People abusing cloudflare workers.

I think it’s worth it, but you could move to one of the VPS deals on racknerd (or another lowendbox.com deal), for like $10-20 a year and save a bunch.

I guess? They advertise it as blocking bots and bad actors and such but it doesn’t really do that.

They do talk a lot about security and their WAF on their home page, it might be secondary but they mention it a lot.

I don’t believe there are any logs being transferred, just the abusive IPs are shared with the central DB.

So if an IP starts hitting a ton of rules (like .env access, repeated 403s, 404s, 429s, etc… Or specific AppSec rules) then that IP is blocked and sent to their central DB where it’s pushed out to everyone running crowdsec.

On my setup crowdsec has been more effective than cloudflare at stopping scanners and bots from overloading things, cloudflare just lets basically everything through so I stopped using it.

That said I’m curious if you remember the source of the real world tests, because I’d love to see what’s actually better.

What does these “tunnels” actually add?

Ease of deployment / time savings generally. You can certainly do it yourself with wireguard and a reverse proxy.

Self hosted alternative is buying a static IP from your ISP I suppose. Mine is an extra $5/mo which is eh, but I’m not paying for a VPS.

Performance on opnsense is fine for anything you’ll be doing at home, so I wouldn’t factor that into your choice.

Features on opnsense are probably better, just due to all the packages you can install.

Do you prefer being 100% in a CLI all the time? If not I’d say opnsense, the GUI certainly makes things a lot easier when you’re not fully familiar with something and spending every day interacting with it.

It mimics discord, so functional voice rooms with screen sharing, text channels, and so on…

You don’t technically need to back up the PBS server as there’s not much there other than a basic config. As far as the backup data itself, you can mirror to another PBS server or I think it supports S3 for offsite storage.

The immich public proxy app is built for this, you run it on your isolated public VLAN, and it displays a shared album to people while loading the images from immich.

The SFF or MT form factors are a lot better, I’d say MT is the best as it has full height PCIe slots. Keep in mind the dell/hp/lenovo models all use proprietary motherboard form factors and power supplies, but not that big of a deal I think since there are so many parts available if something does break.

I highly recommend 7th gen intel or newer, as you get the much better quicksync support and quality.

If you get a desktop class CPU (i5-7500 for example), the whole computer will typically draw around 15W at idle with an SSD, which is pretty decent.

If you need less idle power draw then you’ll want a mobile/notebook class CPU (like an i3-7100u) as the idle usage should be less than 5W. But those typically only come in the micro/mini form factors.

Also good to remember that every 3.5" HDD draws around 7W when idle and spun-up (typically difficult to spin down on servers since there’s always some process accessing files).

Maybe run the public VPN at home with NAT enabled, and use it as the default gateway in the private VPN. Never done it but I think I’ve seen some guides on that concept.

KeePassXC + KeePassDX is probably the best option, with the downside of no way to sync easily (syncthing is probably the best option there)

I might switch back at some point, been getting frustrated with the bitwarden extension performance always being so poor.

Mostly just quick notes in Obsidian, if I do anything complex or ‘unusual’ to set something up I’ll save the history that I ran.

Proxmox has a UI for ZFS. But you don’t really need it, ZFS is kind of set and forget and setting it up is quite easy via CLI.

Crowdsec does everything fail2ban does so not much point.

You can analyze with either the CLI or log files piped into something like OpenObserve which is what I do. You don’t technically need their dashboard.

Komodo.

An SSL error is expected because you’re using localhost and not the common name that the cert is issued for. But the fact that it’s connecting and showing the error means the server is working.