All of this user’s content is licensed under CC BY 4.0.

  • 8 Posts
  • 69 Comments
Joined 1Y ago
cake
Cake day: Oct 20, 2023

help-circle
rss

“Despises O’Toole”? Did I just get transported back in time 4 years?


From what I recall, this sort of stuff is usually kept as a closely guarded secret by those who do it. Perhaps someone else more knowledgeable about the practice could give some more insight.


All of the services that I host are for private use:

  • Nextcloud
  • FreshRSS
  • Immich
  • Jellyfin
  • RSSBridge

And they are all behind Caddy, which reverse proxies and handles HTTPS. I’m not sure if it really counts as self-hosting, but I also use my server as a host for my backups with Borg. I also use it as a sort of central syncing point for Syncthing.

I did have a Pi-Hole at one point, but I kept running into issues with it — I may look into it again in the future.

At some point I’d like to try implementing some ideas that I’ve had for Homeassistant (a camera server with Frigate and some other automation things). Once federation has been implemented, I would like to host a Forgejo instance. I may also host a Simplex relay server, depending on how the app progresses. I’ve been considering hosting a Matrix instance, but I’m not sure yet.


Are you looking for something for a headless server or something for a system with a GUI (eg a desktop)?


It entirely depends on how you want your homelab to work. I use a reverse proxy to set up subdomains for my publicly facing services because I find it easier and cleaner to assign a subdomain to each service, and I also like having HTTPS managed by a single point — a sort of single point of entry to the rest of the services. You’d have to decide what you want out of your homelab, and find and set up the services that yield the outcome that you want.


Ha, I didn’t notice that in the thumbnail. Very interesting indeed, if it is a 22 degree halo!



Five Guys have better service that is free

It wasn’t free — they were charging money for it:

Jetflicks, which charged $9.99 per month for the streaming service



Cross-posted to https://sh.itjust.works/post/21102275 --- - [source](https://www.castlegarnews.com/community/castlegar-opens-canadas-tallest-castle-play-structure-7387997) ([archive](https://web.archive.org/web/20240614215941/https://www.castlegarnews.com/community/castlegar-opens-canadas-tallest-castle-play-structure-7387997)) - "Castlegar opens Canada's tallest castle play structure". Chelsea Novak. Castlegar News. 2024-06-14T13:00. https://www.castlegarnews.com/community/castlegar-opens-canadas-tallest-castle-play-structure-7387997. --- [Here](https://www.google.ca/maps/@49.3242955,-117.6528262,3a,75y,111.28h,94.8t/data=!3m6!1e1!3m4!1sy_02nHtGhm0N8h0YKntilQ!2e0!7i13312!8i6656) is a before on Google Street View, and [here](https://www.google.ca/maps/@49.324246,-117.6529569,3a,75y,115.49h,88.2t/data=!3m6!1e1!3m4!1sYdu0ovE0rmPDmLQ8qu0xhg!2e0!7i16384!8i8192) is an after (while under construction).
fedilink

The Supreme Court of Canada will not review a Québec ruling that bars Canadians from suing the U.S. Government over it’s involvement in Project MKUltra
- "Supreme Court won't hear appeal in Montreal MK-ULTRA brainwashing case". The Canadian Press. 2024-05-30T16:39Z. CBC News (https://www.cbc.ca/news/canada/montreal/mk-ultra-supreme-court-of-canada-class-action-1.7219478). - [Archive Link](https://web.archive.org/web/20240530201302/https://www.cbc.ca/news/canada/montreal/mk-ultra-supreme-court-of-canada-class-action-1.7219478)
fedilink

I’ll preface this by saying that, imo, these sorts of views are the complete wrong type of mindset to have for governing a region that is known for it’s diverse and beautiful natural features and ecosystems.

“What are we going to do if we have 30 per cent less food production?

This is a pretty weak argument considering that food production accounts for a very small portion of B.C.'s total land ­— specifically 4.9% of B.C. is within the ALR [source], so to say that 30% of that is going to be taken away seems like quite a stretch. On top of that, most food production in B.C. is in a relatively compact portion of B.C.'s southern regions [source].

What are we going to do if we’re going to have 30 per cent less forestry production?

