vLLM to host and openwebui for a frontend that I really only use to demo models to friends.

harness

Opencode running with full access inside a rootless podman container with only the directories I want mounted (usually a single project, sometimes read only).

So far though, I’ve only used it to document and report on project repos because Qwen is not that good at actually coding (although it can give pretty decent conf file examples, but not always optimal).

Also useful for parsing pita data dump type files that I’m too lazy to construct multiline awk commands for.

Also I use Jellyfin btw.

You shouldn’t be talking with the amount of hilarious CVEs jellyfin has also had lmao

EDIT:

Literally a critical RCE a couple of months ago lol: https://nvd.nist.gov/vuln/detail/cve-2026-35031

Your downvotes are meaningless, please don’t run Jellyfin publicly exposed without at least some form of secondary ACL whether it be a full blown VPN or just a lazy reverse proxy login like authentik.

And please run inside a non privliged container. Either use uidmap or go rootless.

I’m pretty sure there are multiple hackthebox machines based around jellyfin because of how notorious it used to be with bugs.

Uh no, most if not all of the paid indexers are not worth it compared to just waiting for an open invite from a quality one.

Not even the gold tier quality ones allow paid entry AFAIK. They only allow people who are long time seeders and uploaders with reputation.

The one thing you might have to pay for is a VPN in case you want to torrent on public indexers, which is often worth it because not everything will end up on private indexers, and you usually have to wait a couple of months before you can join a solid private indexer.

I can trip the measly 15 amp breaker by drawing 1.5kW on two servers + turning on an amplifier that is somehow on the same circuit despite being in a different room quite far from where my servers are lol.

On average though I only draw like 350W. The huge spike only happens if I run a miner/llm on both of my servers or the during the startup spike.

The 1kW chunk comes from some RTX Quadro 6000s which each eat 250W each when maxxed out.

EDIT: Want to mention that most machines report their power draw (from mobo) without IPMI, so you can use your favorite stats collector use it to form a rough estimate of kWh total in case you don’t have a proper meter that records usage.

“You can change the logo bruh”

I read the OP which is why I asked the question, not the entire thread just to figure out that you don’t want to use containers.

I don’t want to run a separate database or anything complex, so things like Immich or Photoprism are not an option.

Why not just use podman and let it handle itself? Unless you’re planning on hosting like maybe several million photos, I doubt you would ever need to manually set up a DB.

Just download the compose file, add your photo directory paths to it, and let it start and never think about it again until you feel like updating for some new feature months later.

If its internal network traffic only, you can just use stalwart and add the DNS records to your network so that stuff can use SMTP.

Otherwise, (also with stalwart or your preferred software), you will want to use an SMTP relay so that outgoing messages will be delivered without the hassle of getting your domain reputational enough for sent messages not getting junked by the big email providers.

I’m extra lazy and haven’t set this up, so I just have a public mail server that only receives messages because my outgoing SMTP port is blocked by my ISP.

Saw the title and I already knew IPv6 was still gonna be “not enough adoption” lol.

The overly aggressive lockdown from NAT is not entirely misplaced though. Windows is already notorious for default hosting an atrocious level of protocols that are anywhere between “I can get your NetNTLMv2 hash for free” to “gg ez RCE as SYSTEM user”.

Linux and Unix were also not magically protected either, like every FTP server implementation has had several RCE vulns and it was so bad that Linus himself pointed out how easy it was to abuse buffer overflow vulns even after the addition of NX mem protection with return to libc, several years before ASLR finally landed in Linux and Windows.

Seriously, the early 2000s was the wild west of vulns because everything was still written in C++ so you could just waltz into any binary, find some stack/heap overflow, and you’re on your way to an RCE.

NAT (and firewall) most definitely did prevent millions of users from getting rekt by a metric ton of malware that operated on the ability to connect to those services.

I’m 2 days late to checking the banlist and even though I didn’t make the exact user match, I did make the regex match lol.

20 years of hoarding CVEs down the drain.

Now they’ll never be able to gg ez their way into any country and will have to actually use their bribery budget to get more implants lol.

Yeah I might switch over too because immich didn’t originally have some of the sort and detection features like Photoprism.

Photoprism is pretty good but it doesn’t have some of the nicer UI features immich has.

Photoprism users every time this topic comes up

Supersized Form Factor

If you want something that fits the SFF cube shape so you can throw it next to a TV or desk for video output, you can probably go for the SYS-A22GA-NBRT.

Easy to upgrade CPU & RAM later down the line if you start doing more stuff with it, plus space for dedicated GPU if you ever want to do heavy media server stuff.

Would avoid pi due to the underperformance for the price. Plus best bang for buck usable storage will always be HDDs. SD cards are nice but you have to disable journaling to keep the writes low as to not wear down usable blocks.

NSA is that you?

Also jokes aside, how does the use case compare to some existing tools like BBOT?

This seems morr geared towards public facing targets than targeted information OSINT (user profiling, etc.)

Domain for $8 a year and 300Mbps fiber for $45 a month which snake ass AT&T keeps increasing in 5 dollar increments, so thank you for reminding me to call Spectrum for a quote so I can then call AT&T and harass them into giving me the correct price for another year.

• Anything that you can shove hardware into (CPU, RAM, HDDs, maybe a PCI slot), so any used workstation is a great start, and don’t bother splurging initially, just follow the quality tool rule and only buy when something becomes inadequate. If you want to jump straight into loud and noisy severs, you can pick up used servers for cheap like R730s which there’s a ton of out there. Just avoid 2.5" drive bays because 3.5" HDDS are way cheaper per Gb.

• Would recommend podman over docker as its matured to the point where it has a lot of better features like rootless, quadlets, etc that you might want to take advantage of in the future. OS is whatever linux you prefer, but I recommend you stay away from Ubuntu. If you want something RedHat but not as cutting edge as Fedora, I’ve heard OpenSUSE is pretty nice.

For apps, If you want to do HTTPS via GUI then npmplus is nice option, Otherwise caddy can do the same with text config. Rest is whatever you want to try out :)

EDIT: If you start making an *arr stack, I would recommend recyclarr to handle the quite expansive content filter settings for sonarr and radarr.

I hate to break the news but the issue with Bitwarden is that the client sucks total ass, and there are no drop in 3rd party replacements for the browser plugin.

Been running Vaultwarden for a while now and even though the sync implementation is nice and clean, it’s just not worth the end user experience.

This is really dumb when compared to literally every other password manager, open source and enterprise which does a much better job of actually being a password manager and not a glorified encrypted text file.

I’m eventually going to switch back to KeePassXC and just suggest setting a master password with Firefox’s builtin password manager for everyone else who just wants a painless user experience and not have to deal with syncing vaults.

Wireguard.

Dunno if Cloudflare does effective auth for the tunnel or if you have to set that up yourself, but I don’t bother trying to expose services to the internet in any way because some of this stuff was just never designed for proper web security (cough Jellyfin).

It’s still worth setting up a wildcard cert with ACME so you get nice https and a real domain.