Mama told me not to come.

She said, that ain’t the way to have fun.

  • 1 Post
  • 778 Comments
Joined 1 year ago
cake
Cake day: June 11th, 2023

help-circle







  • Lots of options. Here’s what I do:

    1. HAProxy - uses SNI to match an HTTPS request to a service, without decrypting the connection
    2. Caddy - manages TLS certificates, decrypts connections, and sends the request to the relevant service
    3. Docker - each service runs in a docker container on the host
    4. my router has static DNS entries for each of my subdomains, so I can do https://service.mydomain.com, and my traffic never leaves my LAN when I’m at home

    I have HAProxy running on my VPS (Hetzner), and it routes traffic over my WireGuard VPN to whatever physical device on my internal network handles that service (i.e. 2). This allows me to add devices to my network as needed, and TLS certs all live on that device.

    This is probably overkill for your setup since it sounds like you can talk to your home router from the internet (I can’t because I’m behind CGNAT), so you could drop #1 and just use Caddy, assuming you’re okay with having all traffic handled by a single device. Or you can see if your router supports SNI-based routing to handle what I’m using HAProxy for.

    If you don’t need to share your services w/ anyone, you can have everything live inside of a VPN and just access it via that VPN. You can look into Tailscale if you want something dead simple, and I think Cloudflare offers something similar. I started with that, but decided I wanted to share a number of services with family members, and I didn’t want to force each of them to configure my VPN.



  • If Chrome is at v162 and you’re at v3, people perceive the version numbers to reflect the quality and development.

    I don’t think it is the case. Ask some random person what version their browser is and they probably won’t even know how to check.

    It doesn’t matter for the vast majority of people, the only people who care are power users. And what do power users appreciate? Clear communication. If there’s a major UI change or something, bump the major version. If there’s a new feature, bump the minor version. If it’s just bug fixes, bump the patch version. Or even simpler, since Firefox has the ESR build, bump the major version whenever an ESR build is cut, bump the minor version every regular release (4 weeks?), and bump the patch version every patch release like we do now. That way I know how much the ESR build has deviated from the regular build, which is valuable information (just look at the minor version for the latest Firefox).

    How you manage versions doesn’t matter to the vast majority of people, so it should be tuned for the minority who actually kind of care, so make it mean something. A year would be fine and useful, a number that increases w/ the ESR refresh would be useful, an ever-increasing number isn’t useful. Pick one of the useful options…


  • Eh, my Ubiquiti AP works pretty well, though it’s a bit annoying setting up the server software. I get way better range with it than I ever got with my previous routers, and I never have to reboot it (my Mikrotik router needs to be rebooted more often, and that’s rock solid as well).

    I honestly haven’t had any issues, but I have a very simple setup:

    • Mikrotik router
    • UAP-AC-LITE

    That’s it. No mesh, just a single AP and a single router. It works well, and I largely forget about it because it just works.

    That said, I’m considering upgrading to a newer wi-fi standard, so I’ll be doing some research again. Ubiquiti was the best at the time, but I don’t have any particular brand loyalty, so I’ll get whatever seems to work well and is a reasonable price. I will probably keep this AP and add a second, so that’ll factor in as well (i.e. can I have two APs serving the same SSIDs? If so, how do I get them to work seamlessly?).




  • Is a vpn always safer then a reverse proxy?

    Depends on what you trust, I guess.

    A reverse proxy on a standard cert is a bigger target for automated scripts than a reverse proxy on a non-standard port. A VPN runs through the VPN’s authentication, whereas a reverse proxy relies on whatever that app’s authentication is. So whether it’s secure enough depends on the VPN configuration, what you’re hosting, etc.

    I’m behind CGNAT, so I have limitations you don’t, but here’s my setup:

    • VPS at the edge for my public services - basically the same as a reverse proxy because the application is directly exposed
    • self-hosted VPN at VPS to facilitate reverse-proxy - I could shut down public access any time and just login w/ the VPN
    • static DNS entries on my router so I can use my domains inside my network (TLS also works properly)

    I like this approach because I can eat my cake (nice domain names instead of IPs and ports) and have it too (fast connection inside LAN, can disable reverse proxy if I want better security). You could get the same w/o the VPS, and if you require WireGuard VPN access outside the LAN, you get better security than a public-facing service.



  • Would the Mac Mini actually idle at that wattage if it’s open for connections? I doubt it, it’s probably more like 10W, which is generally the range for those smaller AMD MiniPCs or NUCs.

    If it’s 10W, that’s a $20 savings from your NAS w/ a desktop CPU (and probably a discrete GPU, unless it’s running an APU). I can get 4% easily on savings, so I’d only need a $500 savings vs the Mac Mini to recoup that difference every year ($500 * 4% = $20). So if you already have an old PC, use that instead of buying a Mac Mini, and you also won’t have to fight macOS to do what you want.


  • Yup. My old 1st gen Ryzen desktop system isn’t particularly power efficient, but it idles <50W (I think closer to 25W, but I haven’t measured for a while). And that’s a desktop class chip from 7 years ago with two HDDs and a discrete GPU and PCIe wifi card, so it’s not winning any awards for efficiency. Even at that, it’s barely a blip on my power bill.

    An AMD or Intel laptop-class chip should be able to get to 10W or so idle, and not spike too much with basic tasks. And those can be had for $200-300, less if you’re okay with older chips. Run Linux headless and it’ll likely stay below 15W at the wall most of the time.