Let’s do another round of this. What’s going on on your servers, any cool things? How’d the recent CVE flood tangent you and did it change how you see/do stuff?
You must log in or register to comment.
My automatic weekly backup ran for the first time last night. Everything worked nicely.
I practiced restoring my offsite backup this week. Good experience.
Then I printed and laminated the instructions and stored in two locations.
Just curious. How long does lamination last? I assume light hurts paper.
I dunno. Longer than bare paper, I hope.
I’m always super excited for this kind of stuff :D
If it’s automated, why only run it weekly?
Some backup methods – like VM backups on a basic Proxmox VE – only support full backups, so they put a lot of stress on the system and take a lot of space. Even if the performance hit or service disruption during the backup is manageable, a homelabber has finite disk space for backups, so there’s a tradeoff between RPO (most recent backup) and retention (oldest backup). Keeping 2 weeks of backups is cheap for weekly, expensive daily.
Ideally, everything would be backed up incrementally at fairly short intervals (short RPO, long retention), and restorable very quickly (short RTO). Getting there is a journey and weekly automatic backups is a great step.
But maybe losing a week of data is fine in their case. There are parts of my lab that would even be fine with monthly backups…
(that’s correct, I just wanted to add that Proxmox Backup Server supports incremental backups)
Ah that makes sense, thanks!
I’m into this as a regular thing!
Pinned, I think a lot of us really enjoy seeing what others have been doing to take back and make improvements to our own setup.
Glad you like it! I tried to go for a 2-3 week cycle as I realized every week is a bit too often (less comments). I also tried to do it alternating with the community on slrpnk but they’re currently down. I often forget to do these anyways :D
Anyone can make these, of course. I always enjoy doing them and talking about stuff I enjoy.
I recently got around to setting up OIDC for my internal apps using Pocket ID.
Sonarr v5 adds OIDC support, currently only in beta
Jellyfin SSO plugin
Nextcloud with the Nextcloud OIDC app
Mealie, Paperless, and Immich natively support OIDC
Calibre-Web I migrated to AutoCaliWeb, which supports generic OIDC
Sadly Navidrome doesn’t natively support OIDC and forward auth is a bit jank due to the subsonic API
How does the Jellyfin SSO plugin work for you? I’ve set it up with LDAP at the moment so that tv clients and such can still login normally
Seems to work fine. I can still use Quick Connect for apps that don’t support alternative auth.
Decided to get back into podcasts recently, but baked-in ads and sponsor reads make standard listening unbearable.
I spent the weekend spinning up MinusPod, an open-source tool that detects ad reads and strips them using ffmpeg. It uses Whisper for local transcription, then feeds the transcript to an LLM to identify exact timestamps for sponsor segments and commercial breaks before slicing them out. I routed the text processing through Gemini Flash, which runs about $0.07 per episode. Clean, ad-free audio feeds with zero manual editing.
Nothing really cool per se, but I installed Radicale on my local network as I am slowly moving away from my cloud providers.
Once I find some hardware to host Immich, I’ll be fully self supporting on all my tech.
Yeah, working some radicale related stuff on my end. Roommate decided tasks.org was the most useful to-do list app/implementation for keeping track of house chores. Gotta say, hate that radicale has basically no front end, but boy has it been crazy easy on the plug and play side.
But yeah, looking to take an old tablet and set it up as a kiosk for showing the days chore list. Might be the beginnings of me trying my hand at building a full fledged smart speaker (X to doubt tho).
Radicale and immich replaced my nextcloud instance and I never looked back. I have both updating through apt like everything else and it’s amazing how little maintenance it requires.
After the recent plex player debacle I’m once again trying to come up with a way for me and my diaspora to share media using Jellyfin, but without relying on Tailscale. We have several media libraries, and some of the library hosters are not too tech savvy, so coming up with a solution to replace the ease-of-use of plex hasn’t been easy.
What’s wrong with tailscale?
Hey, I did the same. It’s not as bad as it seems. Get yourself a domain name from cloudflare and use it. I got mine for $10 a year. Then just installed cloudflare on my Debian server and all that (I’m sure you know the rest) then made users on my admin jellyfin dashboard and started sending people their usernames and passwords. The only difference for them is now they would need to enter the server URL on the first page of whatever they use then username and password. Good thing these jellyfin clients have the page of entering the server URL in your face with their “connect to server” button. Let me know if you have any questions.
