The ACME client generates the private key to keep and a signing request to send to the CA. Once the CA validates your challenge type, the client requests the signed cert over that same channel. It doesn’t interact with 80 or 443 except to complete challenges.

If you update DNS, that would use DNS-01 challenge and you don’t need port 80 open. I am using this challenge type to generate certs for completely internal services. The only reason to have 80 open would be to use HTTP-01 challenge, which requires your server to host a file on a specific url only via port 80. If your service is already public on 443, you could leave port 80 open with a simple http-to-https redirect.

Port 443 would need to be open if you want to use TLS-ALPN-01 challenge, but I would avoid this as it is not easy to use or configure.

My advice for internal services is to setup only DNS-01 challenge and configure your dns to be automatically updated using a dns plug-in. This should almost never fail validation.

Most of these backup solutions try to reduce the amount of data backed up, so the system will process each file and determine if the contents changed and only upload new data. In this case if you modify the file you may end up with 2 16 MB chunks that have slightly different data, and only when the old backup expires and the pruning process completes would one of those chunks be deleted.

Smaller chunks sizes means you get more files written to S3, but less duplicate data when deduping without compression.

When connected to your internal network, what is the results of:

nslookup sub.domain.tld AGH.IP.Address

This should respond authoritative with the IP you need to access NPM’s VIP IP address. If that is not the case, let us see your AGH configuration for your sub.domain.tld.

If that does return the correct IP, verify that it responds to https using curl on Linux or windows (replace curl with curl.exe)

curl -vvvI https://sub.domain.tld/

If this is not connecting or showing a cert error then there’s a misconfiguration on the NPM side. Screenshots of your site configuration for one of the sites would be helpful. The domain name should match sub.domain.tld (not your duckdns) and be bound to the let’s encrypt cert.

Instead of a default gateway you can configure just your VPN IP address to go to your gateway. You might also need DNS servers depending on your setup.

Example: ip route add 1.1.1.1/32 via 192.168.1.1 dev eth0

Note that without a script this may be flaky if you’re using DNS to resolve the VPN. It might be better to have a script that resolves the IP(s) of the VPN and then adds routes.

That being said, your VPN software is usually designed to install routes that have higher priority so that they will get used before the local network. One such way is by adding half-internet routes (0.0.0.0/1 and 128.0.0.0/1) which get preferred over the larger default route. If you run ip route once connected you may see those routes present.

While I’m not sure if it works in rootless, take a look at binhex/arch-delugevpn project which has scripts to set up a similar network isolation environment.

I think NetworkChuck has a good set of tutorial videos about self hosting. For the most part you can search for what you want to find info on and he probably had a video on it. E.g. Nginx: https://m.youtube.com/@NetworkChuck/search?query=Nginx

I think if you didn’t assign a tag on the Release Profile it applies to all series.

I have never done RAID over USB, but have done various JBOD setups using SCSI. I think the general idea is that USB having such an easily disconnected connector plus the latency overhead on translating SATA to USB to SATA again means you have a higher chance of corruption. SCSI setups typically have connectors with locking mechanisms to prevent easy disconnection.

If eSATA is an option it might be better for the performance and it has a latching mechanism to prevent easy disconnection. You can get a 2-port eSATA PCI card for about 50 bucks.

Oh, and if you have a free PCI port, you could add internal SATA ports to mount the drives internally.

I know tailscale prefers being installed on every machine but not all of my machines are even capable of running custom code. I use a single tailscale router that published my internal network to tailscale and if the internet is down everything still works fine internally.

With TrueNas you can do it two ways: ISCSI disks that are mounted to the VMs or via NFS. With ISCSI you won’t have access to the data from the TrueNas side as the data will be stored as a volume file. With NFS you get the best of both worlds as you’ll be able to access the files via other TrueNas services like SMB/SFTP. I have my Jellyfin/Plex running via NFS and have few issues, though I’ve not tested it with large 4k/8k videos yet. I mostly run 1080p.

No wildcard support sigh

+1 for Backblaze. They have a convenient backup software too that works great. I backup my parents laptop using it, and use their S3 storage for my NAS backups.

This would depend on whether the limit is defined as ingress or egress or both. For example AWS has free ingress traffic from the internet but there is a cost for egress traffic to the internet.

A better solution would be to find a unmetered service, which means that you have a fixed transfer speed (e.g. 500 Mbit) but have unlimited bandwidth. OVH offers this in their VPS products.

Sadly, most of the ones I’ve found are too complicated, and getting all devices to accept the CA is more hassle than it’s worth for self hosting. I’ve given up and just buy my wildcard cert for 60$/yr and just put it on everything.

The DNS-01 challenge can be used to generate a wildcard by creating the requested dns record in your public dns zone, then you can use that cert for internal servers/dns. With certain dns providers it can even be automated.

https://eff-certbot.readthedocs.io/en/stable/using.html#third-party-plugins

While this is a great writeup on Lemmy instances, the thread was specifically about Mastodon and it’s numerous forks. I believe they use the same tech but are vastly different things. The instance I found wasn’t quite Mastodon apparently, even though it works very similar and the app designed to connect to a Mastodon instance wouldn’t connect to it.

I’ve been looking for a new instance to join due to various reasons. Ended up setting up and account somewhere and spending 2 hours manually copying over various settings only to find my Moshidon client won’t even connect with that new instance. Normal people are just going to quit when that happens.

You mentioned ping. If you’re using Termux you may need to manually update its DNS settings (different from the system DNS). The file is /data/data/com.termux/files/usr/etc/resolv.conf

To make it roam you probably want your home dns first then some internet resolvers after that.

In days past some drive vendors had different sector layouts for drives and would cause issues with raid. Pretty sure most nowadays are all the same layout and you won’t run into any issues. I still look to get the same drive model anyways just to be perfectly sure that there are no issues.

Even then you may run into weird issues like one of my 1.2 TB enterprise ssd drives was reporting 1.12 TiB rather than 1.09 TiB the other 7 drives had. TrueNas refused to build a vdev with that drive and I had to return it to get a new one.

Typically a Fiber ISP will run Fiber optics only to your DEMARC (or Demarcation) point. This will be usually where your main cable (before any splits) or DSL line used to come in (in the US they’ve been using Orange tubes to indicate this and it will usually run to a panel in some closet or laundry). At the DEMARC they’ll install one of two things: a basic fiber to ethernet converter which will provide you a single ethernet port and a pure tap to the internet, or a Gateway device that will convert the fiber to multiple eithernet with NAT (usually providing other capabilites like TV, Phone, etc).

If you have the latter, you may not get much say in what you can do with your connection, and would be limited to a DMZ mode that is configured on the Gateway. What you put behind the converter or gateway is up to you.