Less than 0.3% of B.C.'s land is actively logged at any given time [source], on top of that, only 26% of B.C. land (42% of forests) is available for logging [source], so, again, to assume that it would cause B.C. to loose 30% of it’s logging production is a stretch.


Why do you constantly ask questions without adding anything to the conversation?

That’s a loaded question; I disagree with the premise — I feel that I have provided useful information and context. You, however, have not provided anything but seemingly non-constructive and condescending content for your past 3 comments [1][2][3] in this thread.


The title is certainly classic clickbait — disingenuous and sensationalist. It also doesn’t really match the content of the video, imo.


So what were we talking about before you started trying to derail this conversation with endless questions?

Is that rhetorical? I don’t understand the purpose of your seemingly condescending question.


I think I may have misinterpereted your argument. When you said

It seems most the problems you’re talking about are global problems though.

Where do you think you’ll have a better quality of life? [source]

were you arguing that most countries have the same problems as Canada, so to immigrate elswhere would be futile? I was under the presumption that you were arguing that Canada can’t do anything to fix it’s issues, and that it would instead require some global collaborative effort.


I would guess that it is extremely difficult to quantify how much of an effect the tax has had on the housing market. Anything beyond a guess, however, would be outside of my qualifications — I would defer to those who have looked into this more appropriately. After a very quick, and cursory websearch, I found a paper that stated the following:

From the empirical analysis of overall market, we cannot detect the significant effect of Speculation and Vacancy Tax on the price of housing property in Vancouver after the implementation. Only the parameters of GDP of real estate growth and unemployment rate are reexamined to be statistically significant. We could observe the decrease of housing price in Vancouver from the price chart after the tax policy entered into force. The decrease is also reflected by the negative coefficient of City*Time although it is not significant. […] Focusing on a specific region’s housing price, we still cannot detect that British Columbia’s Speculation and Vacancy Tax has significantly impact on the housing price of Vancouver West compared to Toronto Central. All the other factors mentioned by other researches are not statistically significant neither. [source (archive)]


The original comment that I responded to was about inflation, food costs and housing costs.

Those are all global problems.

How would you argue that they are global problems? (please don’t interperet that as condescending, or accusatory — I am simply curious. It is hard to convey emotion through text)


My child will have to take out loans for like x10 that amount and it will destroy her future before it even begins.

It depends on where one goes — not all post secondary institutions charge the same amounts. Generally, the fancier/more reputable schools will charge the most. It is quite possible to complete undergrad in Canada for <30k CAD (not including living and transportation expenses). Also, keep in mind that inflation is innevitable — the Government of Canada targets an inflation rate of 2% per year [source].


Empty houses in the Metro Vancouver area have certinaly been an issue [source]. The B.C. Speculation and Vacancy Tax was implemented to discourage this behaviour [source]. Theoretically, it should also capture the negative impact that vacant housing has on society and the economy.


Is empty housing a prevelant problem across Canada? I was under the impression that it was really only a problem in Metro Vancouver. Furthermore, B.C. has a vacancy tax [source], which should capture the negative societal and economic impact generated by empty housing .


It seems most the problems you’re talking about are global problems though.

Which problems that they mentioned do you think are global, and why?


food prices are through the roof because we’re being robbed

Would you mind clarifying what you mean by this?

Higher education is unaffordable to anyone without wealthy parents

Based on what are you making this claim? The Canadian Government and the provincial governments provide loans and financial support to students, which should be able to cover all expenses for an average post secondary institution [source] [source]. Furthermore, the Canadian government provides extra support for Indigenous Peoples [source].


reflect on how bad you colonized and fucked up my continent

By “my continent”, I presume that you are referring to the idea that the indigenous peoples were the first ones to arrive in North America, and, by extension, you apply the first possession principle? Also, for clarity, what exactly does “my continent” refer to, in terms of lands?


I see no citations in the video description and I’m not too interested in listening to their argument if they can’t provide those citations up front.

Yeah, I agree that this is annoying, but, to be fair to the video, there are citiations within the video itself in the bottom right corner. I have no proof if they are provided for every claim, however.

The only measure they seem to be appealing to in order to support their claim that “no one wants to live in Canada” is that Canada has lowered in happiness index.

