• 3 Posts
  • 63 Comments
Joined 1Y ago
cake
Cake day: Aug 07, 2023

help-circle
rss

I would also add that you need to explain out-of-home steps, too.

I’m not an idiot but I didn’t go to school for compsci or similar and I don’t do it as a job. So frequently the instructions will go

  • Get your IP address by entering this command
  • Type your IP address in this line
  • Now forward any chosen port to your proxy of choice and don’t forget to check your firewall settings!

My sibling in Eris, most people dont know any of those words.


I’m just being a silly billy it’s not directed at you.

It’s more like “ah if only there was a simple solution that could’ve been used.”

All images are hosted somewhere, I would consider an intern fresh out of college know how to correctly add an image to an email, or at least only be told once if somehow they had never seen this before.


yeah it uses this really neat semantic rendering programming language for serving structured documents across servers

It’s a bit tricky, but anyone with at least a Masters in CompSci should be able to parse some of it enough to get the gist. Bear in mind that the “source” is abbreviated to src, and “image” similarly. The rest is coding that gives the computer instructions, you’ll also need to replace FILENAME in the code with the actual filename. It goes like this

<img src="FILENAME" /> 

Let me know if I can explain it more clearly.




“oh you laughed at that joke despite the fact that the bridge followed the falling action instead of preceding the punch word? Amateurs shouldn’t be allowed to watch comedy.”



it’s not just one thing though. For a non technical user, it’s nerve-wracking to worry that if you screw up the install, or download the wrong package, or configure the YAML wrong, or open the wrong port, or there’s a port conflict, or you forgot to update the software… now you’re potentially unprotected (even if that’s not the case - many will still worry).

Not to mention even if you - as I did - had to skill up to understand it, three months passes and you’re terrified to touch it because you’ve forgotten all the stuff you learned to set it up.

Same as how the majority of people don’t even change their own oil on their cars - even though it’s fairly easy.


that’s why I ctrl+shift+f5 for the extra powerful refresh


I use a pattern relative to the site name, with a different email address for every site also relative to the site name. The pattern means the password is always different but I always know that it is.


as an expat, it can be mixed though. If you rely on it for commuting and travel at rush hour, it’s just a different kind of hell.


hey Op - I went through the same journey as you recently.

I found the exact same guide you linked - but here’s what I found on my journey from knowing literally nothing to having it work.

firstly that guide is a bit outdated and very terse, in fact most of the guides have at least one thing that’s outdated and several things not explained

Here were my learning steps:

  • getting confident with the Linux command line enough that “chmod” and “chown”, user:group, rm, nano, and other basic commands weren’t foreign to me

  • getting confident enough with docker and docker compose that I understand what a container, image, compose file are and how to both manipulate them and exec commands inside them

  • understanding the basics of what a VPN is and does so the terms proxy, reverse proxy, port forwarding, DNS aren’t alien to me

  • understanding the basics of Linux file management including dotfiles, fstab, mounting, blkid, and as mentioned chmod and chown

none of this is particularly hard to grasp once you’ve grasped it but most guides you see and people you meet along the way will assume all of the above is second nature to you. at first I would pull my hair out seeing suggestions like “have you shelled into the container to curl your public IP?” like what the fuck does that even mean

I started with VPN as thats the important protective part. I paid for Mullvad because its fairly cheap and stuck with it all the way. First I used their GUI app and then later I switched to Tailscale and ran it as an exit node.

I also found guides like YAMS (Yet Another Media Server), dockSTARTer, Trash Guides and the Servarr wiki and would jump between them, Uninstalling, reinstalling, going down paths that didn’t work and formatting my raspberry pi and starting from scratch several times. It took me about 6 weeks to skill up to the point where I’m confident knowing about all the parts of my setup.

I’m happy to answer all the questions I can (bear in mind I knew nothing about this a few months ago, but my newbie perspective could help because I know what it’s like to not really know what half these terms mean)

PS:to specifically answer “what do these tools do”