Careful with using CF Tunnels for streaming content. It’s against their ToS to use the free tier for streaming content, so they can technically turn it off whenever they want from my understanding.
Against whose TOS? Jellyfin’s? I’ve never heard of that. Do explain why please.
Edit: I re-read your comment a couple of times (English is my second language), then searched some stuff. I didn’t even know cloudflare did that. I’ve been using them for over 2 years with no issues. I guess I don’t stress their servers enough? lol. If they stop me, I’ll just move to another company. I won’t even bother asking them or anything.
Against cloudflares ToS
Thank you. I realized that after reading the comment a couple of times. Yeah, they can screw off. If they stop me, I’ll just move my stuff somewhere else.
From what I understand, if you turn off caching you aren’t violating their TOS. I’ve been doing this for about 2 years now and have yet to have anything happen. Multiple friends use my Jellyfin server daily.
Procrastination. Want to move may lab off my pi onto my mini PC.
I have done the backup off the pi, just need to restore it but motivation doesn’t line up when the family is out of the house.
I bought some hardware last winter… still sitting in boxes. I do have adhd though
Part of it is I want to shuffle around some stuff, like switch my mobo out on my main pc and use its mobo in the new server
I have proxmox installed on the mini PC with a Debian VM ready to go, just the step of moving everything is the problem.
Ha, that’s my plan as well
Feeling better every day having my stuff under my control and away from prying eyes of trackers and other unsavory stuff.
Thanks for this post, something I miss from earlier selfhosting communities.
I have simply running two SFF Lenovo Thinkcentres—one for all local services and another for all online services. They could run on one but I keep them separate for security and stability reasons. I often crash the local one by running out of space…
I finally got to building a second backup recently which I am happy about.
Honestly, since moving and downsizing from several services at home and at work, this solution works. I run out of space frequently but it forces me to not hoard things I will not actually use. My previous rack server seeded something like 50tb as I kept everything I leached to benefit the community, now less possible.
This has also made me move away from services that are not needed.
-
[ ] I would like to offload all my home videos to an external drive as I am running out of space for actual services and Jellyfin media.
-
[ ] I would like to consolidate all of my local and online databases rather than run a new one for each container stack.
-
A while ago I made my first attempt at setting up a SSO for some of the things I host. I figured out things that have built in support, like Immich, but struggled with getting it done through Proxy for things that don’t have baked in OAuth or OIDC support.
I revisited it yesterday and figured everything out so I’m happy about that. Navidrome was one of the more difficult ones to figure out because I need SSO authentication for the web-ui, but username/password for the API. That was actually pretty easy once I wrapped my head around it.
I picked Authentik based on general positive things I’ve heard about it, and I use Nginx Proxy Manager for reverse proxy.
I’m also on authentik, because of the extensive list of tutorials. I’m also using Navidrome but couldn’t be bothered to set up SSO there since I’m mostly listening via clients
I finally ran a hardware accelerated ML container for immich.
My immich is in a VPS and my GPU is in my home server. Cheaper to run that than to rent GPU compute.
Upgrading one of my powerhouse Dell R410 proxmox nodes to 128GB of smoking hot PC10500 DDR3 ECC Ram from 64.
Now it’s cutting edge.
Last week I had to update everything to make sure that it didn’t fall back on DST because the fucking idjits in my backwoods province decided that they needed to create a new time zone.
Finally took the leap and wiped my NUC to start doing things over. Originally had a family member who works in IT set everything up, but he did the absolute bare minimum and I screwed some stuff up along the way the first time around, so I figured now was as good at time as any to teach myself to set things up from scratch!
I also have moved from Portainer, to Dokploy, to Arcane for docker management, and I actually really like Arcane. I’ve also accomplished something I’m really damn proud of, which is getting HTTPS working on Tailscale (so, for example, arcane.(my subdomain).ts.net but with HTTPS!) alongside Pocket ID for all of it. Maybe it’s just me, but I had trouble finding clear documentation on how to do this, no matter how much I searched. But I documented it for myself, at least. And it’s probably that I lack a lot of knowledge in this field, too.
I have some questions, and although I know there’s a chance this gets buried, I figured I’d try asking anyway. Little skittish about making a thread myself.
My NUC is running Debian 13, and I was wondering some security things. Everything is behind Tailscale and I don’t plan on exposing anything to the internet (even through Tailscale Funnel, I’m using Tailscale Serve for the HTTPS.)
