NixOS in LXC works great, although I switched to bare metal NixOS a few months ago. I didn’t see the need for proxmox as it hindered my ability of declaring the whole system.

Creating NixOS LXC’s is a bit of a pita. Some links that helped me two years ago:

• https://wiki.nixos.org/wiki/Proxmox_Virtual_Environment#LXC
• https://web.archive.org/web/20230818134729/https://blog.xirion.net/posts/nixos-proxmox-lxc/

It’s great to see another open source OIDC provider (with more features). I’ve set up Pocket ID which is awesome because of it’s simplicity and it’s great.

I found the guide/examples on their website a bit irritating at first (that’s on me) but it works well once understood and configured.

Yes. 127.0.0.0 is the localhost. This is the IP the container is listening on. Even if there was no firewall it wouldn’t allow any connection except from the host. If it’s set to 0.0.0.0 it means it’ll allow connections from any IP (which might not be an issue depending on your setup).

The reverse proxy runs on localhost anyway, so any other IPs have no reason to ever have access.

It’s mostly to allow the reverse proxy on localhost to connect to the container/service, while blocking all other hosts/IPs.

This is especially important when using docker as it messes with iptables and can circumvent firewall like e.g. ufw.

You’re right that it doesn’t increase security on case of a compromised container. It’s just about outside connections.

Some I haven’t yet found in this thread:

• rootless podman
• container port mapping to localhost (e.g. 127.0.0.1:8080:8080)
• systemd services with many of its sandboxing features (PrivateTmp, …)

I do the same, but with Wireguard instead of OpenVPN. The performance is much better in my experience and it sucks less battery life.

Trying to actually restore is the best way to ensure the backup works. But it’s annoying so I never do it.

I usually trust restic to do it’s job. Validating that files are there and are readable can be done with restic mount, and you’ve mentioned restic check.

The best way to ensure your data is safe is to do a second backup with another tool. And keep your keys safe and accessible. A remote backup has no use of the keys burned down.

I use Findroid for its great UI but also its ability to download and watch offline. It’s a better experience and I was surprised Jellyfin Android didn’t support it.

I wonder how much money Plex still makes through their lifetime purchases. Is it that they were struggling and then made bad business decisions with the aim on increasing revenue (ad supported video on demand)? Or was it the other way around?

In the 80s new systems usually came with new OSs, which required porting software it. Thus a lifetime license was practically limited.

I wouldn’t be as opposed to a subscription model if it was cheaper and they focused on their actual core product, not all the other fluff around. 5€/m is a bit much given they don’t pay for my bandwidth. And if they didn’t store my media info, history etc…

To me there’s a major difference depending on the cost of the provided service. I don’t know what features crowdsec provides, but if it’s mostly providing lists and all the blocking etc happens locally, I don’t see how they lose much money on this free service. Gathering the lists is something they’d have to do anyway to service their paying customers.

If Cloudflare stopped making Cloudflare Tunnels free to use, I’d be more understanding since bandwidth costs them relevant amounts of money.

If the person would answer almost instantly, 24/7, without being annoyed: Yes. Checking important information is easier once you know, what exactly to type.

Matrix won’t necessarily download all state/messages automatically, but if your client requests a non-available message your matrix server will query other matrix servers for it (backfilling).

E.g. if you scroll up to older messages, it might take a a few seconds but your client should eventually show them.

Matrix server use a back-off for servers sending messages, so if your server is offline for many hours, it might take a day for your servers to get messages pushed to by other servers again.

Given it seems to be a single guy doing his thing I don’t expect them to get bought out.

It’s a great service and incredibly cheap. With advanced pricing I’m only paying ~0,40€ per month. My domain + purelymail is less than I’d pay for other providers email only.

Edit: If Amazon increases their prices they’ll have to pass it on, but those should be pretty consistent. If you use your own domain (or an alias service) switching email providers is simple anyway.

Mindfactory is selling Factory Recertified Seagate Exos and Ironwolf Pro.

They were also reportedly one of the shops (unknowingly) selling used HDDs with SMART values reset as new.

https://www.mindfactory.de/Produkte/Seagate_Factory_Recertified/

A project ending as abandonware is always a possibility. One reason projects get abandoned is losing funding, which can be secured by using dual licensing and selling some features to businesses.

They use AGPL so even if they broke their promise and restricted features, it could still be developed further (even if no new features got added). NGINX also uses a dual license.

It’s sad to hear about his passing. His videos about the Pi3 were great for me at the time. It’s been about 8 years and looking at the thumbnails of his videos brings back memories.

Notable mention of Mozilla being a Platinum sponsor.

For no particular reason, except for btrfs taking up less RAM. I don’t know their specs, but the lack of RAM was my reason for deciding against btrfs for my large non-mirrored HDD.

I personally really like btrfs for my large media HDD because it makes copying large files an instantaneous operation.

Also, it’s useful to have 6 hourly snapshots in case *arr upgrades something or anything else happens (btrbk).

It’s not necessary almost any time, but the times I needed it a CoW FS with snapshots came in handy.

Edit: Also, btrfs does check summing, so it’s possible to detect bit rot.