I was fortunate enough to get a .io domain with my first initial and last name (I have a very common last name), and I have stuck with that ever since. I am a bit concerned with the political stuff around it, as the domain may be going away as some territory changes hands. But I think at this point there are enough large companies using the domain that I’m hoping it would be protected if the country ends up losing the domain.
I have just recently started messing with Authentik. And I can confirm OIDC claims and whatnot are an absolute nightmare. I have some experience setting up SAML stuff from my work, but I only do that if our main guy is out and I always struggle with it there too.
Your setup sounds the most like what I am doing now, minus the DMZ. But all of my containers are rootless. I am running everything on TrueNAS right now.
I think I will lean more on Authentik, as the provisioning of users and giving them access to services through that is very easy. I will probably stick with Cloudflare for the time being, but I will look more into Pangolin.
My ISP is charging $20/mo for static IP’s, so almost any other solution would be cheaper.
I hate Oracle with the passion of a thousand suns, so I don’t want to touch them with a 10ft pole. I would happily pay anyone else to avoid using anything affiliated with Oracle.
Thanks for the warning. My Plex server is currently behind a Cloudflare tunnel, so I probably need to look at moving that.
I mistook pangolin for netbird, so thanks for the clarification!
I use NPM internally for SSL. DuckDNS won’t work for me since I am behind CGNAT. I also already own a domain.
I would like to avoid paying for a VPS. I probably should have clarified in my post too that I am specifically looking for advise on securing public facing services. While I certainly could make everyone use a tailscale-like service, at this point I think securing an external service would be easier. Especially since most of these people would not be tech savvy and I don’t particularly want to play tech support for their VPN.
I haven’t looked into Asahi Linux in a while now, but I figured the experience would be pretty good by now. You don’t need to “hack” anything to get it to run. Last I read, there were just a few driver issues, but I haven’t looked into it in probably 2-3 years now.
Apples implementation of SMB has always been abysmal. I’ve been using Mac’s for close to 20 years now, and connecting to SMB shares has always been a pain. IMO, it’s gotten better recently (since they dumped AFP and were forced to work better with SMB). For whatever reason, it has always been slow to connect through Finder. Not sure there has been much progress on that front…
Really makes you wonder what Apple uses internally, because it must not be SMB!
There is an iOS/macOS app called “Pi-hole Remote” that can manage multiple PiHole instances at once. I use that because it will make changes on both instances at once for me.
Other than that, I log in to each device and copy paste.
These contracts do not stipulate reimbursement for lost revenue. The “uptime guarantee” just gets you a partial discount or service refund for the impacted services.
It is on the customer to architect their environment for high availability (use multiple regions or even multiple hyperscalers, depending on the uptime need).
Source: I work at an enterprise that is bound by one of these agreements (although not with AWS).
I’ve tried both Unraid and TrueNAS. While I greatly prefer TrueNAS, Unraid is much easier to set up and get going for beginners. It’s been a while since I’ve set up TrueNAS from scratch, but last I tried, it wasn’t a very beginner friendly experience. If you weren’t already familiar with ZFS, you were in for a pretty difficult time.
I’ve never used your exact setup, but I have had issues with a web server behind a WAF not getting the client IP (all user traffic was shown as the WAF IP). In my case, the WAF was appending the client IP in a header, and I just had to tell web app to use that header as the client IP instead of the actual IP. Again, not sure if this helps since I have never used podman or caddy (this setup was with Wordpress and an Azure Application Gateway) but the same principles might apply.
I previously had a QNAP, and they honestly aren’t much better than Synology. I would definitely go the build your own route. For the OS, I really can’t recommend TrueNAS more. I’ve been using it for years and it is rock solid.
They mention in the post that other apps are coming soon. If they start letting you self host Protect, that will be huge. When they killed off Video, the only way to get their cameras to work was to buy their hardware that could run Protect. I was shocked when they allowed you to use 3rd party cameras in Protect.
What’s the difference between the two? Reading the GitHub for meshcore, it sounds exactly like meshtastic. What makes it better?
I moved all of my Docker containers over to TrueNAS apps recently, and it’s been great so far. Alternatively, I think the best option for keeping your compose files and all that would be to upgrade to 25.04 (Fangtooth). Fangtooth lets you deploy containers using compose YAML. Each app has to be in its own YAML which can be a bit of a pain, but you would fully own everything so no need to worry about another rug pull.
Alternatively, I’ve seen some people just install Dockge and run all of their containers inside of that.
I work for a medium size enterprise as a backup architect. All of our backups are crash consistent and we’ve never had an issue.
Windows has an easy way of dealing with this in the form of VSS. As long as the application supports it, VSS can prepare the system and application for a backup, putting it in an application-consistent state before the snapshot is taken. Unfortunately, there is no equivalent for Linux. The best you can do is pre-freeze and post-thaw scripts to put the application/OS in a backup-ready state. Really though, I wouldn’t worry too much about it. Unless you are running an in-memory database, you really don’t need to worry about application consistency. If you are running an in-memory database, take database level backups (can also be done with pre-freeze/post-thaw scripts) and back up the backups.
Just remember to test whatever solution you end up going with, and make reminders to frequently re-test your backups. You never know what might change in a year’s time, so re-testing periodically is a good way to make sure everything is still functioning properly and make sure your data is still protected. And testing needs to be more than just making sure the VM powers on. Make sure the application can start up and function properly before calling it a successful test.
I have been using TrueNAS for about 3 years now and couldn’t be happier. It can do all of the backup stuff for you as well. I’m not sure if you would be able to use the key server for booting though, but I believe it would check all the other boxes. I don’t currently run VM’s on it (only docker), so not sure what it can do for VM backups.
Regardless of what you end up going with, I’m curious why you are saying you need to shut down the VM to back it up? I’m not familiar with how you are running the VM so not sure if it’s a limitation of the hypervisor, but I would think as long as you can snapshot the disk, you could just back up the snap. It would be crash-consistent rather than application-consistent, but for a backup scenario that should generally be fine.
I manage a fleet of thin clients for our organization. We have been buying and managing them for 10+ years. They are a huge cost savings over desktops for shared environments (I work for a company in the manufacturing space). For users that do nothing other than log in and check their email and update a spreadsheet, being able to shove 10+ user sessions on a single VM is much more cost effective than deploying and managing a full desktop.
Plus, these devices can connect to Cloud PC’s, so users who need a dedicated machine can use these too. I have been using a Cloud PC for over two years now for all of my job functions and love it. I would happily take one of these devices, as all of my company issued devices are just used to connect to my Cloud PC.
I second Pocket ID. I initially set up Authentik, but after discovering Pocket ID and giving it a try, it is way easier to set up and use. Authentik is great if you want to customize everything, but for my needs it was too much. I was able to migrate everything to Pocket ID in an afternoon, whereas Authentik took me several hours over the course of a few days to get set up.