- How valuable is a firewall in this case? I’ve never used one, and I’m wondering if it’ll just make adding services more of a hassle than it’s worth for the security since everything is staying local.
- Similarly, what about Fail2Ban? I have it on my RPi and it’s not a big deal to set up, but I was reading a firewall is more important?
- Is it okay to run unattended updates for security OS stuff on the NUC? I don’t always check updates, admittedly I’m easily distracted and forgetful. I’m a little worried about auto restarting it to finish the updates up just because I utilize a NAS and sometimes it’s annoying to get them to reconnect to each other (even with the fstab edited) when there’s a restart for either of them.
- Thoughts on auto updates on docker containers? I know this is pretty personal preference, but I mostly ask because I’m forgetful and distractable. I know this is kinda my own problem, but I want to know other people’s thoughts if possible.
Thank you for reading my very long update! And any answers to my questions are very appreciated. Hope everyone else is doing well!
F2B/FW: If it’s only available locally/via VPN, I think your threat model is your LAN. People in your wifi or rogue smart home stuff. I think a firewall makes more sense here, but if it’s just 1 machine, you should be fine with ufw or the like. If you have several VMs that are supposed to be separated, the solution would depend on the virtualization software.
Unattended upgrades are way better than none at all, both for system and docker. Of course it depends on how important it is that your services are “always” available and I get the NAS struggle though.
Hey, thank you for the comment!
That makes sense, that I would be tightening security on the LAN. It’s not just one machine, I have a Raspberry Pi 4 as well running a flavor of Debian (and the Synology NAS), so I would assume a firewall on both the Raspberry Pi and my NUC would make sense? I don’t have any VMs that I’m aware of, and I’ve heard of VLANs but don’t know anything about those.
Services don’t always have to be available! It’s just me and my partner who are accessing them, so nothing like a lot of people who need media playback. I’ll have to weigh if it’s worth fighting with the NAS over auto reboots, but I’m leaning towards yes as an experiment. I’ll have to actually look into how to do unattended Debian security updates, though.
I think for that use case, Firewalls on the hosts make sense. VLAN is not a bad idea either, though you’d need a managed switch (hardware) for that.
I am trying to find affordable 2x16Gb ram modules that are just right to run on my asrock J5040 and push my proxmox to more possibilities.
Because my needs for ram are increasing since its not just about have the services availble anymore. I plan to add gitlab and k3s and with the rest of my services the 16GB ram are pretty tight.
Good luck! I’ve been watching auctions for some weeks on ebay when I needed 2x32GB SODIMM some months ago and eventually got a pair for 230€. Fucking expensive but cheaper than most other offers I found.
This is a realy good price nowadays. Even more when it was DDR5. I only need DDR4 but atm its round about 80€ for one. Makes 160€… Fir this old stuff. And it even feels like a good price. Pretty sad somehow xD
Not quite server related, but in the middle of a workday this week, I decided I was done with Windows on my home PC. Installed Zorin OS and things have been going really well. Any issues I’ve had have been really minor and mostly revolve around me being picky about theming.
I haven’t found a native mp3 tagger that makes sense to me yet, so I just installed Mp3tag. I’m open to suggestions on that front.
On the server side, it’s mostly just keeping on. A friend has me considering Home Assistant, I just don’t know if the value is there for me. I need to do some housekeeping today and update and clean up unused containers.
I have opinions about music tagging! I’m picky; I don’t trust any amount of automation to find the exact right release with the right album art I want, so I use GUIs instead of a CLI -
MusicBrainz has Picard, and that’s pretty slick. Also includes a handy renaming tool for keeping files organized. Quod Libet is also worth a look. I’m not as familiar with its feature set, but it’ll run on a toaster.
One day I might try to tackle Beets. Heard lots of good about that as an auto-tagging solution, so maybe check that out, too.
Yeah, same. Earlier this year I thought “Hey, people seem to love auto tagging with MB, Picard, Beets. I should try it.”
But that was short lived. I don’t want release information outside of artists, titles, albums, year. I just have no need for it. I know how to get what I want from mp3tag.
I am looking at using Beets to keep things clean, maybe find missing artwork, and fetch lyrics. But the vital information I’ll keep reviewing.
I haven’t ever gotten comfortable with how Picard works, but I’ll check out QL. Thanks!
