Radicale and immich replaced my nextcloud instance and I never looked back. I have both updating through apt like everything else and it’s amazing how little maintenance it requires.

OMG patching all the vulns. I actually pulled my wordpress offline overnight for that one. Still waiting on the Ubuntu patch for that IPv4 kernel CVE.

That reminds me - It’s time to do No NAT November again. This CVE gives me an excuse. Last year, the Nintendo Switch Switch and Steam were the big standouts. I think the Switch 2 will actually work with it now.

Oh, and my workplace is shifting offices, so my offsite backup is not offsite. Must take care to not burn the place down. I just put new fans in my PoE switch and now I can hear a server fan is dying too. There’s a lot of maintenance work to all this.

Same. I just stopped apache and let everything else run.

Sir, this is /c/selfhosted.

Oh, you can tear it down as soon as you get the certification.

Mine still runs decades later though.

If your domain registrar doesn’t do DDNS, and you don’t want to pay extra for one that does, you can get free DNS for life at Hurricane Electric:

https://dns.he.net/

All you need to do is finish their little online IPv6 course. TBH the “course” is just setting up your own server properly and proving it.

When I retire my desktop PC, the old parts become my router. If you have two network ports, it can do it.

To warrant the power bill, it’s also a NAS, NVR, mail server, print server and web server.

All my Wifi APs are various home routers flashed with OpenWRT.

It’s running the private DNS for my phone. If it goes down, I realise quite quickly.

Nope. I don’t use them. Especially not to communicate with a server in the same room.

It’s because people keep finding ways around them and they evolve in nonsensical ways.

I’ve been on IPv6 years before Google turned it on. My ISP gave me a /48 and I’ve got different subnets for my WAN, LAN and guest LAN. I have a 4-port NIC so I could put a different subnet on each port.

I didn’t mention it in my first post, but I only made AAAA DNS entries for my internal stuff. I just enable IPv4 for the few services that actually need it.

Nope. SSL certs are pinned to the hostname, not the IP address. I can change the IP address in DNS and it will still work.

That’s exactly what I’m doing.

I’ve also got a completely different DNS config for WAN and LAN traffic. WAN devices can only resolve PTR records for my mail server. My LAN devices have DDNS so internally they a get allocated DNS entries by hostname. Even my guest network has a different config for isolation.

They definitely all need to be kept separate.

Routing between two interfaces on the same NIC takes nanoseconds. You wouldn’t notice a performance difference.

When I first set it up, I didn’t have a static IP address, so it would not be great when it changed. I also want my server to remain reachable locally if my internet goes down. I had different firewall/ACL rules for wifi too. For example, some of my internal websites only prompt for a login if you’re outside the network.

IPv6 has been awesome here. I have my server and clients on different /64 subnets in the same /48 block. The nearby devices on Android assumes only the same /64 is local.

I think Firefox also gave me the first clue that something was up.

Native apps all have a backwards-compatible setting so it’s allowed by default. That will surely get dropped when Google bumps the minimum Android target API so newly published apps need to explicitly configure it.

I actually went through my apps list and disabled nearby devices for all the apps that don’t need it. It’s a good security measure. I just don’t like how it was rolled out.

I self-host a DoH/DoT server and my local DHCP advertises it to local clients. It’s kinda cool because android phones on my wifi will use DoT when private DNS is set to “automatic”.

Private DNS sort-of broke while I was tinkering with internal/external IP addresses for nearby devices. It wouldn’t always connect when I specified my external IP (despite being available externally). I made it IPv6-only too. It wouldn’t be the first time something couldn’t handle it.

I’m actually on GrapheneOS.

I’ve found that you can deny “Network” permissions and permit “Nearby devices”. The app becomes LAN-only this way.

I’m actually using GrapheneOS.

It would be annoying to do that for everyone who uses my wifi.

I found that “Conversations” (XMPP) was blocking a connections even when the permission was enabled. I suspect Android no longer allows connections on port 5xxx on a local network. It works fine when the IP is external.