It has experimental HTML export. This is the source for my site and here’s the Typst documentation.

Ah, so they are actually differences between IPP Everywhere and AirPrint (apart from AirPrint including the whole autodiscovery stuff)? Good to know. The latter is usually more prominently advertised though which is why that’s the one I mentioned.

But yeah, it should be very common for these to be supported with anything remotely recent.

Yeah, I’m a big fan of Swift so far. All in all it’s a really well-designed language and I’m enjoying writing it. I have some complaints but nothing deal-breaking.

I love the Contrarian Stack. For example, my website is built with Typst and Meson, and I’m making an ActivityPub server in Swift with Vapor (that one isn’t too far along yet).

Anything that supports AirPrint (this one does from what it looks like) will work with CUPS driverless printing on Linux.

I don’t have any secrets in my config or a private key or anything and I’m currently running 4 servers from the same config (it used to be 8 or even more machines at some point even, including desktops).

But yes, it’s a multi-file config, it would be absolutely crazy to not split it up with how large it is.

Very good post :)

I just about lost it at everything in this paragraph

The door creaked open. Guido van Rossum looked like the typical output of GNU Autotools. He introduced me to the only other survivor: Special DevOps Mikhail Molotov. “We lost Travis. We lost Jenkins…” Molotov lamented.

Yeah! To add to this:

Gentoo can do this with Portage sets. They’re essentially a more simple way of creating a meta package which just installs other packages. And you can also write config packages which installs configuration for other packages.

Hm, okay, that does sound like the real client IP will get lost and every connection will appear to come from the proxy then. It would be good if that were passed somehow. My current setup adds the X-Forwarded-For header for example.

Oh interesting, I’ll have to look into that. Is this with that “proxy protocol” I’ve seen mentioned? If not, does this preserve it pass through the client socket address?

Tbf, technically data is still decrypted at the reverse proxy and then re-encrypted. So if someone manages to reconfigure the proxy or read its memory somehow they could read traffic in plain text.

However then since they have to control the VPS, they could also get a new cert for that domain (at least the way I’ve configured it) even if it was passed as is to the real host via a tunnel and read the plaintext data that way, so I don’t think a tunnel protects against anything.

If someone manages to get root (!) access on this VPS it’s over either way.

Yes, you can just use a reverse proxy for IPv4 only and point it to the IPv6 upstream. That is what I do, with a separate DNS record which then combines the two. See the DNS records for id.knifepoint.net (CNAME), http.vineta.knifepoint.net (AAAA, A) and vineta.knifepoint.net (AAAA).

The reverse proxy config and certificate management is set up with NixOS, if it helps: https://git.dblsaiko.net/systems/tree/nixos/defaults/v4proxy.nix https://git.dblsaiko.net/systems/tree/nixos/modules/sys2x/v4proxy.nix

Two different rDNS names, for stuff that uses it. For example if you want to run mail and an IRC bouncer under different domain names.

Yeah, that’s fair. When verified beforehand, and what it discovered is an actual issue, why not. It does overwhelmingly attract people who have no idea what they’re doing and then submit bogus reports because it looks good to them though.

Daniel Stenberg has banned AI-edited bug reports from cURL because they were exclusively nonsense and just wasted their time. Just because it gets a hit once doesn’t mean it’s good at this either.

Tbh I haven’t had too many problems with Postfix – however it is certainly a footgun and it would be nice to have fewer parts to connect together, and better defaults. I might try it out, it looks interesting.

From its web page it sounds like it is both a MTA and MDA, has a built-in spam filter, plus has calendar, contacts and file storage. Do you know how it compares to my current setup of Postfix, Dovecot, and rspamd (and Nextcloud for the others)?

Not with --attributes-only.