I took a look at it. From what I understand, some of the lines in your setup are redundant. The final product seems to do basically the same job as mine. In any case, if it works, it works.

Hey, great post. I have one request. Can you maybe add some description for what the iptables entries do? I have a similar setup with a lot less iptables rules that works well for me. But I’m not an expert in networking, and am now worried that I might be missing something that can leak my home IP.

They’re just outsourcing their ethics.

There’s propaganda, definitely. Also, there are people who simply don’t care what they watch. They’ll just open Netflix and watch whatever they see on the home screen. It’s hard for them to understand why I might wanna watch some Iranian movie from the 80s.

I know about Jellyseerr, but I find it not worth it since there are very few people that send me requests. Messaging apps are enough for that.

I also teach college students lol. People can’t even figure out how to upload assignments from their phone. Had a student tell me that she broke her laptop, so can’t submit an assignment even though it was already written. She was gonna scan it from her phone, airdrop to her laptop, and then upload the files to Canvas. I tried to explain that she can do it on the mobile app for Canvas instead. I eventually had to give up and asked her to drop it at my office. It literally felt like explaining stuff to my ma.

I think the gap stems from need. Most people only learn what they absolutely need to. My sister and I are just 3 years apart in age. Yet I am pretty familiar with tech, while she knows next to nothing. I was always there to fix whatever broke. Even now she knows that if she needs to watch something, she can just ask me to add it to my Jellyfin server. I often have to remote into her system to fix stuff.

The Gen Z we’re talking about here mostly grew up using phones, and phone OSes do their best to hide any complexity away from the user. So they never learnt anything. I’m also technically Gen Z (very early), but growing up in rural India, I had to teach myself how to pirate since streaming wasn’t a thing yet (our internet was too slow for that anyway), and the local theater didn’t play anything except local mainstream cinema.

Navidrome does that. I think you just used a bad frontend. Try Tempo if you’re using Android. Or Feishin on desktop.

I’ve been very happy with Navidrome. I have it accessible on a subdomain, so I can just use it from wherever I want. Feishin is a great frontend for Linux desktop, and Tempo is a great frontend for Android.

My friend uses Jellyfin instead of Navidrome, and he’s also happy with it. Both the frontends that I mentioned work with Jellyfin as well.

I’ve heard many people complain about DuckDNS. Personally use desec.io for DDNS and it’s been solid.

What I’ve realized in my (very limited) experience in selfhosting, it’s always best to use a general purpose server OS rather than anything geared to a specific usecase, unless that’s the only thing you’re gonna use it for. So, if you want a separate NAS drive, then it’s a good idea to use TrueNAS on it. But on your main server, it’ll be best to use some sort of RHEL downstream distro like AlmaLinux.

I use Syncthing and a bunch of rsync scripts to keep my machines in sync. The stuff I want synced continuously is handled by Syncthing. Other stuff is synced on a daily basis using the rsync scripts and anachron. For Photos, I use PhotoPrism. I simply sync the Photos from my smartphone to a folder and make PhotoPrism scan it on a regular basis using ofelia. For cameras, I need to copy the photos manually, but I don’t think there’s a way around that.

Don’t mean to necrobump. But I have Syncthing GUI working over a very similar setup. Let me know if you still need help setting it up.

Relevant xkcd

I don’t keep any TV series after I watch them, unless someone else with access to my Jellyfin wants to watch too. So my collection is relatively small at a few terabytes.

Some people are also building a reverse proxy using pingora called river.

For media, I host the some of the arr apps, qbittorrent, Jellyfin, gpodder2go, and navidrome. For personal photos, I host PhotoPrism. I host a file sharing service fileshelter, and a link shortening service chhoto-url. I host Wiki.js for mostly recipes, and some notes. I’ve recently started hosting Forgejo for my git repos. I also host SageMath for computation, it’s especially useful when I only have my phone with me and need to use it. I use caddy as a reverse proxy and serve these through a VPS using a Wireguard tunnel.

Thanks, I’ll check it out.

Thanks for the suggestion.

Where are you, if I may ask? Their Intel offers are not based in the US. Most of the time, I’ll access it from inside US, so I’m worried about the latency.

Without anything extra, there are three ways of doing it:

1. Using Tailscale Funnel
2. Direct port forwarding in your router, and pointing to the IP using some DDNS provider (e.g. desec.io)
3. Through Cloudflare tunnel (not recommended due to privacy reasons)

In each case, you’ll need a reverse proxy (e.g. Caddy) if you want secure https connections.

If you’re willing to spend money, the better way would be to proxy through a VPS (using something like a Wireguard tunnel). In that way, you won’t have to open ports on your home router. You can get a very cheap one since proxying doesn’t need much CPU power. Just choose one with enough bandwidth. I personally proxy most of my stuff through a $12/yr RackNerd VPS.

That’s why docker was created.