Aha, I would be very hesitant to justify clickbait, but, that being said, did the creator refer to that thesis within the video itself (I’m not disagreeing with you, necessarily — I could simply have missed something in the video)? One other claim that may be in line with that thesis is at 12:38 when they mention that, each year, Canada loses 0.7% (in the video, they misquote this figure as 7%, but, to be fair, the document that they were citing wrote the value as “.7%” which, arguably, could be easily misread) of its population to brain drain.


I would argue that it’s due to people not making the distinction between the government policies that attract immigrants, and the immigrants themselves. The immigrants are simply pawns in the greater game, and they are therefore used as a scapegoat to detract from the government’s own failings.


Out of curiosity, what content in the video do you specifically disagree with?


so might run into more roadblocks with its use.

This has been my experience with Podman. That’s not to say that these roablocks aren’t without reason, nor merit, but there is always a trade off of convenience when optimizing for security.


Podman is […] “better” because it doesn’t run as root, but other than that I don’t know of any advantages to it that are not a derivation of “it runs as a regular user”.

Podman can run in rootless mode (with some caveats), but it is still able to run as root — it doesn’t only have the capability to run as a “regular user”.


I am curious what kind of performance you’re seeing for DNS requests considering how old and anemic the first gen Pi is

I haven’t done any rigorous tests to gather empirical data for an accurate comparison, but, annectdotally, it, at least, doesn’t feel any slower than when I had my router (Linksys E8450) resolving to Cloudflare.


I could be misunderstanding your comment, but you don’t seem to have answered my question of why I don’t see my rules anymore.


Now that it is up and running, do you think it’s is a good service?

That’s a good question. The service itself is well made — it functions as advertised, it has satisfactorily intuitive UX, a sizeable community, and a good amount of documentation. I’m not sure, yet, if it’s a service that I personally need — I set it up mostly for the benefit of others.

While you may not like the setup

The main pain points were the sparse, vague, and misleading documentation that I encountered — I understand that documentation is difficult, but for a company like Raspberry Pi, my standards, and expecations are quite a bit higher. I probably won’t use Podman anymore, as I don’t find its setup overly user friendly, currently, as compared to something like docker. I had never used Podman before, and I was considering switching my existing services over to it, so this was sort of meant to be a trial run on something with little impact. I will keep an eye on Podman, but I will stick with Docker for the time being.

do you enjoy the results?

I personally don’t notice its effects as much, but I do like what I’m seeing for others. It has also made me aware of some other issues that I’ll have to look into, so that is good.


It’s a raspberry pi 1. Those things have 256mb of RAM

The exact model that I am using, which I referenced in my post, actually has 512MB of RAM.


Given the extremely limited resources: why bother with containers?

While, from what I can see, containers virtually don’t add any resource overhead, it’s honestly moreso that I favor consistency. Containerization is well documented, it is well supported, and its behaviour (if one is familiar with the platform) tends to be more predictable than running a service natively.


