Let’s do another round of this. What’s going on on your servers, any cool things? How’d the recent CVE flood tangent you and did it change how you see/do stuff?
You must log in or # to comment.
A while ago I made my first attempt at setting up a SSO for some of the things I host. I figured out things that have built in support, like Immich, but struggled with getting it done through Proxy for things that don’t have baked in OAuth or OIDC support.
I revisited it yesterday and figured everything out so I’m happy about that. Navidrome was one of the more difficult ones to figure out because I need SSO authentication for the web-ui, but username/password for the API. That was actually pretty easy once I wrapped my head around it.
I picked Authentik based on general positive things I’ve heard about it, and I use Nginx Proxy Manager for reverse proxy.
I finally ran a hardware accelerated ML container for immich.
My immich is in a VPS and my GPU is in my home server. Cheaper to run that than to rent GPU compute.
Decided to get back into podcasts recently, but baked-in ads and sponsor reads make standard listening unbearable.
I spent the weekend spinning up MinusPod, an open-source tool that detects ad reads and strips them using ffmpeg. It uses Whisper for local transcription, then feeds the transcript to an LLM to identify exact timestamps for sponsor segments and commercial breaks before slicing them out. I routed the text processing through Gemini Flash, which runs about $0.07 per episode. Clean, ad-free audio feeds with zero manual editing.
Thanks for this post, something I miss from earlier selfhosting communities.
I have simply running two SFF Lenovo Thinkcentres—one for all local services and another for all online services. They could run on one but I keep them separate for security and stability reasons. I often crash the local one by running out of space…
I finally got to building a second backup recently which I am happy about.
Honestly, since moving and downsizing from several services at home and at work, this solution works. I run out of space frequently but it forces me to not hoard things I will not actually use. My previous rack server seeded something like 50tb as I kept everything I leached to benefit the community, now less possible.
This has also made me move away from services that are not needed.
-
[ ] I would like to offload all my home videos to an external drive as I am running out of space for actual services and Jellyfin media.
-
[ ] I would like to consolidate all of my local and online databases rather than run a new one for each container stack.
-
The only PHP vuln I had was from parts-db which I deployed recently to check it out. Haven’t set it up yet seems like a lot of work. I keep a running record of my electronics parts in obsidian hoping maybe I can bulk add em or something.
Feeling better every day having my stuff under my control and away from prying eyes of trackers and other unsavory stuff.
Added no-new-privileges to all my outward facing containers :P
Nice. Any immediate quirks found?
Nope, all working as intended, just less likely to be taken over now.
Just completed my set of needed services by adding nextcloud to the list. Now life is good. Jellyfin: check. Navidrome: check. Pihole: check. Invidious: check. Nextcloud: check. What else? lol
You’ll find more stuff for problems you didn’t know you have. :D
This week, I’ve mainly been handling the fallout from the PHP vulnerability that occurred in late October. Following that incident, I made a few changes: I’ve opened only the necessary ports to the outside world, and the admin panel is now accessible only via VPN. I’ve created an inventory list for each server, clearly detailing which services are running and their versions, so that the next time a CVE is released, I’ll know immediately which servers are affected. In addition to running daily automatic backups, I periodically restore them to a clean machine to verify they work.
Remember: Always treat your servers as if they might be lost tomorrow, and make sure to have a thorough recovery plan in place.
After the recent plex player debacle I’m once again trying to come up with a way for me and my diaspora to share media using Jellyfin, but without relying on Tailscale. We have several media libraries, and some of the library hosters are not too tech savvy, so coming up with a solution to replace the ease-of-use of plex hasn’t been easy.
What’s wrong with tailscale?
Hey, I did the same. It’s not as bad as it seems. Get yourself a domain name from cloudflare and use it. I got mine for $10 a year. Then just installed cloudflare on my Debian server and all that (I’m sure you know the rest) then made users on my admin jellyfin dashboard and started sending people their usernames and passwords. The only difference for them is now they would need to enter the server URL on the first page of whatever they use then username and password. Good thing these jellyfin clients have the page of entering the server URL in your face with their “connect to server” button. Let me know if you have any questions.
