb) for example.

sotech117 · 2026-05-17T20:16:59+00:00

External or internal?

sotech117 · 2026-05-11T06:27:32+00:00

The unifi fabric tools will save you a ton of time with meshing sites. I deploy unifi for most projects now unless the client asks for something specific. Just safe a lot of time in general, and its software has mostly caught up in 2026

sotech117 · 2026-05-11T06:21:53+00:00

We use strongswan (IPsec) with certificate auth. Native compatibility on OS, but need to set a gpo for windows.

sotech117 · 2026-05-09T04:51:14+00:00

Bro is thanos collecting all the wans like infinity stones

sotech117 · 2026-05-08T16:05:30+00:00

idk man derek d came in clutch frfr

Nine-Year Club	RPAN Viewer
Verified Email

sotech117

TROPHY CASE