This is for traefik but might help to understand the process and change it for caddy (https://youtu.be/liV3c9m_OX8)

You should have

Service.local.domain.com

For local only services (Vaultwarden) and

Service.domain.com

For external things (immich)

I’m your router / Pihole locally, you setup the above URLs to point to the IP of caddy

I did this using a POE switch to both power the cameras and also have that entire switch on a VLAN. On my OPNSense, that vlan only has permission to send or recieve packets to home assistant which is on my main LAN. They have no other access to anything including each other on the camera vlan.

Other than the initial setup, the only interaction I have with the cameras is via home assistant. This allows them to be completely isolated and still have remote access as per usual with home assistant.

My HA is using the all in one VM setup on Proxmox. I would highly recommend HA installed as a VM rather than Docker due to the ease if installing plugins. After that the above setup will keep your IOT devices nicely isolated.

This is traefik, but its worth watching this because local SSL and external SSL setup is amazing and highly versatile for homelab

https://youtu.be/liV3c9m_OX8

When you adapt this to caddy I recommend a similar certificate configuration

I get very annoyed now when things are not rack mount and now need a 3d printed to make brackets for things that aren’t.

BTW can I rack mount a 3d printed /s

Has anyone tried windows teams app in bottles or win-apps?

If anyone’s Firefox auto updated like mine you can uninstall the extension, go to the Bitwarden extension page on the Firefox website and manually install the old version. Only needed if you can’t update vaultwarden right away.

If you check the github discussion from the devs that patched the issue it doesn’t seem intentional to me (not an expert). That being said I assumed the same thing.

My browser auto updated the extension at a very inopportune time and from some reason KDE connect from my phone to computer which is usually very reliable also wouldn’t connect. Was quite annoying until I realized I can just log into the vaultwarden website directly. I don’t think I’ve done that in years

What are you looking for in an app that the FreshRSS mobile website doesn’t offer?

With your mobile browser, you can ‘install’ the site as an app and then I use gestures to launch the app.

If I read Dungeon Crawler Carl should I get into He Who Fights Monsters? I have a big enough back log on my list as it is, but I really enjoyed DCC. Is HWFM just more of the same?

One thing to consider is that once zfs is setup there really is no significant intervention that is needed. I probably haven’t done anything to my proxmox zfs array in years.

I know its almost a meme to say just learn command line, but unfortunately in this case it will really help you understand what is happening and it also just takes a few commands to setup up once and then never worry about it again.

After the inital setup, the zfs GUI will be pretty much unused.

For commands I don’t use often, i use a note taking software to keep track of commands I used during setup because years go by before I use it again. I find the GUI often changes in that time making it harder to replicate whereas command line is the same and easier to document.

Keeping 80 open is useful so that traefik can redirect all traffic to 443 (https)

My router is quotom from 2017

Any idea if gluetun does this by default? A popular setup is setting the network mode on the application docker to the gluetun service and then gluetun itself says it has a killswitch built in. I assume they did that well since its very popular and this is pretty much the main purpose of the container.

I didn’t know what this was until now. It seems like the beta bitwarden app supports this. Would be interesting to get it setup for that.

This along with borg warehouse is the GOAT setup. Many others exist of course.

Borgbase for offsite backup as well. Has been rock solid and I test download files from there every now and again with no issues. Never really did a full restore since its my 3rd line backup

I used this years ago. I had issues with repeated database corruption. Google search showed lots of people with similar issues.

I moved to borg backup which has been great.

I use a docker container that uses the MySQL/postgress dump command to create database dumps every hour with a retention policy. The dump is placed into docker data directory.

My docker data directories are in a parent directory on the host.

Borgbackup then runs the backup on this one directory. Like the other reply mentions, this is probably overkill since the database doesn’t isn’t being written too that intensivley but the resources needed to do this are minimal so its not a big deal once you know how to set it up.

https://github.com/Martlark/pg_dump

https://github.com/fradelg/docker-mysql-cron-backup

I did his when I moved from unraid because I wanted better infra as code for my dockers etc. Kept unraid with all my drives and use NFS mounts from another machine with proxmox that runs a VM for my dockers

The best and most versatile system is having domains and a reverse proxy that has internal and external domains. Ie jelly.example.com and Vaultwarden.internal.example.com

Then you add authentik which does SSO for many app like nextcloud, immich, linkwarden etc. For apps that don’t integrate, you can still use his with reverse proxy authentication (sonarr).

Naturally this is more complex to setup but nothing beats the versatility.

I can choose extra protection for things like vaultwarden (need to connect via wiregaurd). Make things external for other users to access easily (immich, jellyfin, etc). Everything is based on users that are made in authenticatik and they all have the same password with single sign on.

You would approach this is pieces. get the domain and reverse proxy working first. Then authentik. this is only realistic with docker compose.

Assuming this is all true, sure its not great but how much does it matter?

Most have jellyfin in a docker. My jellyfin can’t only has read only accses to the media folder. Only the config folder has write access. Assuming the worst case scenario here, how much damage can than do?