Are your exposed services all on their own ports externally, or behind a reverse proxy?

Putting them behind a reverse proxy makes sure that attackers at least need to know the correct hostname to access your service.

This is security by obscurity which isn’t proper security but it means that all of the port scanners out there likely won’t know your jellyfin server exists when a vulnerability for jellyfin is released.

If you use let’s encrypt or something similar be aware that all issues certs show up in a public log so attackers like to harvest that log as a list of valid domain names. Switch those certs to wildcards so that you aren’t advertising those valid hostnames.

There are often options in reverse proxies, or sometimes your router to do geo based blocking. If you can limit connections to your local country only you eliminate huge portions of the botnets out there.

Combining this with auto updates/reboots on your services is probably enough to keep you safe, but if you want to really secure things a separate DMZ vlan for your services to prevent an attacker from compromising additional services on your LAN.

The more network segmentation you can do the better. An ideal setup is every app/container in its own network/ACL that only allows traffic to the specific network devices that it needs to talk to. This is a lot to manage if you do this with your router/vlans. Containers orchestrators (i.e. k8s) make this easier, but don’t protect you from kernel level exploits to break out of the containers. I believe proxmox has VM level ACLs now so you could skip the vlans and do your segmentation at that level instead.

It certainly isn’t good to depend on it but security by obscurity is your first and probably most important line of defense. When these vulnerabilities come out they need to know your service exists to exploit it.

The best way to do that is to setup a reverse proxy to reject invalid hostnames. A single port is all you need exposed for multiple web services, and the IP scans won’t find the script kiddies anything valuable. Be careful with lets encrypt, there is a public journal of all issued certs, so make sure to get yourself a wildcard cert so that you aren’t advertising your valid hostnames to the world.

Use the reverse proxy to put basic auth in front of your services (if they can handle that). Basic auth is very simple, no web forms to attack, just a single header. If your php site is vulnerable they won’t ever be able to even attempt to reach it without a valid username/password.

I’ve got a mix of containers and VMs behind that reverse proxy. The containers have network security groups around them limiting network access. The VMs are in a Harvester hypervisor with KubeOVN for software defined networking. That means each VM is in its own subnet with network security groups around the subnet preventing any unnecessary network access.

For machines/containers that need Internet access I have a Squid proxy with an explicit whitelist of allowed URLs so that the machines can’t reach out to unauthorized sites to download their malware or contact command and control nodes.

Unattended updates for the VMs, and FluxCD keeping helm charts up to date hourly for the containers. For my own containers, weekly scheduled container rebuilds.

I do have one public website that I host for a friend (indexed by search engines so the sites name is known to the world). My friend had originally deployed that as a WordPress site, but WordPress/PHP don’t have the best security track record so I was concerned about that. The site was pretty simple so I recreated it as 100% static content, so now the attack surface is just a nginx container with a read-only filesystem.

Wireless display is too laggy? Steam Link is how half of the people using the frame are playing games in the first place. Not having the dongle doing the transmitting might add a couple of ms of delay due to the second hop, but there are many people who have been gaming with steam link for years.

I’ve bought about 16 drives from goharddrive (through eBay). Most of them 5+ years ago without any failures. So I can’t say how well they honor their warranty, but they have been around for some time so that is probably a good sign.

If you are running your power supply near its limit I have seen that cause drive drops as well. If you continue to see drives drop that seem to be functional and cables/HBA don’t seem to be the cause, you might want to swap/upgrade power supplies if you can.

I assume it is fake, but basically these US companies spent billions making proprietary models to make money and the Chinese came along and made models that are just as/nearly as good, and made them open for anyone to use.

They are also charging less to use them. Third parties that provide AI access can run them on their own hardware without expensive licensing fees so again they are some of the cheapest models to run for their capabilities.

The US companies thought it was a race to the top. First one to hit AGI would get mega rich eliminating jobs across the globe. Turns out AGI isn’t here yet, and it costs so much to run that no one is paying for it anyways.

The Chinese know this is a race to the bottom. The models will get better, and the hardware more capable, so focusing on compute capacity and keeping costs low is the important part.

If the Chinese keep up, or at least nearly keep up with a considerably lower cost, then the US AI companies can’t make their money back (they aren’t anywhere near profitable) and go broke.

This would be more of a use case for blockchain, any site(/user) wishing to mirror the social media would participate in the chain. A post on one site would get pushed into the chain and show up on every mirror.

Media would likely have to be links outside of the blockchain since it isn’t usually very good at storing large datasets (it would make it difficult to mirror over time as it grew), so if you wanted a full mirror you would probably have your site fetching media as soon as it is posted and mirroring it yourself.