My experience setting up Pihole with Podman on a Raspberry Pi 1 Model B rev 2.0
I thought I'd share my experience doing this, as it was quite a pain, and maybe this will help someone else. It contains the process I took to set it all up, and the workarounds, and solutions that I found along the way. 1. Hardware that I used: [Raspberry Pi 1 Model B rev 2.0](https://web.archive.org/web/20230923000322/https://www.pololu.com/product/2750), [SanDisk Ultra SD Card (32GB)](https://web.archive.org/web/20231026234811/https://www.westerndigital.com/en-ca/products/memory-cards/sandisk-ultra-uhs-i-sd?sku=SDSDUN4-032G-GN6IN). 2. I had issues using the [Raspberry Pi Imager](https://github.com/raspberrypi/rpi-imager) (v1.8.5, Flatpak): It initially flashed pretty quickly, but the verification process was taking an unreasonably long time — I waited ~30mins before giving up, and cancelling it; so, I ended up manually fashing the image to the SD card: 1. I connected the SD card to a computer (running Arch Linux). 2. I located what device corresponded to it by running `lsblk` (`/dev/sdd`, in my case). 3. I downloaded the image from [here](https://www.raspberrypi.com/software/operating-systems/). I specifically chose the "Raspberry Pi OS Lite" option, as it was 32-bit, it had Debian Bookworm, which was the version needed for `podman-compose` (as seen [here](https://packages.debian.org/search?suite=all&searchon=names&keywords=podman-compose)), and it lacked a desktop environment, which I wanted, as I was running it headless. 4. I then flashed the image to the SD card with `dd if=<downloaded-raspbian-image> of=<drive-device> BS=50M status=progress` - `<downloaded-raspbian-image>` is the path to the file downloaded from step 3. - `<drive-device>` is the device that corresponds to the SD card, as found in step 2.2. - `BS=50M` I found that 50M is an adequately sized buffer size. I tested some from 1M to 100M. - `status=progress` is a neat option that shows you the live status of the command's execution (write speed, how much has been written, etc.). 3. I enabled SSH for headless access. This was rather poorly documented (which was a theme for this install). 1. To enable SSH, as noted [here](https://web.archive.org/web/20240101104715/https://www.raspberrypi.com/documentation/computers/configuration.html#remote-access), one must put an empty file named `ssh` at the "root of the SD card". This is, unfortunately, rather misleading. What one must actually do is put that file in the root of the *boot partition*. That is not to say the directory `/boot` contained in the root partition, `rootfs`, but, instead, it must be placed within the boot partition, `bootfs` (`bootfs`, and `rootfs` are the two partitions written to the SD card whe you flash the downloaded image). So the proper path would be `<bootfs>/ssh`. I simply mounted `bootfs` within my file manager, but, without that, I would have had to manually locate which partition corresponded to that, and mount it manually to be able to create the file. The ownership of the file didn't seem to matter — it was owned by my user, rather than root (as was every other file in that directory, it seemed). 2. One must then enable password authentication in the SSH daemon, otherwise one won't be able to connect via SSH using a password (I don't understand why this is not the default): 1. Edit `<bootfs>/etc/ssh/sshd_config` 2. Set `PasswordAuthentication yes` (I just found the line that contained `PasswordAuthentication`, uncommented the line, and set it to `yes`). 4. I changed the hostname by editing `<rootfs>/etc/hostname` and replacing it with one that I wanted. 5. I created a user (the user is given sudo priveleges automatically) 1. Create a file at `<bootfs>/userconf.txt` — that is, create a file named `userconf.txt` in the `bootfs` partition (again, poorly documented [here](https://web.archive.org/web/20240101104715/https://www.raspberrypi.com/documentation/computers/configuration.html#configuring-a-user)). 2. As mentioned in that documentation, add a single line in that file of the format `<username>:<password>, where - `<username>` is the chosen username for the user. - `<password>` is the salted hash of your chosen password, which is generated by running `openssl passwd -6` and following its prompts. 