uBlock Origin is already less effective when running in Chrome than in Firefox. For example, it can’t detect CNAME cloaking on Chrome, while it can do that in Firefox. When Chrome finally enforce manifest V3, uBlock Origin will be even more neutered in chrome due to limited number of blocking rules.
I just checked my AMD box and tailscale there can consume ~15% of cpu time when the tunnel is under active use. When it’s not used it’s ~1.5%. But it’s a low power old AMD cpu though (AMD G-T56N), so I’m not use if it compares to Ryzen 5. On my intel machine, it’s ~5% when under active use, and idle at ~0.5%.
On my machine it’s consuming about 0.5% - 1.0% of cpu time, which is higher than zerotier in the same machine (almost zero).
Tailscale does a lot more things than just tunneling though. For example, on default installation it’ll catch all outbound dns request on the machine and route them through MagicDNS (100.100.100.100).
I always look for excuses to get more servers, so if you ask me, I’d say yes, get that new server. There’s no such thing as having too much servers since there are so many things I want to self-host.
I also regularly tear down my servers and see how fast I can set it up again. Keep my deployment scripts up to date.
You can enable it from settings -> remote control in SmartTube app. Also, if you’re using YouTube revanced, the cast button might be hidden because it was not functional. You can re-enable the cast button on YouTube revanced from revanced settings.
When casting a video, you’ll have to open the SmartTube app in your Android TV first because it’s not automatically launched when you hit the cast button in YouTube revanced. If it’s in the background or not yet running, the video won’t play.
Here is the documentation, pretty bare though: https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/oauth2.html
I don’t think you’ll miss anything. If pihole works for you, then there is no need to switch to adguard.
One thing I found helpful is configuring my router (asuswrt-merlin) to transparently route all dns request to my adguard instance. You might already heard that some apps and IoT devices tried to be clever and hard-coded their dns server so they can evade dns blocking (I’m looking at you Netflix). If your router support redirecting all dns request to a custom dns server, definitely use it!
Sounds great! By the way, if you’re using docker, be careful not to accidentally have a container open a port on all interface. Even if you have a firewall configured on the machine, sometimes docker can punch a hole without you knowing. Might be a good idea to run a port scan from an external computer from time to time just to makes sure no unwanted open ports.
Unfortunately, I can’t say for sure if your instance will reliably get the deletion requests and process them. I did a small test to see how deletion works a few days ago and it doesn’t seem to propagate reliably as the deleted comment is still up in another instances, even now, though other instance such as lemmy.world seem to delete it. Not sure where it went wrong either, could either a bug, instances get overloaded and didn’t receive activitypub message correctly, or OP’s instance was improperly configured, but I sure hope it’s just an isolated incident.
Like I said before, If this still worries you, you can just delete older image files in the pictrs directory every few months to make sure you don’t host user-uploaded files for too long.
Some people say manually purging the activity table for entries older than a week or so should be safe enough.
The risk is pretty small IMO, especially if you (or your friends) are the only one that use your instance (with registration closed so no random users uploading stuff to your own instance). If you disable nsfw on your instance, the chance of storing illegal images should be pretty low, especially if the communities you subscribed are moderated as deletion from mods will eventually processed by your own instance. If this still worries you, just nuke pictrs directory every few months, perhaps automatically using a cron scripts that delete images/gifs older than a few months.
You could setup a status monitoring system and then configured it to send out messages for critical alerts. For example, I’m using Vigil to monitor my services and it’s configured to send email alerts when something is down and then sms alerts when things are still down for too long (in case I didn’t read the email).
This seems to be the easiest solution. Use the provided docker-compose file, then configure traefik to route requests to your lemmy domain to port 8536. How to do that depends on how you currently run traefik as there are multiple ways to configure it. Could be as simple as adding a label to the service named proxy
in lemmy’s docker-compose file.
The possibility to have your packets passed through a shorter route compared to IPv4 packets is worth it imo. I have 280 ms ping to the US and I can cut it down to ~250ms by routing my traffic via certain countries with vpn. I really hope widespread IPv6 deployment would optimize global internet routing so my latency would improve even if just a few ms so I don’t need to use VPN to override my route manually.
According to IETF, you should only use .intranet
, .internal
, .private
, .corp
, .home
or .lan
for your private network ( RFC 6762 Appendix G ). Using other TLDs might cause issues in the future, especially since new gTLDs seems to show up every few months or so, which can collide with the TLD you use for your local network.
Then it’s not a shitty ISP. My precious ISP not only put that customer behind CGNAT, the CGNAT’s IP addresses they use have poor reputation too so their customers sometimes get caught in captcha hell (very annoying when cloudflare doesn’t like you because every other sites are behind cloudflare now), doesn’t provide static IP address even when I asked to pay for it, and don’t even provides IPv6. The only saving grace was 1:1 download/upload ratio, and they implemented government-mandated block list half-assedly (Reddit is banned in my country) so it’s easy to circumvent. Once another ISP covered my area, I immediately jumped ship.
The new ISP also has problem with IPv4 allocation. Sometimes I got assigned behind a CGNAT, but restarting the modern is usually enough to get assigned into a publicly routable IPv4. And they actually have IPv6 so the CGNAT isn’t as much of an issue. The drawback is asymmetric download/upload speed, and they implemented the government-mandated block list more competently (transparently hijacking all DNS requests, throttling DoH, ip-blocking some blocked websites, sniffing http host header and block it if the website is banned, etc) so I have a bit harder time to unblock everything.
Looks like https://mastodon.xyz is up again now.
Extended downtime is common for community-run servers like this. Remember, even if the server is down for a full day every year, it’s still have 99.73% uptime! Chasing 99.999% uptime (like the big tech) for a community-run server is not reasonable because the cost (money and manpower) to do so is exponentially higher with every “9” you add in your uptime.
Haha I actually just did the same thing yesterday! I run RKE2 in a seagate hdd partition and was tolerating the noise. The seagate hdd was louder than any previous hdd I had, and yesterday I couldn’t stand it anymore and move the data into a new ssd partition, then remount it in /var/lib/rancher
.
Such bliss! Should’ve done it right from the start.
One common criticism about Tailscale is it has too many features for a networking product, which increase the likelihood of bugs that can lead to security compromise (e.g. Tailscale SSH ), especially when compromised tailscale network means the malicious actors have full access to your internal network.
Transparent here means the use of the relay is invisible to you. If two devices under the same tailscale/Zerotier network can access each other (e.g. in the same lan), then the relay won’t be used. But if both devices are under separate networks (e.g. one in your home, and the other is your phone while outside your home, and both devices are behind NATs), the relay will be automatically used as a bridge so both devices can communicate with each others.
Connections to relays are encrypted, but Zerotier allows you to setup your own relay server if you worry about privacy. Not sure about tailscale.
Who cares if it already exists, just make it.
Also consider the possibility when the other, more popular projects got enshittified. Now the fleeing users have an option to switch to your project. It actually happened on one of my side project. I made it because I want to try building my own version of X. It got ~2000 users, but later down the road, X got sold to a new shitty owner that waste no time to enshittify it, and my side project suddenly grow to 20,000 users overnight.