It depends on the project. Often there’s a “Contributing” page on its website or a file named CONTRIBUTING.md or similar in the source tree. Start from reading it. Sometimes information there is aimed at experienced developers, but sometimes it is very friendly for beginners.

$ sudo smartctl -A /dev/sda -f brief | grep -i power_on
  9 Power_On_Hours          -O--CK   001   001   000    -    120198
$

If you don’t need issue tracker, wki, CI etc., cgit will be enough. If choose from gitlab, gitea and forgejo, use forgejo.

My plan is to load up on canned stew and buckwheat.

Yes, it is normal.

# fail2ban-client status sshd
Status for the jail: sshd
|- Filter
|  |- Currently failed: 10
|  |- Total failed:     4433
|  `- Journal matches:  _SYSTEMD_UNIT=ssh.service + _COMM=sshd
`- Actions
   |- Currently banned: 27
   |- Total banned:     668
   `- Banned IP list:   2.57.122.194 45.148.10.183 195.178.110.30 2.57.122.208 92.118.39.195 103.74.123.88 92.118.39.23 2.57.122.196 92.118.39.197 45.148.10.151 92.118.39.236 178.20.210.185 68.178.161.186 80.94.92.183 92.118.39.63 2.57.122.197 2.57.122.191 2.57.122.189 80.94.92.171 94.156.152.18 14.225.7.70 45.78.198.199 211.253.9.160 159.224.213.138 1.214.42.172 103.239.165.114 77.239.111.233

My choice is OpenWrt and specialized hardware. It is much better suited for home use and has much lower power consumption (i.e. silent). Right now I’m looking for replacement for my home router and going to buy one of Banana Pi boards. However in the US the optimal choice may be different.

I didn’t try many of them. I use Ansible for my job, but sometimes I hate it. I would try Terraform/OpenTofu or Salt if I were looking for alternative.

deleted by creator

you don’t really need to scale a homelab that much

Maybe. But you never know this beforehand.

if something breaks, you just want to quickly fix it manually because “doing the Ansible” is more of a pain

In most cases you just need to replay a playbook for quick fix. But I agree that the proper fix will likely take a longer time (while downtime is much shorter).

now idempotency and documentation-as-code is out of the window.

Let @BruisedMoose@piefed.social decide.

P. S. I don’t like Ansible, other tools can be easier to use. But I don’t want to recommend something concrete.

It is hard, if even possible, to keep documentation up-to-date. Better use a configuration management system (salt, ansible etc.) for your servers. Yes, you need to learn how to use it. Yes, it will take a longer time to make changes in your configuration. But as a result you’ll have a self-documented configuration-as-a-code that will allow you to scale your setup as you need. Reproducing something won’t require reading your notes, remembering your actions etc.

In matrix, chats with e2e encryption are protected from hoster even if they would try to steal your data.

Makin notes is good for sonething very simple. It’s better to automate deployment with salt, ansible or something similar. A bit more effort at first setup, much easier restoration. Self-documented.

I don’t think you gain much from OpenBSD. It is focused on preventing vulnerabilities that are hard to exploit and unlikely used by botnets. Most dangerous are vulnerabilities caused by software misconfiguration. The OS cannot prevent your mistake. Also, in OpenBSD you will be unable to use modern containers like docker, podman etc.

By default your OS is secure. You only have to think about what you expose and how can it be broken in. Disable SSH password authentication. Don’t run software that is provided by hobbyists who have no enough security expertise (i. e. random github projects with 1 or 2 contributors and any software that recommends install method curl <something> | sudo bash). Read how to harden the services you run, if it is not described in the documentation — avoid such services. Ensure that services you installed are not running under root. Better use containerized software, but don’t run anything as root even inside containers. Whenever possible, prefer software from your distro official repos because maintainers likely take care about safe setup even if upstream developers don’t. Automate installing security updates at the day they released.

What doesn’t help:

• Security through obscurity. Changing SSH port etc. Anyone can scan open ports and find where SSH is listening.
• Antivirus. It is simply unable to detect each of numerous malicious scripts that appears every day. It just eats your system resources.The best it can do is to detect that your host is compromised, but not prevent this. It is not security, just marketing.
• Making different rules for public internet and DMZ. Consider there’s no DMZ. Assume that your host can be accessed by crackers from anywhere.

What is Splitwise?

There is only one commit for two years. Seems dead.

Passphrase-protected SSH keys are definetely more secure than passwords.

Stubby.

What is n8n?

I’ve read the article you pointed to. What is written there and what you wrote here are absolutely different things. Docker does integrate with firewalld and creates a zone. Have you tried configuring filters for that zone? Ufw is just too dumb because it is suited for workstations that do not forward packets at all, so it cannot be integrated with docker by design.