6. Plug the SD card into the Pi, plug in power, and wait for it to boot. This is an old Pi, so it takes a good minute to boot fully and become available. You can ping it with `ping <hostname>.local` to see when it comes online (where `<hostname>` is yor chosen hostname). 7. SSH into the Pi with `ssh <username>@<hostname>.local` (You'll of course need mDNS, like Avahi, setup on your device running SSH). 8. Make sure that everything is updated on the Pi with `sudo apt update && sudo apt upgrade` 9. Install Podman with `sudo apt install podman` (the socket gets automatically started by `apt`). 10. Install Podman Compose with `sudo apt install podman-compose`. 11. Create the compose file `compose.yaml`. Written using [the official](https://github.com/pi-hole/docker-pi-hole) as reference, it contains the following: ```yaml version: "3" services: pihole: container_name: pihole image: docker.io/pihole/pihole:latest ports: - "<host-ip>:53:53/tcp" - "<host-ip>:53:53/udp" - "80:80/tcp" environment: TZ: '<your-tz-timezone>' volumes: - './etc-pihole:/etc/pihole' - './etc-dnsmasq.d:/etc/dnsmasq.d' ``` - `<host-ip>` is the ip of the device running the container. The reason for why this is needed can be found in the solution of [this post](https://web.archive.org/web/20240315031012/https://sh.itjust.works/post/16201887). - `<your-tz-timezone>` is your timezone as listed [here](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones). - For the line that contains `image: docker.io/pihole/pihole:latest`, `docker.io` [is necessary](https://stackoverflow.com/questions/69162077/podman-pull-official-images-from-docker-hub), as Podman does not default to using [hub.docker.com](https://hub.docker.com/). - Note that there isn't a `restart: unless-stopped` policy. Apparently, [podman-compose currently doesn't support restart policies](https://github.com/containers/podman-compose/issues/91). One would have to create a Systemd service (which I personally think is quite ugly to expect of a user) to be able to restart the service at boot. 12. (NOTE: if you wan't to skip step 13, run this command as sudo) Pull the image with `podman-compose --podman-pull-args="--arch=arm/v6" pull` - `--podman-pull-args="--arch=arm/v6"` is necessary as `podman-compose` [doesn't currently support specifying the `platform` in the compose file](https://github.com/containers/podman-compose/issues/551). - Specifying the architecture itself is required as, from what I've found, Podman appears to have a bug where it doesn't properly recognize the platform of this Pi, so you have to manually specify which architecture that it is i.e. `armv6` (you can see this architecture mentioned [here](https://hub.docker.com/r/pihole/pihole/tags) under "latest"). - This took a little while on my Pi. The download rate was well below my normal download rate, so I assume the single threaded CPU is just being too bogged down to handle a high download rate. - Don't be concerned if it stays at the "Copying blob..." phase for a while. This CPU is seriously slow. 13. Allow podman to use ports below 1024, so that it can run rootless: - Edit `/etc/sysctl.conf`, and add the line `net.ipv4.ip_unprivileged_port_start=53`. This allows all non-priveleged users to access ports >=53. Not great, but [it's what's currently needed](https://github.com/containers/podman/blob/main/rootless.md). You can avoid this step by running step 12, and 14 as sudo. - Apply this with `sysctl -p` 14. (NOTE: if you wan't to skip step 13, run this command as sudo) Start the container with `podman-compose up -d`. - It will take a while to start. Again, this Pi is slow. - Don't worry if `podman-compose ps` shows that the container is "unhealthy". This should go away after about a minute, or so. I think it's just in that state while it starts up. 15. Access the Pihole's admin panel in a browser at `http://<host-ip>/admin`. - The password is found in the logs. You can find it with `podman-compose logs | grep random`. The password is randomly generated everytime the container starts. If you want to set your own password, then you have to specify it in the compose file as mentioned [here](https://github.com/pi-hole/docker-pi-hole).
fedilink