Or media might be a good spot to integrate with your bittorrent idea. Blockchain handles the distributed state of the site (communities/post text+metadata), and any submitted media is added to the post as bittorrent hashes. I don’t know how scalable bittorrent clients are though it might take considerable overhead to seed millions of pictures/videos.

https://www.linuxatemyram.com/

This is normal. Linux caches disk reads so that you don’t have to go to her/SSD to reread blocks. If your app isn’t using the ram Linux will use it instead.

Zero reason to be concerned, because if your app allocates more memory Linux will evict the cached pages to make sure your apps have plenty of space.

In this case your apps have memory that isn’t being touched (sometimes a sign of a memory leak), and Linux has decided that caching your disk access is more advantageous than keeping the unused application memory in ram.

If you have apps that you don’t use often and are really slow to access when you finally do, keep lowering that swappiness value or just remove swap all together if it annoys you.

Looking at your graph you have a lot of ram that you don’t really need… I would just disable swap entirely. Otherwise you are just wasting write cycles on your SSD.

Btrfs raid5/6 support is unstable/experimental and cause some serious issues in the past, so it isn’t really recommended.

Since you only have 4 drives you could do a pair of mirrors with btrfs, but you aren’t guaranteed to be able to handle two drives failing (depends on which two drives fail). So zfs with raidz2 is the best protection you can get, and it matches the capacity you would get from mirrors.

Rebuild time isn’t great, but you would need a second drive to fail plus at least a read failure on another drive before you have issues.

A bigger question would be how soon would you have a replacement? If you already have a spare on hand I wouldn’t worry about rebuild time at all, but if you are expecting to wait potentially weeks for a warranty replacement your chances of the second failure go up.

Even if you had a second failure and additional read failure is unlikely (how often do you see read failures when you run a scrub). Combine that with your backups… You should have very little to worry about.

If two drives failed and you ran into a couple of sectors that can’t be read ZFS continues to operate just fine, except for the failed file. The file with the failed blocks shows up in zpool status so you know exactly where the corruption is, and you can just copy that single file from your backups and everything is back to normal.

If your files are mostly WORM files like media/documents then your backups cover you really well and copying a file or two from backups isn’t a concern. Vs if you are running virtual machines or DBs that are writing to their virtual disk constantly then you would start to worry about how much data you lose by rolling that file back to your past backup.

Well that would be the description of the community, but the actual rules section doesn’t say anything about privacy/control.

So at the end of the day Plex is self hosted (you run most of it) so it should qualify. It might not 100% match the spirit of self hosting it does still meet the definition.

You can argue most Jellyfin/emby installs have the same problem because most users are still are dependent on external services because of things like metadata plugins.

And on the privacy front those plugins aren’t any better than Plex. For instance The Movie DB which is the primary movie and TV metadata provider for Jellyfin has a privacy policy that clearly says they will use and share any interaction you have with the site including location and personal information. They almost certainly keep track of what is in your library. They don’t have a user account for you that they can use to track across IPs, but if your ISP keeps you on the same IP for long periods of time they have a good idea of what you are watching.

You can run Jellyfin without those plugins enabled but unless you want to build/collect manual nfo files to import that data you are going to have a subpar experience.

Same problem for the **arr stack since they need metadata as well. Some of which go to different providers so you are giving out that information to additional parties (i.e. Sonarr goes to TheTVDB which has a similar privacy policy).

You can configure the arrs to write out nfo metadata and have Jellyfin consume that so that at least you aren’t giving away your info to two external parties.

Well they did try to schedule delivery and apparently UPS wouldn’t let them do that, but yeah certainly not anything to do with Valve.

If this were pre-covid UPS likely wouldn’t have left a note and reattempted delivery the next day. But all of the shippers took the COVID no-contact rules to mean that they could just leave packages at the door, snap a pic, and be done with it. Saves them a huge amount on redelivery attempts, and they get to pass the blame on to their customers for not being there.

UPS asking you to open a case with Valve is normal. You didn’t pay to ship it, Valve did. Even if it is a line item on your invoice it was a contract between Valve and UPS, so you can’t call up UPS demanding investigation/money because it is Valve that gets the money not you (who in turn refunds it to you).

If Valve gives you the money back they are likely taking a loss on it to keep you happy. As far as UPS is concerned they delivered it (presumably with photographic evidence), so why would they pay up on insurance. Unless Valve pays for the higher level of insurance UPS won’t cover for porch pirates.

It is unlikely that Valve paid to have that level of coverage, but that is because they know only a small number of packages will be stolen. It ends up being cheaper to just give a few refunds than it is to pay for the higher level coverage on thousands of packages.

Hopefully that is the case on how Valve handles this and you get a replacement or at least your money back. Good luck!