To be fair, if something is open by default or very easy to enable without informing about the risks, tons of people will have it exposed without thinking.
It isn’t that “tons of people do it so it is normal and perfectly fine” but more “people don’t realize.” It also uses some nontrivial amount of resources to process and block those attempts, even if they never have a chance of getting in.
There is yet a reason I can find to have it forwarded for home use. Need to ssh into a machine to fix it? VPN.
There are plenty of secure web-based tools to manage your server without a VPN also.
Does inkscape have diagram connecting? One of the best draw.io features is the wide array of premade shapes, styles, and auto connecting for flow visualization
You want a prebuilt NUC. That is pretty much it. A Pi generally doesn’t cut it, plus by the time you get all the accessories to make it usable as a server, you are at the price of a much more powerful small PC.
I run a ryzen 3600 with 32GB RAM in a Node 304 and it is very quiet with 12TB red pro helium drives. 4 HDD capable with a GPU and 6 without. However, it still draws 20-30W idle or 50W with an Arc A380 installed.
There is one neat trick: don’t expose SSH.
There is still not a reason anyone has been able to give for 99% of self-hosters to expose SSH.
If you need to access your machine via ssh while on the go. Wireguard to your local network, use SSH. Done. Unless you are running an always-up public facing site, the amount of times you have to access your machine that can’t wait until after work is very low anyway.
Bots will scan all ports. That is just how it works. Less than 22, but you will still get spammed. Why force your computer to go through the fail2ban loop and take up resources when it is simply not needed at all and you can block it on another machine?
If you want to build it yourself, you have to decide on size.
Are you trying to keep it as small as possible?
Do you want a dedicated GPU for multiple jellyfin streams? (Definitely get the Intel A380, cheap and an encoding beast)
If you don’t want to start a rack and don’t want to go with a prebuilt NUC, there are 2 PC cases I would recommend.
Node 304 and Node 804.
Node 304 is mini-ITX (1 PCIe slot, 1 M.2 slot for boot OS, 4 HDDs, SFX-L PSU, and great cooling)
Node 804 is micro-ATX (2 PCIe slots, 2 M.2 slots, 8-10 HDDs, ATX PSU, and 2 chambers for the HDDs to stay cool)
Why do you want a N100? Is electricity very expensive where you are that idle power is a big factor? Because desktop CPUs are more powerful and the CPUs can idle down to 10W or so without a GPU and they can have way more RAM.
Tldr; go with prebuilt NUC or go with a desktop CPU for a custom build.
At that point, you might as well get Mealie.
Then use Wireguard to get into your local network. Simple as. All security risks that don’t need to be accessed by the public (document servers, ssh, internal tools, etc…) can be accessed via VPN while the port forwarded servers are behind a reverse proxy, TLS, and an authentication layer like Authelia/authentik for things that only a small group needs to access.
Sorry, but there is 1 case in 10000 where a home user would have to have publicly exposed SSH and 9999 cases of 10000 where it is not needed at all and would only be done out of laziness or lack of knowledge of options.
I love the absurdity of game reviewers 😂
“This game is the pinnicle of its genre”
“This is the 1 game I would bring to a desert island”
“one of the most captivating puzzle games ever”
85%, 88%, 70%, a C to a B. That is just above average.
Meanwhile you get an absolute broken AAA piece of crap that barely functions, incoherant story, generic and boring and those same reviewers say “70-80%”. So there is a <10% difference between absolutely mastering a genre and releasing straight garbage?
I got in one private tracker and I like that system a lot. I seed my torrents for years because I don’t do a ton of very popular stuff, and I like some older shows. Like The Mentalist season packs on TG are at like a 30:1 for me because not many others seed them.
However, the private tracker doesn’t use standard naming which sometimes fucks up searches and *arr, also, there are barely any seeders or leechers so a lot of media is hit or miss both downloading and uploading. Of the 50 or so things that I downloaded since I got on, 1 has a positive seed ratio, so thank mods for duration seed points…
Definitely Red plus. They are quiet as hell and 12TB+ are helium filled.
Just got a 12TB a while ago and it is as quiet as my 4TB drives.
But for OP, just use software raid instead of hardware raid. There is very little point for homelabbers using hardware raid at this point without an existing setup.
Why not just spin up Syncthing, sync your music between your phone and server, and then use one of the countless good local music players.
You own the music anyway, you have a limited library, and there is 0 delay having your music locally along with no buffering, offline access, and it will always be at max quality.
(Of course, not realistic if you have 500GB of music and no SD card slot in your phone)
I have an ITX Ryzen 2700X with an arc A380. 3 HDDs and 1 SSD boot drive.
Before some kernel improvements for the A380, my idle wattage was 60W. Without the A380 it was around 35W idle. I am hoping that it is around 45W now because of fixing the high idle wattage of the GPU but I have to measure again.