You can always do what I do, and just blow up the install and start fresh.

This may be what I’ll have to do. I just don’t understand what’s going wrong here. It’s so strange.


Yup. I ran # nc -u -l 0.0.0.0 53 to listen on port 53. Then I ran # drill @127.0.0.1 53 archlinux.org in another shell. I saw the request in the listening shell.


[SOLVED] Podman won’t start Pihole with an error saying that it can’t bind to port 53, as it is already in use, but nothing is using port 53.
## Solution It was found ([here](https://github.com/containers/podman/issues/19108#issuecomment-1619920541), and [here](https://github.com/containers/podman/issues/19523)) that Podman uses its own DNS server, `aardvark-dns` which is bound to port 53 (this explains why I was able to bind to 53 with `nc` on the host while the container would still fail). So the solution is to bridge the network for that port. So, in the compose file, the ports section would become: ```yaml ports: - "<host-ip>:53:53/tcp" - "<host-ip>:53:53/udp" - "80:80/tcp" ``` where `<host-ip>` is the ip of the machine running the container — e.g. `192.168.1.141`. --- ## Original Post I so desperately want to bash my head into a hard surface. I cannot figure out what is causing this issue. The full error is as follows: ```txt Error: cannot listen on the UDP port: listen udp4 :53: bind: address already in use ``` This is my compose file: ```yaml version: "3" services: pihole: container_name: pihole image: docker.io/pihole/pihole:latest ports: - "53:53/tcp" - "53:53/udp" - "80:80/tcp" environment: TZ: '<redacted>' volumes: - './etc-pihole:/etc/pihole' - './etc-dnsmasq.d:/etc/dnsmasq.d' restart: unless-stopped ``` and the result of `# ss -tulpn`: ```txt Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port Process udp UNCONN 0 0 [fe80::e877:8420:5869:dbd9]:546 *:* users:(("NetworkManager",pid=377,fd=28)) tcp LISTEN 0 128 0.0.0.0:22 0.0.0.0:* users:(("sshd",pid=429,fd=3)) tcp LISTEN 0 128 [::]:22 [::]:* users:(("sshd",pid=429,fd=4)) ``` I have looked for possible culprit services like `systemd-resolved`. I have tried disabling Avahi. I have looked for other potential DNS services. I have rebooted the device. I am running the container as sudo (so it has access to all ports). I am quite at a loss. - Raspberry Pi Model 1 B Rev 2 - Raspbian (bookworm) - Kernel v6.6.20+rpt-rpi-v6 - Podman v4.3.1 - Podman Compose v1.0.3 ### EDIT (2024-03-14T22:13Z) For the sake of clarity, `# netstat -pna | grep 53` shows nothing on 53, and `# lsof -i -P -n | grep LISTEN` shows nothing listening to port 53 — the only listening service is SSH on 22, as expected. Also, as suggested [here](https://sh.itjust.works/comment/9843033), I tried manually binding to port 53, and I was able to without issue.
fedilink

