I operate on the philosophy that it is better for me to relearn things than lean on old documentation that may no longer be accurate/relevant.

The best way to implement a safe connection to my home lab today might not be the safest way tomorrow.

Old dog, new tricks, etc.

Also! Your documentation is an attackers wet dream.

NB: this philosophy doesn’t scale.

It is ok to admit you are wrong.

Jesus Christ, your obnoxious.

Blocked.

I’m done arguing. Not gonna respond to whatever fedora fanboy nonsense to follow.

Ubuntu holds around 30 percent of the Linux desktop market. Fedora sits around 1 to 2 percent. Ubuntu focuses on Long Term Support stability, massive community documentation, seamless hardware driver support, and minimizing breakage for new users. Fedora deliberately pushes bleeding-edge kernels, experimental libraries, and rapid changes that regularly introduce breakage. Beginners do not need the newest kernel version or experimental features. They need stability, predictability, easy troubleshooting, and access to a massive community when things go wrong. Fedora is excellent for intermediate users who know how to fix their own problems. It is irresponsible to recommend a testing ground distro to someone who is still learning how to use the terminal.

If Fedora were actually a good beginner distro, it would dominate beginner spaces like r/linux4noobs, It does not. Fedora is respected, but it is not designed for beginners. Even Fedora’s own documentation assumes technical competence that a first-time Linux user will not have.

It is objectively not a good distro for beginners. Not even Fedora thinks it’s a good distro for beginners. Your arguments make no sense. I certainly don’t care to hear anymore of them.

Good day.

It is a testing ground for new features. It is literally one of the worst beginner distros. Shit breaks constantly. That is not good for beginners. Just because you like it doesn’t make it good for beginners.

We’re not talking about what distros are good. We are talking about what is good for beginners.

Would absolutely not recommend fedora as a first distro.

Yeah, I don’t recommend settling on it, but I stand by learning on it. It will be the most frictionless. It’ll ease you into resolving hairy problems in a way that is less discouraging, because they’re not quite as hairy.

Ubuntu. Many will disagree but, Debian flavors are a way smoother experience from the start and Ubuntu has a ton of community support. You’ll rarely find an issue no one found and solved before you.

if you want total control

You literally just moved the goalposts.

But, sure, ok… your NAS can be simply 1 16TB HDD in a server that does a dozen other things already, assuming its generally always available on your network. That’s roughly what I do (with redundancy).

Synology is made for the tech literate tech idiot.

They solve one problem and create a dozen more. That problem not only doesn’t need a physical solution, it doesn’t need to be a standalone device. It doesn’t need its own shitty proprietary operating system.

Anyways. Fuck them.

Im not saying Zuck is good or a savior of choice, but now would be a good time for facebook investors to pressure him to eat that difference.

Not that he should, but hes all in on Open Source*

*Massive stipulations apply.

Okay, the permission error is almost certainly because the Samba process inside the container doesn’t have the right Linux permissions for the host directory /mnt/my_ext_hdd/my_dir/my_subdir.

On your server running docker, find the numeric UID and GID for that directory: ls -ln /mnt/my_ext_hdd/my_dir/my_subdir

you likely need to set PUID=<uid_from_step_1> and PGID=<gid_from_step_1> in the environment: section of your docker-compose.yml file for the Samba service.

Recreate the container (docker compose up -d --force-recreate).

WARNING: This assumes you are only accessing Samba from within your secure local network. Never expose Samba directly to the internet. Doing so is a major security risk and makes you a target for attacks.

You’re running into that permission error because of how Docker handles file permissions between the host and the container. It’s by design for security reasons. The user inside the container likely doesn’t have access to the mounted directory unless the UID and GID match what’s on the host. You can work around it, but it’s locked down intentionally.

Also, what’s the use case here? What do you need file sharing via Samba in a Docker container for? If it’s just about moving files in and out, docker cp or docker exec -it container /bin/bash might be easier.

If it is just you on your server and the only access from outside your network is SSHing in front the VPN? You’re good. Especially if it’s just you on your network/VPN.

If there are services that others utilize, you need a firewall. Can’t trust other people’s devices to not drag in malware.

So, this question is very difficult to answer. I don’t want you to be discouraged though.

I can’t answer you because I don’t know your goals. Since we’re in /c/selfhosted, I assume you’re experimenting with some self-hosted setups, which is awesome! But what exactly are you hoping to do with OpenWRT? And what’s the plan for the switch? Are you aiming for better network control, VLANs, firewall rules, or are you just looking to have network area storage?

If you can share more about what you’re trying to accomplish, folks here will be much better equipped to help you figure out your next steps.

If you’ll be running Linux and trying to use steam to run games, at all, avoid the 14th gen is.

If not, the 14th gen i9 is your bet.

Something with Proton, the layer that makes steam work with Linux, has been causing tons of people a lot of grief myself included. Any games that rely heavily on vulkan shaders will cause my whole system to crash under heavy load. It’s a known thing and Intel still seems clueless as to what to do to resolve it, afaik.

Auth portal for VPN tunnell -> Authelia -> fail2ban -> VLAN with services only.

ELK stack monitors the LAN. (Including VLAN)

Keep that VLAN segmented. You’re good unless you’re a DOGE employee, then I’d recommend quite a bit more security.

Https://crt.sh would make anyone who thought obscurity would be a solution poop themselves.

I was reading this and thinking node package manager too and I was both confused and concerned that somebody would sit all of their security on node package manager!

That makes much more sense 🙂

Don’t fret, not even Microsoft does.

You’re not as valuable as a target as Microsoft.

It’s just about risk tokerance. The only way to avoid risk is to not play the game.

I have a server that I run services through traefik/docker on.

It ALSO has a drive that is a MIRROR of my NAS.

that NAS has a lil slavey twin, an external 14tb USB HDD. It’s on my laptop.

Every time my laptop is idle, It does a little rsync with the servers NAS to stay current.

I keep a 3rd copy (mirroring server NAS) in the cloud.