Careful with using CF Tunnels for streaming content. It’s against their ToS to use the free tier for streaming content, so they can technically turn it off whenever they want from my understanding.
Against whose TOS? Jellyfin’s? I’ve never heard of that. Do explain why please.
Edit: I re-read your comment a couple of times (English is my second language), then searched some stuff. I didn’t even know cloudflare did that. I’ve been using them for over 2 years with no issues. I guess I don’t stress their servers enough? lol. If they stop me, I’ll just move to another company. I won’t even bother asking them or anything.
Against cloudflares ToS
Thank you. I realized that after reading the comment a couple of times. Yeah, they can screw off. If they stop me, I’ll just move my stuff somewhere else.
From what I understand, if you turn off caching you aren’t violating their TOS. I’ve been doing this for about 2 years now and have yet to have anything happen. Multiple friends use my Jellyfin server daily.
Upgrading one of my powerhouse Dell R410 proxmox nodes to 128GB of smoking hot PC10500 DDR3 ECC Ram from 64.
Now it’s cutting edge.
Last week I had to update everything to make sure that it didn’t fall back on DST because the fucking idjits in my backwoods province decided that they needed to create a new time zone.
I got new rack gear. I don’t 3d print so I ordered metal face plates for my 10 inch rack. got them here https://www.rackmountplates.com/
I am not affiliated. just a happy customer that stumbled on a solution to a problem. Sharing in case others have similar needs
Looks pretty cool, quite pricey though compared to 3D printing. I’m glad my friend printed mine
I recently got around to setting up OIDC for my internal apps using Pocket ID.
Sonarr v5 adds OIDC support, currently only in beta
Jellyfin SSO plugin
Nextcloud with the Nextcloud OIDC app
Mealie, Paperless, and Immich natively support OIDC
Calibre-Web I migrated to AutoCaliWeb, which supports generic OIDC
Sadly Navidrome doesn’t natively support OIDC and forward auth is a bit jank due to the subsonic API
How does the Jellyfin SSO plugin work for you? I’ve set it up with LDAP at the moment so that tv clients and such can still login normally
Seems to work fine. I can still use Quick Connect for apps that don’t support alternative auth.
My automatic weekly backup ran for the first time last night. Everything worked nicely.
If it’s automated, why only run it weekly?
Some backup methods – like VM backups on a basic Proxmox VE – only support full backups, so they put a lot of stress on the system and take a lot of space. Even if the performance hit or service disruption during the backup is manageable, a homelabber has finite disk space for backups, so there’s a tradeoff between RPO (most recent backup) and retention (oldest backup). Keeping 2 weeks of backups is cheap for weekly, expensive daily.
Ideally, everything would be backed up incrementally at fairly short intervals (short RPO, long retention), and restorable very quickly (short RTO). Getting there is a journey and weekly automatic backups is a great step.
But maybe losing a week of data is fine in their case. There are parts of my lab that would even be fine with monthly backups…
I practiced restoring my offsite backup this week. Good experience.
Then I printed and laminated the instructions and stored in two locations.
Just curious. How long does lamination last? I assume light hurts paper.
I dunno. Longer than bare paper, I hope.
I’m always super excited for this kind of stuff :D
OMG patching all the vulns. I actually pulled my wordpress offline overnight for that one. Still waiting on the Ubuntu patch for that IPv4 kernel CVE.
That reminds me - It’s time to do No NAT November again. This CVE gives me an excuse. Last year, the Nintendo Switch Switch and Steam were the big standouts. I think the Switch 2 will actually work with it now.
Oh, and my workplace is shifting offices, so my offsite backup is not offsite. Must take care to not burn the place down. I just put new fans in my PoE switch and now I can hear a server fan is dying too. There’s a lot of maintenance work to all this.