PSA: Docker nukes your firewall rules and replaces them with its own.
I use nftables to set my firewall rules. I typically manually configure the rules myself. Recently, I just happened to dump the ruleset, and, much to my surprise, my config was gone, and it was replaced with an enourmous amount of extremely cryptic firewall rules. After a quick examination of the rules, I found that it was Docker that had modified them. And after some brief research, I found a number of open issues, just like [this one](https://github.com/moby/moby/issues/22054), of people complaining about this behaviour. I think it's an enourmous security risk to have Docker silently do this by default. I have heard that Podman doesn't suffer from this issue, as it is daemonless. If that is true, I will certainly be switching from Docker to Podman.
fedilink

How responsive is your Nextcloud?
My Nextcloud has always been sluggish — navigating and interacting isn't snappy/responsive, changing between apps is very slow, loading tasks is horrible, etc. I'm curious what the experience is like for other people. I'd also be curious to know how you have your Nextcloud set up (install method, server hardware, any other relevent special configs, etc.). Mine is essentially just a default install of Nextcloud Snap. Edit (2024-03-03T09:00Z): I should clarify that I am specifically talking about the web interface and not general file sync capabilites. Specifically, I notice the sluggishness the most when interacting with the calendar, and tasks.
fedilink

[SOLVED] Nextcloud Snap behind Caddy is responding with 301 Moved Permanently
Cross-posted to: https://sh.itjust.works/post/14975166 --- # Solution I'm still not really sure exactly what the root cause of the issue was (I would appreciate it if someone could explain it to me), but I disabled HTTPS on the Nextcloud server ``` nextcloud.disable-https ``` and, all of a sudden, it started working. My Caddyfile simply contains the following: ``` nextcloud.domain.com { server-LAN-ip:80 } ``` # Original Post I am trying to upgrade my existing Nextcloud server (installed as a Snap) so that it is sitting behind a reverse proxy. Originally, The Nextcloud server handled HTTPS with Let's Encrypt at `domain.com`; now, I would like for Caddy to handle HTTPS with Let's Encrypt at `nextcloud.domain.com` and to forward the traffic to the Nextcloud server. With my current setup, I am encountering an error where it is saying `301 Moved Permanently`. Does anyone have any ideas on how to fix or troubleshoot this? `Caddyfile`: ``` https://nextcloud.domain.com { reverse_proxy 192.168.1.182:443 header / Strict-Transport-Security max-age=31536000; } ``` And here is the output of `curl -v https://nextcloud.domain.com/`: ``` * Host nextcloud.domain.com:443 was resolved. * IPv6: (none) * IPv4: public-ip * Trying public-ip:443... * Connected to nextcloud.domain.com (public-ip) port 443 * ALPN: curl offers h2,http/1.1 * TLSv1.3 (OUT), TLS handshake, Client hello (1): * CAfile: /etc/ssl/certs/ca-certificates.crt * CApath: none * TLSv1.3 (IN), TLS handshake, Server hello (2): * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8): * TLSv1.3 (IN), TLS handshake, Certificate (11): * TLSv1.3 (IN), TLS handshake, CERT verify (15): * TLSv1.3 (IN), TLS handshake, Finished (20): * TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1): * TLSv1.3 (OUT), TLS handshake, Finished (20): * SSL connection using TLSv1.3 / TLS_CHACHA20_POLY1305_SHA256 / x25519 / id-ecPublicKey * ALPN: server accepted h2 * Server certificate: * subject: CN=nextcloud.domain.com * start date: Feb 21 06:09:01 2024 GMT * expire date: May 21 06:09:00 2024 GMT * subjectAltName: host "nextcloud.domain.com" matched cert's "nextcloud.domain.com" * issuer: C=US; O=Let's Encrypt; CN=R3 * SSL certificate verify ok. * Certificate level 0: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using sha256WithRSAEncryption * Certificate level 1: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption * Certificate level 2: Public key type RSA (4096/152 Bits/secBits), signed using sha256WithRSAEncryption * TLSv1.3 (IN), TLS handshake, Newsession Ticket (4): * using HTTP/2 * [HTTP/2] [1] OPENED stream for https://nextcloud.domain.com/ * [HTTP/2] [1] [:method: GET] * [HTTP/2] [1] [:scheme: https] * [HTTP/2] [1] [:authority: nextcloud.domain.com] * [HTTP/2] [1] [:path: /] * [HTTP/2] [1] [user-agent: curl/8.6.0] * [HTTP/2] [1] [accept: */*] > GET / HTTP/2 > Host: nextcloud.domain.com > User-Agent: curl/8.6.0 > Accept: */* > &lt; HTTP/2 301 &lt; alt-svc: h3="public-ip:443"; ma=2592000 &lt; content-type: text/html; charset=iso-8859-1 &lt; date: Wed, 21 Feb 2024 07:45:34 GMT &lt; location: https://nextcloud.domain.com:443/ &lt; server: Caddy &lt; server: Apache &lt; strict-transport-security: max-age=31536000; &lt; content-length: 250 &lt; 301 Moved Permanently <h1>Moved Permanently</h1> <p>The document has moved here.</p> * Connection #0 to host nextcloud.domain.com left intact ```
fedilink

[WORKAROUND] Nextcloud portforward stops working when it is moved to a bridged network
cross-posted to: https://sh.itjust.works/post/12856689 --- I have the following topology: ![](https://sh.itjust.works/pictrs/image/f134ad1b-a822-45ed-a9a8-387fdecafac6.png) The device running Nextcloud (snap) used to be connected to Router A, but I have recently added a bridge (Router B) and I moved Nextcloud's device to that bridged network; however, as soon as Nextcloud was moved to Router B, the portforward on Router A seemed to stop working -- as in I cannot connect to nexcloud from the public IP anymore. Bridges operate at layer 2, so this *should* make no difference whatsoever (this is reflected in the fact that other services (like SSH) still work perfectly fine portforwarded -- it's only Nextcloud that doesn't work), which leads me to think that it is a Layer 7 (i.e. Nextcloud) issue. What's going on here? How can Nextcloud even tell that it's been placed on a bridged network? **EDIT (2024-01-16T00:19Z):** I performed a network capture on the device running Nextcloud, and it appears that it's receiving the incoming request (`SYN`), and responds appropriately (`SYN, ACK`), but then Router B responds with `Destination unreachable (Network unreachable)`, which is then, of course, followed by many requests for retransmission as the packets are being dropped. But what's causing the packets to be dropped? Why aren't they making it through the network? **EDIT (2024-01-25T08:37Z):** I'm not 100% sure what the previous problem was, but I think that it had to do with [the bridge](https://web.archive.org/web/2/https://openwrt.org/docs/guide-user/network/wifi/relay_configuration) that I was using -- not necessarily that it was broken, but perhaps it was jsut incompatible with the setup in some way. What I ended up doing was buying [a different router that supported WDS](https://web.archive.org/web/20240120035823/https://www.linksys.com/ca/dual-band-ax3200-wifi-6-router-e8450/E8450-CA.html), and then I created a WDS bridge between the two routers. The network seems to be working reliably, and as expected now.
fedilink