JRaccoon

I run Debian on my homelab and manage Ubuntu Servers at work. I haven’t seen any practical differences between the two. Sometimes you might get a bit newer version of something from the Ubuntu repositories than from the Debian ones but not even once has that been an issue and most of stuff I use come from 3rd party repositories anyway.

Old screenshot. They used to have basic security features like 2FA behind a paywall. That’s just stupid. But at least they recently changed it, allowing free users to secure their accounts.

It works great when you log in as a user like you normally would on a Windows pc. But on a server you want it to run as a service, starting automatically in the background and/or being managed by the failover cluster without requiring a user to log in.

The solution back then was to use netplwiz autologon. Obviously a hack and bad for security, but fine for a homelab. After googling it now, it looks like some other “solutions” are documented in the GitHub issue about this.

Asking out of curiosity: is there a specific reason you’re running Windows on your server? I used to do the same on my home servers because that’s what we used to have at work, and I wanted to learn and test some stuff. But it was a difficult road, to put it mildly. Simple things, like getting Docker autostart on boot seemed almost impossible. At some point I just gave up and switched to Linux.

Agreed

I use Caddy and it’s great. ACME is very easy to configure, as is everything else. I haven’t tried running it in a container tho but they have official images published so it should work without issues.

I’ve had a good experience with mailcow. It’s not the most lightweight tho, and spins up quite a few containers.

Obviously I’m not a lawyer but I don’t see what law they could use to shut it down. All it’s doing is accessing publicly available data via a proxy. It’s not like it’s exploiting Instagram somehow.

If they wanna stop it, they can do what Twitter did and start requiring an account to see almost anything. Personally I suspect Meta is slowly going towards that.

Awesome! Got it running and seems to work well. Also I love the CLAUDE.md file you got there in the repo 🐈

SimCity 4. That was before the franchise went to shit.
I dunno why exactly, but I just don’t get the same enjoyment out of Skylines or other city builders.

I chose one from this list: https://github.com/forwardemail/awesome-mail-server-providers?tab=readme-ov-file#vps-and-dedicated-mail-server-provider-comparison-table

I recently set up the whole stack (Postfix, Dovecot, OpenDKIM) on a VPS. I wanted to do it from home, but my ISP won’t provide a static IP or open ports 25/465/587 for consumer customers, no exceptions.

It took me about two days to get everything working, but most of that was because I went in with very little knowledge of how email even actually works. If you’re looking for a learning experience, I’d say go for it. If you just want a working email setup quickly, I wouldn’t recommend it.

I haven’t noticed any deliverability issues so far. Just make sure you have SPF, DKIM, DMARC, and PTR records all set correctly from the start.

Thanks. This is kinda important info so I’ve edited my initial comment.

They are not saying anything on why they are removing it.

Jellyfin is dropping HTTPS support with a future update[…]

What’s the source for this? I wasn’t able to find anything with a quick google search

I see everyone in this thread recommending a VPN or reverse proxy for accessing Jellyfin from outside the LAN. While I generally agree, I don’t see a realistic risk in exposing Jellyfin directly to the internet. It supports HTTPS and certificates nowadays, so there’s no need for outside SSL termination anymore. (See Edit 2)

In my setup, which I’ve been running for some time, I’ve port-forwarded only Jellyfin’s HTTPS port to eliminate the possibility of someone ending up on pure HTTP and sending credentials unencrypted. I’ve also changed the Jellyfin’s default port to a non-standard one to avoid basic port-scanning bots spamming login attempts. I fully understand that this falls into the security through obscurity category, but no harm in it either.

Anyone wanna yell at me for being an idiot and doing everything wrong? I’m genuinely curious, as the sentiment online seems to be that at least a reverse proxy is almost mandatory for this kind of setup, and I’m not entirely sure why.

Edit: Thank you everyone for your responses. While I don’t agree with everything, the new insight is appreciated.

Edit 2: I’ve been informed that infact the support for HTTPS will be removed in a future version. From v10.11 release notes:

Deprecation Notice: Jellyfin’s internal handling of TLS/SSL certificates and configuration in the web server will be removed in a future version. No changes to the current system have been made in 10.11, however future versions will remove the current system and instead will provide advanced instructions to configure the Kestrel webserver directly for this relatively niche usecase. We strongly advise anyone using the current TLS options to use a Reverse Proxy for TLS termination instead if at all possible, as this provides a number of benefits

What if a bad actor acquires one of these once popular tracker domains? Could they somehow take advantage of it? For example, what if they make the tracker advertise a large number of “fake” peers that serve malware instead of the actual files? I only have a crude understanding of how BitTorrent works, so I’m not sure what kinds of protections, if any, it has against this type of attack.

They can include runnable JavaScript too, which can cause vulnerabilities in certain contexts. One example from work some years back: We had a web app where users could upload files, and certain users could view files uploaded by others. They had the option to download the file or, if it was a file type that the browser could display (like an image or a PDF), the site would display it directly on the page.

To prevent any XSS (scripts from user-provided files), we served all files with the CSP sandbox header, which prevents any scripts from running. However, at the time, that header broke some features of the video player on certain browsers (I think in Safari, at least), so we had to serve some file types without the header. Mistakenly, we also included image files in the exclusion, as everyone through image files couldn’t contain scripts. But the MIME type for SVG files is image/svg+xml… It was very embarrassing to have such a simple XSS vuln flagged in a security audit.

My use case is a bit different than yours but still worth mentioning, I think; I have Sharry running in Docker and it makes sharing and receiving files super easy. All downloads and uploads are resumable so they work well even in unstable networks.

Nope. But as mentioned in the article, some support for display servers might be coming in Android 16.

Networking does work. I was able to install packages using apt and also ping machines on my local network. Could be useful.
I guess in a pinch it could be used to ssh into other machines. However, I’m sure there are plenty of SSH clients available for Android, which are much more lightweight solution than running a whole VM.

It has access to /sdcard as a shared folder.

How does this work? The app doesn’t seem to have any settings related to it yet. Under /mnt in the VM I noticed folder shared that seems to match the downloads folder on my phone, which seems odd