Elvith Ma'for

I despise those companies that filter their domain or company name in the email address at signup and don’t allow you to do that. It’s rare, but some do. That being said - those are usually hardcore and can regularly be defeated by a strategically placed underscore or dash in their tld or company name.

Here, have some WiFi cable - I have plenty of it left!

My current setup for this:

I own a domain - say homelab.com - and use it exclusively in my internal network.

The public DNS records do only resolve to 127.0.0.1 (as my domain holster doesn’t want me to have no A record).

In my home network I have a pihole running that resolves this domain and it’s subdomains locally (say pihole.homelab.com, proxmox.homelab.com and so on).

For HTTPs: As this server is not publicly reachable, I use the DNS API of my domain host to get a let’s encrypt certificate with the DNS-01 challenge. That way, the internal systems do not need to be exposed to the internet.

Edit: Caddy can do DNS-01, but you usually have to compile it yourself to include the plugin for your provider. To circumvent that, I’m just using plain old certbot and told Caddy to use the certs that are already on the machine

Also depends on your provider’s infrastructure. On mobile data, I get sorted into a rough geographic region correctly. When I’m on my home WiFi, I usually get placed about 200-300km away from my real location.

Check out Framadate. It’s hosted (and IIRC developed) by the French non profit org Framasoft.

https://framadate.org/abc/en/

Source code should be here: https://framagit.org/framasoft/framadate/

Tip:

For my cloud vps with Caddy and several containers I just pointed Caddy at a simple Caddyfile /opt/caddy/Caddyfile that globally sets up some basic things (like tls config for Let’s encrypt with email address and such) followed by import sites-enabled/*

So every container gets a Caddyfile in /opt/caddy/sites-available/app.caddyfile (or wherever) and that one gets just linked to /opt/caddy/sites-enabled/.

Now it’s easy to change the config of an app and only that one app.

To me sounds like either a neglected project

If it’s a depdency nested deep in the dependency graph, that doesn’t necessarily mean I abandoned my project. I might be using this dependency of a dependency in my project and don’t notice anything, if there is a precompiled version for the (Python/Linux/…) distribution I’m running on my machine, so I might not notice that. It might even be, that I keep my dependencies up to date, but someone up the chain isn’t. And maybe there isn’t really a viable alternative to that one dependency that pulls that package in.

There are some projects, that do not offer latest or a general tag to pin a major version. So you might need to account for that.

Also since a few years ago you can specify pull_policy: always in the docker-compose.yaml to always pull the images on start. That should at least auto update the containers on a server reboot after OS/Kernel updates.

Unless you forgot AutoUpdate=registry in the .container file for half of them, like I did.

But yeah, I switched to Podman over a year ago and I’m not looking back.

By the way, the data is subject to the privacy regulations of the country we (or our partners) have built our servers in, so good luck trying to understand what exactly our interpretation of your rights are is.

FTFY

The wearers of these glasses probably don’t want that footage seen by third parties. And the contractors sure seem like they’d rather not watch it—though they risk losing their job if they decide not to label something. “You understand that it is someone’s private life you are looking at, but at the same time you are just expected to carry out the work,” an employee told the papers. “You are not supposed to question it. If you start asking questions, you are gone.”

We at $COMPANY value your privacy and will process your data with the utmost care.

Every. Privacy. Policy. Ever.

Other than Friendica, Mastodon, Matrix, PeerTube and PieFed, what’s worth running

Maybe Nextcloud (not only for storage, but also calendar, video conferences, office, when combined with Collabora,…)? Also Immich (basically Google Photos) comes to mind. Your own instance of SearXNG.

Any kind of ToDo-list, Kanban board, …?

A ticketing system?

A Wiki to host your documentation? Note, that you may want to access it if the server fails, so…

Some stack of components around Grafana or such to visualize some data? Since you mentioned Hetzner, I’m guessing you’re from Germany. You could build a small container, ingest the gas prices that the gas station are required to publish and build a dashboard for the gas prices in your area? (Hint, here’s an API licensed under Creative Commons - https://creativecommons.tankerkoenig.de/ )

My journey:

Had some form of Linux for a long time. Either in a VM (Oracle Virtual Box, then switched to S HyperV for compatibility reasons as I had Windows Pro anyways) or sometimes as dual boot.

Then came WSL which eased some things and complicated others. What this makes really easy is to start and play around with docker containers on your PC.

Then I experimented with Linux in a VM and put docker and other software there to practice.

Up until here, there were no costs involved (besides having Windows Pro, but depending on where you get your windows key, there’s not a real difference between pro and home anyways…).

After that I got my own VPS. As much as I don’t like AWS, Google Cloud (GCP), Azure and such, they usually offer a very small VPS for free and these can be a good point to start. If you want to really go and host things, it can be beneficial to look for a hoster that isn’t one of the big 3 cloud providers and pay for a VPS there.

For hosting at home: You could start with a raspberry pi, but looking at current prices, you usually get more flexibility and bang for the buck by buying a refurbished mini PC or repurposing an old notebook/PC. You can just put Yunohost or Proxmox on it and get going.

Same, I had tried Openoffice/LibreOffice in the past and had many problems. Since I got a personal MS Office License very cheap from my employer I used that and didn’t really feel the need that much to look for alternatives.

Then about a year ago, I reworked some deployments of my self hosted things and added Collabora to my Nextcloud “just for fun”. And I was pleasantly surprised by it. Since that is based on libre office, I had the urge to check that out and realized that it should have everything I usually need. Also I was already dual booting for a while but still hadn’t really switched many “workflows” to Linux, because I was lazy to search for alternatives. This now meant that there was less friction to use Linux as a bonus.

On the other hand - they could access that data all the time since they bought it. This just simplifies this a little bit to tie it to your “real” account and combine it with all the other data about you

Stolen? That’s a harsh term. We prefer “backed up to our cloud for your security”!

Still they chose the platform and pay for it. They actively decided to use it.

Rules for thee,
not for me

And don’t listen to the promises of big companies with billion-funds, they cook with water like the rest of us.

Oh, yeah, I remember when one of our super important core systems was migrated to SaaS. My system was interfacing with it, so I got notified about the migration to make a plan. I basically told them: “We’re using $API to connect to your system. Tell me the new hostnames and IP ranges and ports and I will configure the firewall on our end. Also, our connector for your migrated system will be deployed in $IP-range so please allow these inbound connections in your firewall.”

Half a year later I got a message: “Yeah, we just found out, that $SaaS-provider never configured the firewall after our tickets and everything is reachable from the public internet. We’re forcing them to lock down the system now. Can you please tell us again from where you connect to us?”

If you put any data anywhere, assume it will be contained in a breach in the future. Blue teaming is hard. You have to be perfect every time. Red teaming is easy. You just have to wait till the blue team makes a simple mistake…

Mails sent to a company? Their or your mail account will be breached one day.

Account details on a webpage? Their user database will be leaked.

Your cloud drive, ect.

Even your data on your NAS at home or on your PC could get accessed in one way or another, you’re just a zero day and an unfortunate click away from disaster.

On the upside, as long as you do not have a target on your back, patch your stuff in a timely manner and keep some hygiene in configs, secops … You should be fine, as most automated attacks aren’t that high level and target the low hanging fruits. But that doesn’t make you completely safe.