I’ll add: mTLS would only break because the client certs are typically signed by a private CA and the host is configured to only trust that specific CA (similar to the enterprise solution I referenced in the post).

If, for some reason, the host was configured to trust all of the typical public CAs, then mTLS would theoretically share the same problem.

Not directly, but I believe mTLS would break if the traffic was intercepted/altered, so it sort of works to test the connection.

mTLS requires installing a certificate on the client device, though. If you’re able to do that, then you’re also able to pin the correct cert or install a custom CA. This would be the “enterprise” solution, as far as I know, but doesn’t work well for public sites, since you can’t always configure your end-users devices.

Edit: mTLS is still very useful, though. I use it to secure some of my services. It just doesn’t solve this specific problem.

Really depends.

It’d be massively overkill for me, so even if it’s technically a “good value”, it doesn’t make sense to buy one if my cluster of $60 thinkcentres is chugging along without an issue (and I get HA).

On the other hand, if you need all that extra performance for something, then it’s probably a great buy (hence its popularity here).

I use beets to add synced lyrics to my library automatically.

To display them in the web browser interface, click the lyrics button (looks like a book).

Have you explored any other options?

Yeah. I briefly explored some other possibilities in the post, including a potential self-hosted option, but ultimately landed on CF as a practical compromise.

I didn’t see an obvious link to the source code, so here it is for those interested: https://github.com/Drop-OSS/drop

Crowdsec does it by using crowd-sourced blocklists (hence the name). So if an IP triggers a scenario on other machines, that malicious address will be proactively added to your blocklist before it ever gets a chance to impact your machine.

That is the big advantage of crowdsec over reactive-only solutions, like fail2ban.

Yep.

Never noticed a difference, myself.

The 3DS on the other hand…

https://github.com/zoeyjodon/moonlight-N3DS

What is the advantage of this over just dropping HTML files onto a USB drive?

Not often, but there’s a niche. I wish I could remember the details, but I saw someone earlier this year that was hosting a public BBS on a c64.

Same experience. 🫤

Personally, whenever I need to process anything text-based, I use perl.

Read the json into a hash, parse the values if desired, then plug the values into an html template.

It’s pretty quick to write, much easier to learn than python (in my opinion), and super powerful.

I’m a bit torn on the hardware bit, myself.

On one hand, hardware is a fundamental aspect of self hosting. There’s already a portion of the community who considers self-hosting to include using commercially-hosted cloud services (as long as it’s not Google), so prohibiting hardware discussion just reinforces that concept. Plus, it can be really fun to see what creative hardware people come up. I’m pretty sure I posted about my Fediverse server running on a WiFi router here, for example. The focus was on the unusual hardware, but it was also clearly related to self-hosting.

On the other hand, looking at what is posted in other communities, I don’t think there’s a ton of value in seeing a dozen photos of a bone-stock rpi or a closed laptop sitting on a desk. Same with the nth post asking if their 30-year-old 1u would be a good choice for Jellyfin; so I see why the rule exists.

Overall, though, I think hardware should be allowed, but maybe add a rule along the lines of “if you’re posting a question, please include what resources you’ve already reviewed or troubleshooting steps you’ve already taken.”

Heck, that might be a good rule for all questions, regardless of topic…

The first one. The service is owned by root, but the application is running as an unprivileged system user.

Quadlets work like any other systemd service.

You create the user/group you want to run as on the underlying system, then just specify that user/group in the quadlet file.

If you look at my *arr examples, you can see the user and groups they’re running as.

Podman quadlets can also auto-update and auto rollback, if needed.

Same here.

Pulling doesn’t work if you don’t know when a system will be online, so it only makes sense for my laptop to push.

Seems to be specific to rewrites using an un-named capture.

grep -rnE "\$[0-9.*].*\?" /etc/ngnix

should show if you have any potentially vulnerable directives in your config.

It’s a function of a “pod” within podman.

I wrote the podman examples for AudioMuseAI using a pod: https://github.com/NeptuneHub/AudioMuse-AI/tree/main/deployment/podman-quadlets

And I have an example *arr suite on my GitHub page: https://github.com/K3CAN/podman-arr-quadlets