My HumbleBundle donations go to the EFF, which is my indirect way of supporting Let’s Encrypt. I used to support the Internet Archive before they went political (and, consequently, to shit).

I am running BIND9 to achieve this very thing.

You can set up different “views” in BIND. Different zonefiles are served to different clients based on the IP address.

I have an external view that allows AXFR transfers to my public slave DNS provider, and an internal view for clients accessible over my VPN. I use DNS-01 challenges to issue valid Let’s Encrypt certificates to both LAN-facing and public-facing services.

My DNS server is running on my VPN coordination server, but, if I was not doing that, I’d run it on my router.

I do not use dnsmasq, so I am not sure if it supports split-view DNS, but if it does not, you can try coredns as a lightweight alternative.

sentry.io can be selfhosted for app monitoring.

Netdata is a ‘set-and-forget’ server monitoring solution. If you want something more tailored, go the prometheus+grafana route.

You can also have your app emit prometheus metrics as well.

Fair enough.

I am almost 90 per cent certain that my work won’t let me get away with a VM, but heh, who knows…

Have you considered a physical KVM switch? If you have, why did you decide against it?

Are you doing GPU partitioning?

I would submit that there is a distinction between not caring and not being aware of something. Therefore, ‘legally blind’ would indicate someone is not aware of something, and not not caring about that something.

If I said I’m legally apathetic, that would imply I don’t care about law and piracy.

Depending on your existing monitoring stack, some options might be:

• Grafana Loki
• Sentry can be self-hosted for application logging
• Logstash is self-explanatory, use with other parts of Elastic’s software like Kibana for visualization.

Never used it, don’t trust random github repos with only 3 stars, and I don’t feel comfortable using turnkey solutions or “configuration scripts”. I am a firm believer in the maxim that configuration is a deeply personal thing. Therefore, I would not use someone’s configuration scripts because they are configured as he wants it, not as I want it.

Running Docker Desktop on Windows is not exactly hard. And once you have docker desktop running, it is not exactly hard to run whatever other software / media server you might like.

Windows is my primary workstation OS because I am legally blind and Windows has the best on-screen magnifier on the market. No other product, whether commercial or free, whether standalone or baked into the WM, comes even remotely close. So I use Windows. But within Windows, I leverage both WSL and Docker to run linux tools properly. All of my remote servers are linux. My home server is linux. More than half of my virtual machines are linux.

Python has entered the chat.

I’m a smidge confused on what you are trying to achieve and how you think it will work.

As I understand you, you want to connect “embedded” devices where you do not control the software to a VPN network?

VPNs do need some kind of client (otherwise how does the network stack know to use the VPN protocol?) so how do you envisage this working without an app?

What is your desired topology like? Do you just want your smart TV/etc to connect to a remote media library over a VPN? If that’s the case, then you are overthinking it with approvals etc.

You can achieve most of what you want with router configuration. Just define routes saying “Traffic from IP address 10.20.30.40 (TV) should go to 10.20.30.30 (gateway)” and then have the “gateway” handle the tunnel.

You can also look at tailscale’s subnet routing (should work with headscale backend too).

Good luck.

A few things, in no particular order:

• Docker interferes with user-defined firewall rules on the host. You need to expend a lot of effort to make your rules persist above docker. This functionally means that, if you are running a public-facing VPS/dedicated server and bind services to 0.0.0.0, even if you set up a firewall on the same machine, it won’t work and your services will be publicly accessible
• If you have access to a second firewall device  —  whether it is your router at home, or your hosting provider’s firewall (Hetzner, OVH both like to provide firewall controls external to your server)  — this is not the biggest concern.
• There is no reason to bind your containers to 0.0.0.0. You will usually access most of your containers from a certain IP address, so just bind them to that IP address. My preference is to bind to any address in the 127.0.0.0/8 subnet (yes, that entire subnet is loopback) and then use a reverse proxy. Alternatively, look into the ‘macvlan’ and ‘ipvlan’ docker network drivers.

Good luck

Ergo, formerly oragono, supports LDAP and possibly SAML. This is not something I have set up, but I have hosted a public ergo server before.

Good luck.

cc /u/badass6  —  no need to wait a day.