  • Ombi (optional) – allows other people (or yourself if you like) to select requests for things to download (tv shows and movies)
  • qBittorrent - the torrent download client, takes a torrent from Prowlarr (see next point) and downloads it to your storage
  • Unpackerr (optional) - if it happens to download as a rar or zip file, unzips it for you
  • Prowlarr (replaces Jackett) – takes requests from Ombi (optional part) or Radarr/Sonarr/Lidarr (usually de rigeur) and uses trackers to find torrents. Trackers are services that take “I am looking for this movie” and turn it into “here is the torrent”. Prowlarr is where you manage the Trackers
  • Radarr (movies), Sonarr (tv), Lidarr (music), Whisparr (porn), Mylar (comic books), and Readarr (books) are part Ombi (find me this movie) but when qBittorrent has finished downloading and Unpackerr has unzipped it, puts tv shows together into series/seasons, handles the meta data, organizes everything for you and talks to the other apps so your library isn’t just a /downloads/ folder full of random crap, also sometimes you’ll download episodes 1 and 2 from one source, 3 and 4 from another, Sonarr gives you a UI to group them all together.
  • Jellyfin then let’s you watch these on your TV

The biggest high level challenge in any tech org is security and there’s no way you can convince me that ML can successfully counter these challenges

“oh but it will but it will!”

when

“in the future”

how long in the future

“When it can do it”

how will we know it can do it

“When it can do it”

cool.


it’s been a running internet joke for about 3 years now.



how did you get started moving from public to private and what does your average workflow look like?

I just started with a handful of Public trackers and they do okay, but I’d like to do a bit better.

On the other hand I don’t want to have to invest a huge amount of effort buddying up to complete strangers just to get the latest episode of University Challenge.



i am running *arr apps on a pi, using tailscale with mullvad exit nodes as a VPN, how do i add adguardhome or pihole to the stack without screwing everything up?
-all *arr apps in docker containers using docker compose -tailscale has friendly tailnet name -...magicdns enabled -...global nameservers have mullvad public dns in them not very confident here, can I just follow this guide (link: https://tailscale.com/kb/1114/pi-hole/) and it works or do I need to change some settings? I notice it tells me to add a custom DNS but mullvad is already in there? how does it know which to use or in which order?
fedilink


I fucked something up and installed pihole and adguard at the same time both in a container and bare metal and received a massive load of error messages that after 2 hours of trying to unstick just formatted the SD card and started over. So then, installing and configuring ssh, fstab the external drive, set a static IP address on the pi took up all of my time so far.



yes - grew up in the 80s so witticisms like “4 bits is a nybble” are stuck in the brain.

Although it doesn’t seem relevant it’s actually pretty illuminating in what IP addresses are and do so thank you for that


that’s a helpful explanation of subnets thank you

In the paradigm of

111.222.3.4:5/22

if “3” is subnet and “5” is port - what are the names of “4”, “222”, “111”, and “22”?

And is there ever a 000.111.222.3.4:5/22 or another add on?



As more of an artist than a techie for the most part — if you have your medium or at least part of it — the more interesting thing about art is what you have to say about it.

As an example, if you want to draw a distinction and comparison between the age of discovery and the age of technology, you could use the hard drives as a canvas on which to paint a portrait of something like Robert Scott / Lawrence Oates, or Jacques Cousteau, or Armstrong and Aldrin etc.

On that last one - if you could tie the size of the drive in comparison to the size of the code used in the moon landing that might also be interesting.

Anyway, all that to say - art is a mix of medium and message



Check the error logs and see what’s wrong with it instead. How is it crashing? Did you check stdout and stderr (use docker attach or check the compose logs)?

“Crash” is the wrong word. The app is running, it says “Connected” for about 15-20 seconds, then it says “Internet blocked” for about 20 seconds, then it says “Reconnecting” for 30-90 seconds, repeat indefinitely.

Using the CLI for logging, it says something along the lines of “Timeout… Hyper time out”

You should look a bit into how the internet, DNS and IP addresses work on the public internet and private networks.

Do you have any recommendations on how to learn this?

Also, thank you for explaining that “configuring a domain name” is adding an A record. I’ve added TXT records and similar for Google analytics and I’ve added mail records to set up my own domain’s email before - but this is helpful, thanks.



Thank you, this was really helpful.

I don’t know if I’ve configured the A records correctly - but someone else I was asking says that all this is against CloudFlare’s TOS so maybe I need to abandon CloudFlare completely.

The NGINX example will help when I start digging into that, thank you.

Yes, perhaps I over-simplified my gluetun example, I know it’s doing something in the container, but when I run the mullvad app it shows in green when it’s connected, and red when it’s not, and when the kill switch is engaged it shows “blocking internet” - how do I understand this same level of protection is active with a docker container? I think I read somewhere that I download something, then I docker pause gluetun and the download rate in qBittorrent should drop to near-zero to show it’s paused? Does that sound correct?


thank you so much for this considered reply. I’m just stepping out now, but will check in later to go through this in depth


ok. I would still like to learn this stuff, so hopefully someone can come in and answer some of the questions - but it seems like, then, the challenge is just gluetun for now.