Performance is great though. Perfect Jellyfin streaming, home automation, document and media management, file sync, recipe management, etc…
People tend to over-spec their servers, in my opinion. Unless you are dealing with more than a few dozen clients or so on one server (or having a many-user dedicated streaming server), you really don’t need much.
Are you absolutely sure that you have the i915 firmware installed and enabled?
If you have gone through these steps of adding the modules: https://jellyfin.org/docs/general/administration/hardware-acceleration/intel/#low-power-encoding
and it doesn’t work, you may have to manually download the git linux firmware library, extract the i915 folder and place it in your firmware folder.
That is how I got jellyfin working on my A380 after pulling my hair out about it.
Please check and post your dmesg starting up.
You should see GUC and HUC enabling.
What is Futo? Their website says absolutely nothing besides their “company values.”
What is their business model?
Who is running it?
How do they earn money to give out?
What do they ask in return besides hoarding the trademarks?
Flat fee is always good, but I am always skeptical about these sort of completely opaque, altruistic companies that often turn into not-so-altruistic companies after they see more profit capabilities.
https://www.tomshardware.com/reviews/intel-arc-a380-review/5
Blows the 6950XT and 3090 out of the water in transcoding performance. I would say that is performing very well. That was before drivers have gotten much much better too probably a bigger difference now.
I have one, it is fantastic.
Someone said that it is “not terribly performent” but it doesn’t matter for transcoding. It can do multiple 4k streams of AV1 & HEVC. That is perfect.
According to benchmarks, it beat the 3080 and 6800XT when it was released for transcoding performance. That is what you have to look at in this case, you aren’t gaming on it.
Just remember to enable all of the correct kernel modules to get it working. You often have to manually download the firmware git repo and move it to the firmware folder in Debian to get it working.
Compatibility and storage.
Do you want only 2 devices of the 10 your family possibly owns to work?
Do you want your family to complain that jellyfin “isn’t as good as Netflix/Disney+/etc…” Because it constantly stops to buffer and a can’t keep up the framerate?
It is completely fine if you are single and have 1-2 devices that work with AV1 and h.265 client side and that is all you need, then you don’t have to bother with transcoding at all. When you start letting other people into it, compatibility becomes an issue.
As for storing it beforehand, the entire point of AV1 and HEVC is to significantly reduce the size on disk. If you have to store 10 versions or each file, 5 resolutions each, half h.264, then you are taking up about 20x the space per file compared to 1 copy of HEVC or AV1.
A transcode GPU like the A380 or new QSV compatible CPU is MUCH cheaper than a new good quality 12TB drive lol
Sorry for the long text, it pretty much depends on the living situation.
As someone who doesn’t live in the US:
The data from google and facebook is hoarded by a foreign nation (the US is basically a quasi-democratic plutocracy which also has extremely extensive surveillance both legally and agencies caught working in grey areas) to boost surveillance and that is pretty blatant about their espionage and political propaganda. We get US political right wing propaganda on these platforms all over the rest of the world.
There is a difference of course, but the gap is closing significantly every few years.
Mealie is absolutely the best
Home Assistant integration
SSO through OIDC (though mine is broken and I need to file a bug)
meal planning functionality with shopping checklists
equipment checklists
advanced grouping through tagging, cookbooks, and categories. Everything can be beautifully sorted
then the holy grail: recipe parsing through URL. I haven’t found recipe parsing this good since the discontinued ChefTap app
Yeah, for that threat model, a VLAN is not needed in my opinion:
esphome devices are for sure not data collecting and pihole will block most of the phone homes with a good block list, where possible (like simple smart devices) they are flashed with a local open source version. Still the vast majority are KNX and Zwave which are local only
video cameras are local-only always and have completely blocked internet access via the router
This is probably the biggest threat unpreventable in other ways. Though definitely citation needed for them actually being caught recording conversations lol. People think phones do that too, but it is simply a lot easier (and more importantly, cheaper with a much higher ROI) to make a complete data picture through search/watch history + proximity to other devices.
If you are looking for user management and registration, then Authelia is the wrong software for you.
Authelia is a very light weight security layer (and more recently SSO) that is only meant for few users precisely because it doesn’t have an onboarding process, dynamic access control, and more advanced features. Everything is done through config files and secrets. The admin has to manually create a file or plaintext lines with the user and password for each new user and restart the container.
Authentik is what you want if you want a bunch of users and new user sign up.
As for bitwarden/SSO, they should be fully separate. Otherwise you will likely break Bitwarden app and browser integration functionality.
You also do not want to run into the case where you don’t know your SSO password so you can’t get into bitwarden to find the password and you are screwed.
Bitwarden, TOTP method, and SSO should ideally be separate and you should be able to access your passwords and TOTP without requiring any password that is exclusively in the Bitwarden database.
But piracy is a product of their free market, don’t they want their mythical free market to be a free market?
Or maybe that was always just bullshit and they rely on using their money to suppress competition while they deliver a terrible, inferior product.