Thank you, that’s an excellent read! This reminds me of the “expected value of perfect information” - sometimes it is worthwhile to answer a question, and sometimes it isn’t. Every once in a while I find myself in an engineering call discussing a minor problem, and I run the numbers to see if the change we are discussing is even worth talking about. One time the combined salaries of the people on the call had already outpaced the cost savings of the change over the next 10 years. We quickly stopped that discussion lol

I recently picked up a pipe. It has all the rituals and escapism of a cigar, without the hour-long commitment.

That being said, sometimes being”occupied” for an hour is part of the appeal. Each has their place ime.

Is American Pragmatism a thing? If you explain it to me, will I feel better about myself?

Indeed, and good points. How many users do you have? I assume this isn’t just for you, and setting up multiple nfs shares with tailscale access policies isn’t feasible. SMB might be the best play. I’ll have to refresh my memory on file sharing protocols

NFS for storage, tailscale / wireguard for access control?

Put http://0.0.0.0:11473

Your current setting is the “loopback” address. You’re listening for traffic to this address, and the only thing that can send to the loopback is yourself. This is a safe default, it means only the computer running the software can talk to it. Generally 0.0.0.0 listens on all available addresses. If that doesn’t work, use your local / internal ip.

This ui smells like it’s trying to hide the implementation details, but that makes things extremely difficult when troubleshooting

You can reduce doorknob turning dramatically by running on a non-standard port.

Scanners love 80 and 443, and they really love 20, but not so much 4263.

I used to run a landing page on my domain with buttons to either the request system / jellyfin viva la reverse proxy. If you’re paranoid about it, tie nginx to a waf. If you’re extra paranoid, you’ll need some kind of vpn / ip allow-listing

The other six are (copied from the article):

1. PUBG (3.2 mil)
2. Counter-Strike: Global Offensive (1.8 mil)
3. Counter-Strike 2 (1.4 mil)
4. Lost Ark (1.3 mil)
5. DOTA 2 (1.2 mil)
6. Cyberpunk 2077 (1 mil)

That looks promising. Just keep in mind that this will take a very long time to run. I believe there is a *arr out there that can manage this / show progress, but the name escapes me

Other comments here do a great job pointing to DH key exchange; I’d like to try explaining it with the paint analogy.

You and Youtube need to agree on a “color of paint” (encryption key) without ever sending it over the network.

You and Youtube agree on a common “yellow” in the clear, and you each pick a secret color. Youtube mixes yellow and their secret and sends it to you. This is okay, because un-mixing paint (factoring large prime numbers) is really hard. You add your secret to the mixture, and now you have yellow+Youtube’s secret+your secret.

You mix yellow and your secret and send it to youtube. Youtube adds their secret; now they’ve got yellow+Youtube’s secret+your secret. You both have the final color!

An eavesdropper can’t reconstruct this - everything sent over the network had yellow mixed in, and un-mixing paint can be really hard. Maybe you can guess that green minus yellow is probably blue, but you can’t get close enough to decrypt anything. And what if it’s brown? Is that blue + orange, or is it red + green?

Cryptographers have worked very hard to make the communications secure. I would be more worried about the other end ratting you out - using a relay / proxy / vpn that you trust is a good idea :)

Your network flow is from your server, to your router, to your android phone, to your router, to your chromecast. If that’s all wifi, then every frame crosses the air 4 times, and you’re doing transcoding on the phone in the middle.

Casting sucks.

Wireguard creates a new network interface that accepts, encrypts, wraps, and ships packets out your typical network interface.

If you were to create a kernel network namespace and move the wireguard interface into that new namespace, the connection to your existing nic is not broken.

You can then use some custom systemd units to start your *rr software of choice in said namespace, rendering you immune to dns leaks, and any other such vpn failures.

If you throw bridge interfaces into the mix, you can create gateways to tor / i2p / ipfs / Yggdrasil / etc as desired. You’ll need a bridge anyway to get your requester software interface exposed to your reverse proxy.

Wireguard also allows multiple peers, so you could multi-nic a portable personal device, and access all your admin interfaces while traveling, with the same vpn-failure-free peace of mind.