I want to get started with *arr apps - here are all the things I don’t understand about (reverse-/)proxies and networking in order to get it set up.
Please can someone show off how smart and sexy they are by answering these questions. I don't mind if you just link me to a video or guide explaining it (like I'm 5?) instead of typing it out - but please don't just send me stuff that says something like "To forward to ports correctly, simply forward the correct ports - but be sure to reverse-p the goeanity-2.0 exposed server flange via qPack*7_bingb (IMPORTANT put 1=2 in /conf!!!)" - which is what all the help documents read like to me right now. Here's what I think I know, but I have probably got wrong, and would be delighted if you could not only tell me how wrong I am but what is the right answer instead: -> I have a raspberry pi 4 running raspbian/debian bookworm, all software up to date. -> I have installed docker and docker compose. Docker lets you run apps/programs in separate little cages so if they crash or do something insecure they don't crash or expose the whole computer (the Raspberry Pi), the operating system (Raspbian), or the other apps running in other containers. Docker compose allows you to fine-tune the settings of these apps from outside the container by changing a text file. Each docker container, controlled by a compose yml has a port, e.g. Jellyfin's is :8096 -> I can set up and configure radarr sonarr qbittorrent to download movies, for this I need a VPN. I paid for and installed mullvad (app) but it crashes a lot (for over a minute every 20 seconds), so it looks like I need to configure something like gluetun to do it instead. For this reason I want to stick with mullvad as I paid for it, gluetun is really confusing. -> However, downloading is only half the battle - assuming I can get a VPN to work without crashing every 20 seconds so it takes less than 5 hours to download a single movie in 1080p(!!!) - I can only watch stuff by plugging an HDMI cable into my raspberrypi and a monitor and using a mouse and keyboard to navigate to the UI and click "play" -> If I want to watch them on my TV I need to connect something to my TV that talks to the raspberry pi, so I have an NVIDIA shield with Jellyfin installed on it - but in order for the NVIDIA-Jellyfin to connect to the RaspberryPi-Jellyfin it needs to go through the internet (if this is not the case, how does one point the NVIDIA-Jellyfin at the Raspberry Pi jellyfin?) -> Because it's going through the internet I need to hide my activities from prying eyes, and because it's on the internet it will have a web address (I bought the cheapest domain for a few bucks on namecheap), so a proxy and reverse proxy are neccessary to hide my activity on my end (proxy) and the activity on the internet (reverse proxy) from said prying eyes while allowing me to watch my stuff in peace. -> I can set up my domain to point to Jellyfin, this means I configure mysubdomain.mydomain.com to point to Cloudflare on the internet. Then I set up Cloudflare to point to NGINX on my raspberry pi. But I really don't know what this entails or how to do it. I changed my nameservers to Cloudflare's on namecheap and that's where I stopped because I didn't understand any further. -> So, in practical terms, I'm on my sofa and I want to watch a movie in my Jellyfin on my raspberry pi, I open the NIVIDA sheild, I open the jellyfin app and I tell the jellyfin app to go to mysubdomain.mydomain.com -> I think I'm correct in saying that mysubdomain.mydomain.com is actually an IP address and a public port, so something like 123.456.7.8:443, then Cloudflare - which is the reverse proxy - gets involved (somehow? how?) to say "ah, 123.456.7.8:443, you obviously want to go to funkless.raspberry.pi:NGINX (or rather something like 987.654.3.2:443)" and then NGINX - which is the proxy-proxy, not a reverse-proxy - goes (somehow? how?) "ah, 987.654.3.2:443, you obviously want to go to 987.654.3.2:8096 which is jellyfin") -> At some point in that last step SSL certificate(s?) need to be issued and used on Cloudflare and/or NGINX - but I don't know how or why - and/or a public and private key Here's where the questions start: - First of all, is that all correct or have I misunderstood something? - How does mysubdomain.mydomain.com know it's me and not some random or bot? - How do I tell Cloudflare to switch from web:443 to local:443 (assuming I've understood this correctly) - Is this step "port forwarding" or "opening ports" or "exposing ports" or either or both? (I don't understand these terms) - If my browser when accessing mysubdomain.mydomain.com is always going to port 80/443, does it need to be told it's going to talk to cloudflare - if so how? - and does cloudflare need to be told it's going to talk to NGINX on my local machine - if so how? - How do I tell NGINX to switch from local:443 to local:8096 (assuming I've understood this correctly) - Is there a difference between an SSL cert and a public and private key - are they three things, two things or one thing? - Doesn't a VPN add an extra step of fuckery to this and how do I tell the VPN to allow all this traffic switching without blocking it and without showing the world what I'm doing? - Gluetun just looks like a text document to me (compose.yml) - how do I know it's actually protecting me? - From https://nginxproxymanager.com/ : "Add port forwarding for port 80 and 443 to the server hosting this project. I assume this means to tell NGINX that traffic is coming in on port 80 and 443 and it should take that traffic and send it to 8096 (Jellyfin) and 5000 (ombi) - but how? - Also from that site: "Configure your domain name details to point to your home, either with a static ip or a service like DuckDNS or Amazon Route53" - I assume this is what Cloudflare is for instead of Duck or Amazon? I also assume it means "tell Cloudflare to take traffic on port 80 and 443 and send it to NGINX's 80 and 443 as per the previous bullet) - but how? If your reaction is "Asking how how to set up port forwarding from Cloudflare to NGINX is a cowardly question - just figure it out!" Please could you at least link me to something that will help me figure it out if all those words just look like gibberish to me? Thank you so much for your help and time in advance.
fedilink