In no particular order:

• Price (if looking to host something low value)
• Price/performance (if longer-term)
• Details of Fair Usage Policy
• Bandwidth limits
• Overlimit pricing
• Location - proximity
• Location - creepiness of government / jurisdiction
• Reputation of the company - are they scummy? Do they oversell? Is their datacenter about to get yeeted? (cough Dedipath cough)
• Are they bullshitting me with RAID 100000 PURE SSD STORAGE!!!

In fact, I actually prefer HDD storage for most of my servers: for most websites, your bandwidth will be a bigger limitation than your data access speed.

This is a case of RTFM. Specifically, TFM says:

Please note that we do not support nor encourage the use of reverse proxies and container to run Headscale.

Notwithstanding the above, there is community documentation to run headscale behind conventional reverse proxies.

However, per the headscale discord, cloudflare does not work because tailscale/headscale utilize a non-standard websocket negotiation.

If you want an alternative to headscale without publicly exposing your home IP too much, I highly recommend trying something like innernet.

What I like about innernet is that the control interface is only exposed within the VPN network, so there is no big deal that your IP is internet-facing — all non-WG connections to the open WG port are dropped, and WG connections require authentication.

Are there any TOS considerations for using R2 instead of Cloudflare’s Stream platform?

You are looking for VOIP.

Asterisk is the main goto, but it is still waiting for patches to some RCE vulns disclosed last DEFCON.

Your country might not support using a mobile number with VOIP providers, mine does though.

Good luck.

Where does one get help? IT consultants. Where does one get affordable help? Dunno, I don’t use IT consultants.

Is there a particular reason you need to upgrade rather than back up your files, do a clean install of Alma, and then rsync your files back to the new host?

That’s what I’d do. I also run a lot of docker containers, so I am not worried about nuking a system — I can rebuild in minutes on a new VM.

Look into Docker Networks.

You just create a VPN Network, and then attach containers to that network that need to go through that VPN.

With VPN containers things can be more funky, where you don’t so much use a Network but rather you use “network mode” to copy the network mode of the VPN container, but you get the picture.

Having read your comment I think I understand what you are looking for: fancy dashes available to the public to serve as inspiration for your team.

In that case, let me suggest:

• Internet Traffic Trends: https://radar.cloudflare.com/
• “Cyberthreat” heat maps: https://cybermap.kaspersky.com/
• Airplanes: https://www.flightradar24.com/
• Ships: https://www.marinetraffic.com/
• Maybe some BGP routes?
  • https://lg.he.net/ or
  • https://as2914.net/#/galaxy/internet?cx=0&cy=0&cz=0&lx=0.0000&ly=0.0000&lz=0.0000&lw=1.0000&ml=150&s=1.75&l=1&v=2020-01-28
  • https://rex.apnic.net/as-interconnections?allocationType=ipv4,ipv6&economy=AU
• For weather:
  • https://openweathermap.org/
  • https://support.apple.com/en-us/102594
  • https://www.wunderground.com/weather/ca/vancouver/IVANCOUV64
  • https://merrysky.net/
  • http://pirateweather.net/en/latest/
• Public status pages:
  • https://www.githubstatus.com/
  • https://discordstatus.com/

Financial stuff is difficult  —  while there are many websites showing fancy websites, they don’t exactly like to expose their data programmatically because of the API costs.

If you’re a nerdy workplace, you can also look up satellite trackers, too.

If you want to go build a high-capacity all-SSD NAS, you need to decide how many kidneys you can part with.

The folks at /r/datahoarder will be the best to talk to about storage solutions. I prefer 7200 drives for use in my daily driver box, and I don’t really care (but have them) in the NAS.

2.5GBe is overkill  —  don’t forget you also need the cables that can support the throughput. But, even when you get the cables sorted, drive speed will be a bottleneck anyway.

I would not spend money on 2.5Gbe gear if your WAN is limited to 1gbps.

There just aren’t many reasons in a small network context where having that kind of network speed will give you a tangible benefit. In those circumstances where it would make a benefit, you would already know and would not be asking this question.

When it comes to gaming, the speed of data transfer on your internal network will mean diddly-squat. Firstly, I am not aware of any games that will saturate a 2.5g link. That’s because most online games are designed to be playable on ADSL+. There just isn’t that much data transfer.

And if you are doing LAN party only type stuff, then you will likely want a switch with more ports than with more bandwidth per port.