My setup looks like the following:

/etc/wireguard/wg-vps.conf on the VPS
-----------------------------------------------------
[Interface]
Address = 10.8.0.2/24
ListenPort = 51820
PrivateKey = ********************************************

# packet forwarding
PreUp = sysctl -w net.ipv4.ip_forward=1

# port forwarding 80 and 443
PreUp = iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-destination 10.8.0.1:80
PreUp = iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j DNAT --to-destination 10.8.0.1:443
PostDown = iptables -t nat -D PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-destination 10.8.0.1:80
PostDown = iptables -t nat -D PREROUTING -i eth0 -p tcp --dport 443 -j DNAT --to-destination 10.8.0.1:443

# packet masquerading
PreUp = iptables -t nat -A POSTROUTING -o wg-vps -j MASQUERADE
PostDown = iptables -t nat -D POSTROUTING -o wg-vps -j MASQUERADE

[Peer]
PublicKey = ********************************************
AllowedIPs = 10.8.0.1

/etc/wireguard/wg-vps.conf on my home-server
---------------------------------------------------------------
[Interface]
Address = 10.8.0.1/24
PrivateKey = ********************************************

[Peer]
PublicKey = ********************************************
AllowedIPs = 10.8.0.2
Endpoint = <VPS-DDNS>:51820
PersistentKeepAlive = 25

Now, just enable the tunnel using sudo systemctl enable --now wg-quick@wg-vps. Make sure that the port 51820, 80, and 443 are open on the VPS. Now, allow 80, 443 through the firewall on the home-server (not on the router, just allow it locally), and it should work.

I’m afraid that I don’t have any guides. But, you’re halfway there anyway. Which one of these methods do you prefer? I can maybe give you some pointers.

I have a wireguard tunnel set up between my home server and the VPS, with persistent keepalive. The public domain name points to the VPS, then I have it set up (simply using iptables) so that any traffic there in port 80 and 443 is sent back to my honeserver and there it’s handled by caddy, and sent to the actual service.

The only ports I need to open are 80 and 443 on my VPS to make this setup work. So, no open ports on my local machine. This does however require you to pay for VPS. Since you aren’t doing much on it though, you can get away with a cheap one. I have a $12/year VPS from Rack nerd that I use for this job.

For completely free options, you can do one of three things. (That I can think of. There are probably more ways.)

1. Either open up some ports on your machine. You’ll need to make sure that you aren’t behind a CGNat for this. I simply don’t like opening ports to the internet, though.
2. You can use a VPN. Tailscale works great for this. I use it personally for sshing remotely into my machines.
3. You can use cloudflare-tunnels. Potentially bad privacy-wise since they can technically access the data. So don’t use it for sensitive stuff. Also, their policy doesn’t allow traffic that’s not mostly HTML. So something like a Jellyfin server would violate this. But you do get to use their firewall which is great for protection against DDOS attacks.

P.S. If you need help setting any of these up, lmk.

Thank you for your service.

I currently use Wiki.js but it’s a bit too much. The image size is around 500MB. I don’t see why I need such a huge program for hosting essentially text files and some images.

From the comments, DokuWiki with a modern theme, Fossil-SCM, and MkDocs seem nice. I’ll probably try some of these during the weekend.

Hadn’t heard of it before. Looks promising, thank you.

Are you an elf? We humans usually don’t live that long.

That was the idea. But I’m not a functional programmer (not a programmer by profession at all lol), so I might’ve done something stupid. Hence the disclaimer. Thanks for confirming.

A tail-recursive version written in OCaml that should not reach stack limits easily. (Not an expert in OCaml, so this might be stupid. But I tried it with 10000 iterations, and it worked without any issues.)

let gnu =
    let rec aux s = function
    | 0 -> s
    | n -> aux (s^" is Not Unix") (n-1)
in aux "GNU";;

*Expected rage

Try out fileshelter. It’s super lightweight and works pretty reliably.

Physics. Light won’t pass through my body.

Zulip is a little better in this regard. I’m involved in Lean, which uses Zulip as the primary mode of support and documentation. While it’s usable, I still think that a Discourse style forum is the way to go.

Adding to the discussion, if you want to watch anything that’s not mainstream (i.e. non-western, or arthouse), you’re basically supposed to either wait for it to stream on Mubi or get a Blu-ray/DVD (that are often out of circulation if it’s more than 5 years old). So the only real option is pirating.

I don’t, because I switch it with something better if something like that happens.

Games are one of the very few things that I always pay for. Steam is mostly responsible for that. Also, music. But nowadays I do store some of my own music because I can have lossless that way.

I can’t permaseed for tv shows due to storage limits, so I use autoremove-torrents to automatically delete stuff based on the tracker.

I’m kinda in the same boat, except for a specific private tracker. It’s a local private tracker which has a ton of exclusive stuff in my native language, and most of the users also speak it so there’s a communal aspect to it. But otherwise, yeah. I also tend to prefer public trackers, especially for more mainstream stuff.