I have an NVIDIA shield, but cf my other issues (now mostly fixed hopefully by EOD today) that connections in and out of the pi were either being blocked by VPN or totally exposed without VPN


it’s a raspberry pi running raspbian bookworm

what’s the difference between wireguard and mullvad. Is mullvad just another shell for wireguard?


Thank you - that is helpful.

So the Gluetun part is really only for if I want to get into my jellyfin when away from home?


Forgive my ignorance, but doesn’t the mullvad need to run through gluetun, or at least in its own docker container to be secure?

Or to put it another way, whats the benefit/cost of installing it via dpkg as opposed to running it in a container, as opposed to running it in in gluetun (in a container)?

i thought everything was supposed to run in a container if it’s touching the web



I appreciate the advice but I am disinclined to go “hm this setup doesn’t work, I should buy a totally different set up” - as then I’m sure I’ll just have a different set of problems and other money I spent is essentially wasted.


but I can’t just have one device connected to the VPN. I have to be able to tell it what to download (from a device) and then watch it (from a device)

edit: also, from your link there

“Did you adapt the rules to your setup (IP, port etc)? What if you add a counter to the rules? Can you see them trigger on incoming packets with nft list ruleset?”

No, I have not adapted and counted the rules to trigger on incoming packets with an nft list ruleset because I have no idea what that means

From the link inside that link

"the following rules should be applied.

table inet excludeTraffic { chain allowIncoming { type filter hook input priority -100; policy accept; tcp dport 2010 ct mark set 0x00000f41 meta mark set 0x6d6f6c65; } chain allowOutgoing { type route hook output priority -100; policy accept; tcp sport 2010 ct mark set 0x00000f41 meta mark set 0x6d6f6c65; } }"

no idea what any of this means, nor what to do with it, what to change, or where to put it.

I can’t be a complete idiot for thinking this seems overwhelmingly technical. Like surely you can’t believe you can show that to the average person on the street and they’d be like “ohhh just table inet exclude traffic! of course!”

and “exclude traffic” sounds like the opposite of what I want - which is to include my ssh traffic.


It is a little frustrating that you advised me to ask AI to tell me what to do, I posted the answer verbatim and you said it’s not necessary. Is that because you know the real answer but don’t want to tell me, because the AI is wrong, or something else?

the issue isn’t plex v jellyfin ease of use, its mullvad or privoxxy on gluetun through docker via compose …ease of use.


want to get started but finding the technical side really overwhelming
I'd really like to get started with this stuff but finding the technical requirement exhausting. Trying to install privoxyvpn- "simply add the proxy to your browser and ensure the configuration is correct" (no help as to what this means, or how to do it and following the basic instructions just renders my browser unable to connect - googling the error message gives me replies like "simply make sure you read the logs" (no description of how to get to the logs or how to read them) hearing I need a proxy and a reverse proxy, install SWAG — "first, point the A name at your server and the CNAME at the A and then install the SSL certificate - but be sure to pick between directories and subdomains if you have fewer than 20 domains in your account." Like what the fuck does any of this mean? Then I hear if I have a proxy it might interfere with the reverse proxy and both might interfere with the VPN and vice versa. How does one even get started?
fedilink