I have just recently started messing with Authentik. And I can confirm OIDC claims and whatnot are an absolute nightmare. I have some experience setting up SAML stuff from my work, but I only do that if our main guy is out and I always struggle with it there too.

Your setup sounds the most like what I am doing now, minus the DMZ. But all of my containers are rootless. I am running everything on TrueNAS right now.

I think I will lean more on Authentik, as the provisioning of users and giving them access to services through that is very easy. I will probably stick with Cloudflare for the time being, but I will look more into Pangolin.

My ISP is charging $20/mo for static IP’s, so almost any other solution would be cheaper.

I hate Oracle with the passion of a thousand suns, so I don’t want to touch them with a 10ft pole. I would happily pay anyone else to avoid using anything affiliated with Oracle.

Thanks for the warning. My Plex server is currently behind a Cloudflare tunnel, so I probably need to look at moving that.

I mistook pangolin for netbird, so thanks for the clarification!

I use NPM internally for SSL. DuckDNS won’t work for me since I am behind CGNAT. I also already own a domain.

I would like to avoid paying for a VPS. I probably should have clarified in my post too that I am specifically looking for advise on securing public facing services. While I certainly could make everyone use a tailscale-like service, at this point I think securing an external service would be easier. Especially since most of these people would not be tech savvy and I don’t particularly want to play tech support for their VPN.

I haven’t looked into Asahi Linux in a while now, but I figured the experience would be pretty good by now. You don’t need to “hack” anything to get it to run. Last I read, there were just a few driver issues, but I haven’t looked into it in probably 2-3 years now.

Apples implementation of SMB has always been abysmal. I’ve been using Mac’s for close to 20 years now, and connecting to SMB shares has always been a pain. IMO, it’s gotten better recently (since they dumped AFP and were forced to work better with SMB). For whatever reason, it has always been slow to connect through Finder. Not sure there has been much progress on that front…

Really makes you wonder what Apple uses internally, because it must not be SMB!

There is an iOS/macOS app called “Pi-hole Remote” that can manage multiple PiHole instances at once. I use that because it will make changes on both instances at once for me.

Other than that, I log in to each device and copy paste.

These contracts do not stipulate reimbursement for lost revenue. The “uptime guarantee” just gets you a partial discount or service refund for the impacted services.

It is on the customer to architect their environment for high availability (use multiple regions or even multiple hyperscalers, depending on the uptime need).

Source: I work at an enterprise that is bound by one of these agreements (although not with AWS).

I’ve tried both Unraid and TrueNAS. While I greatly prefer TrueNAS, Unraid is much easier to set up and get going for beginners. It’s been a while since I’ve set up TrueNAS from scratch, but last I tried, it wasn’t a very beginner friendly experience. If you weren’t already familiar with ZFS, you were in for a pretty difficult time.

I’ve never used your exact setup, but I have had issues with a web server behind a WAF not getting the client IP (all user traffic was shown as the WAF IP). In my case, the WAF was appending the client IP in a header, and I just had to tell web app to use that header as the client IP instead of the actual IP. Again, not sure if this helps since I have never used podman or caddy (this setup was with Wordpress and an Azure Application Gateway) but the same principles might apply.

I previously had a QNAP, and they honestly aren’t much better than Synology. I would definitely go the build your own route. For the OS, I really can’t recommend TrueNAS more. I’ve been using it for years and it is rock solid.

They mention in the post that other apps are coming soon. If they start letting you self host Protect, that will be huge. When they killed off Video, the only way to get their cameras to work was to buy their hardware that could run Protect. I was shocked when they allowed you to use 3rd party cameras in Protect.

What’s the difference between the two? Reading the GitHub for meshcore, it sounds exactly like meshtastic. What makes it better?

I moved all of my Docker containers over to TrueNAS apps recently, and it’s been great so far. Alternatively, I think the best option for keeping your compose files and all that would be to upgrade to 25.04 (Fangtooth). Fangtooth lets you deploy containers using compose YAML. Each app has to be in its own YAML which can be a bit of a pain, but you would fully own everything so no need to worry about another rug pull.

Alternatively, I’ve seen some people just install Dockge and run all of their containers inside of that.

I work for a medium size enterprise as a backup architect. All of our backups are crash consistent and we’ve never had an issue.

Windows has an easy way of dealing with this in the form of VSS. As long as the application supports it, VSS can prepare the system and application for a backup, putting it in an application-consistent state before the snapshot is taken. Unfortunately, there is no equivalent for Linux. The best you can do is pre-freeze and post-thaw scripts to put the application/OS in a backup-ready state. Really though, I wouldn’t worry too much about it. Unless you are running an in-memory database, you really don’t need to worry about application consistency. If you are running an in-memory database, take database level backups (can also be done with pre-freeze/post-thaw scripts) and back up the backups.

Just remember to test whatever solution you end up going with, and make reminders to frequently re-test your backups. You never know what might change in a year’s time, so re-testing periodically is a good way to make sure everything is still functioning properly and make sure your data is still protected. And testing needs to be more than just making sure the VM powers on. Make sure the application can start up and function properly before calling it a successful test.

I have been using TrueNAS for about 3 years now and couldn’t be happier. It can do all of the backup stuff for you as well. I’m not sure if you would be able to use the key server for booting though, but I believe it would check all the other boxes. I don’t currently run VM’s on it (only docker), so not sure what it can do for VM backups.

Regardless of what you end up going with, I’m curious why you are saying you need to shut down the VM to back it up? I’m not familiar with how you are running the VM so not sure if it’s a limitation of the hypervisor, but I would think as long as you can snapshot the disk, you could just back up the snap. It would be crash-consistent rather than application-consistent, but for a backup scenario that should generally be fine.

Yeah, I get it’s unusual and it sucks it happened. I honestly would have been less upset if it was a driver issue or something like that. I at least could have looked at dmesg logs or something to try and figure out what was going on. I’m new to GUI Linux, so I had no idea where to start with this one. I think this was more frustrating than a driver issue or something similar for me because I would expect installing applications from the built in repositories to be something that “just works”.

Hopefully as more people move over to Linux distros, we will get more people that donate to them as well so more dedicated developers can be hired to work on such things. I know it will get there one day, and it’s already so much better from when I last tried gaming on Linux back in the early 2010’s. Hopefully the full release of SteamOS will truly bring about the age of Linux desktop.

I get it. Working in IT and doing this stuff all the time and being surrounded by other technical people really disconnects you from the knowledge of the average user. I’ve worked in IT for over 10 years now, and I am always overestimating how much technical knowledge the average user has. Luckily I don’t have to talk to end users anymore, but even when helping friends and family with things, stuff that I think is common knowledge isn’t common among less tech-savvy people. I still struggle with this, and suspect I will for a very long time.

I’ve heard of Endeavor before as well. May give it a try, but then I feel like I would be one of the distro-hoppers I always see out there. I just crave stability.

I installed Bazzite on my personal gaming PC a few months ago, so I have done more than try it. My AMD drivers would crash on Windows when playing Helldivers about every 30 minutes. I lost count of the number of times I booted into safe mode and ran DDU to uninstall drivers. Haven’t had the issue a single time on Linux. The Bazzite image I’m using on her PC is different than mine since she currently has an NVIDIA GPU. She has an old 1080Ti because Microcenter was out of stock of all GPU’s on the day we went to buy the rest of the parts for her build. Eventually she will get a newer AMD GPU as well and we can be on the same image.