Mama told me not to come.

She said, that ain’t the way to have fun.

  • 1 Post
  • 507 Comments
Joined 1 year ago
cake
Cake day: June 11th, 2023

help-circle





  • Lots of options. Here’s what I do:

    1. HAProxy - uses SNI to match an HTTPS request to a service, without decrypting the connection
    2. Caddy - manages TLS certificates, decrypts connections, and sends the request to the relevant service
    3. Docker - each service runs in a docker container on the host
    4. my router has static DNS entries for each of my subdomains, so I can do https://service.mydomain.com, and my traffic never leaves my LAN when I’m at home

    I have HAProxy running on my VPS (Hetzner), and it routes traffic over my WireGuard VPN to whatever physical device on my internal network handles that service (i.e. 2). This allows me to add devices to my network as needed, and TLS certs all live on that device.

    This is probably overkill for your setup since it sounds like you can talk to your home router from the internet (I can’t because I’m behind CGNAT), so you could drop #1 and just use Caddy, assuming you’re okay with having all traffic handled by a single device. Or you can see if your router supports SNI-based routing to handle what I’m using HAProxy for.

    If you don’t need to share your services w/ anyone, you can have everything live inside of a VPN and just access it via that VPN. You can look into Tailscale if you want something dead simple, and I think Cloudflare offers something similar. I started with that, but decided I wanted to share a number of services with family members, and I didn’t want to force each of them to configure my VPN.


  • Eh, my Ubiquiti AP works pretty well, though it’s a bit annoying setting up the server software. I get way better range with it than I ever got with my previous routers, and I never have to reboot it (my Mikrotik router needs to be rebooted more often, and that’s rock solid as well).

    I honestly haven’t had any issues, but I have a very simple setup:

    • Mikrotik router
    • UAP-AC-LITE

    That’s it. No mesh, just a single AP and a single router. It works well, and I largely forget about it because it just works.

    That said, I’m considering upgrading to a newer wi-fi standard, so I’ll be doing some research again. Ubiquiti was the best at the time, but I don’t have any particular brand loyalty, so I’ll get whatever seems to work well and is a reasonable price. I will probably keep this AP and add a second, so that’ll factor in as well (i.e. can I have two APs serving the same SSIDs? If so, how do I get them to work seamlessly?).




  • Is a vpn always safer then a reverse proxy?

    Depends on what you trust, I guess.

    A reverse proxy on a standard cert is a bigger target for automated scripts than a reverse proxy on a non-standard port. A VPN runs through the VPN’s authentication, whereas a reverse proxy relies on whatever that app’s authentication is. So whether it’s secure enough depends on the VPN configuration, what you’re hosting, etc.

    I’m behind CGNAT, so I have limitations you don’t, but here’s my setup:

    • VPS at the edge for my public services - basically the same as a reverse proxy because the application is directly exposed
    • self-hosted VPN at VPS to facilitate reverse-proxy - I could shut down public access any time and just login w/ the VPN
    • static DNS entries on my router so I can use my domains inside my network (TLS also works properly)

    I like this approach because I can eat my cake (nice domain names instead of IPs and ports) and have it too (fast connection inside LAN, can disable reverse proxy if I want better security). You could get the same w/o the VPS, and if you require WireGuard VPN access outside the LAN, you get better security than a public-facing service.



  • Would the Mac Mini actually idle at that wattage if it’s open for connections? I doubt it, it’s probably more like 10W, which is generally the range for those smaller AMD MiniPCs or NUCs.

    If it’s 10W, that’s a $20 savings from your NAS w/ a desktop CPU (and probably a discrete GPU, unless it’s running an APU). I can get 4% easily on savings, so I’d only need a $500 savings vs the Mac Mini to recoup that difference every year ($500 * 4% = $20). So if you already have an old PC, use that instead of buying a Mac Mini, and you also won’t have to fight macOS to do what you want.


  • Yup. My old 1st gen Ryzen desktop system isn’t particularly power efficient, but it idles <50W (I think closer to 25W, but I haven’t measured for a while). And that’s a desktop class chip from 7 years ago with two HDDs and a discrete GPU and PCIe wifi card, so it’s not winning any awards for efficiency. Even at that, it’s barely a blip on my power bill.

    An AMD or Intel laptop-class chip should be able to get to 10W or so idle, and not spike too much with basic tasks. And those can be had for $200-300, less if you’re okay with older chips. Run Linux headless and it’ll likely stay below 15W at the wall most of the time.



  • Eh, I chose this instance because it was one of the top 5 or so, not because of the name. I would probably hesitate to share a link from this instance, but honestly, I don’t do that anyway, I generally just share links to actual articles linked here.

    So for me, it’s really a non-issue. I have much larger concerns about how Lemmy works in general than naming of any one site, such as the one mentioned in the OP (no indication from domain name that it’s a Lemmy instance, one instance lagging on updates can break when viewed from other instances, etc). So to me, it’s going to stay niche because the user experience kind of sucks.



  • Nope, which honestly annoys me but is pretty par for the course. That said, when it comes to budgeting, I mostly care about where money is going and care less about the “whole financial picture.” If I need to estimate what retirement looks like, I want more than a simple budgeting tool.

    I personally use Fidelity for investment tracking. My main “checking” is their Cash Management Account, my “savings” is a brokerage account (invested in t-bills and money market funds), and I can link all of my other accounts and it pulls in specific investments and shows a consolidated view. It’s awesome because it shows all kinds of stuff, like morningstar-style factor weights, sector exposure, etc. It’s not self-hosted, but I trust them with my banking anyway, so it’s not like I’m opening myself up to some new exploit (oh, and Fidelity also has proper MFA; Symantic VIP, which kinda sucks, but it’s way better than any other financial institution).

    I used to track this stuff via a Google spreadsheet (couldn’t find a way to get stock quotes in LibreOffice), but this seems to be good enough for me.