![](/static/253f0d9b/assets/icons/icon-96x96.png)
![](https://lemmy.world/pictrs/image/8286e071-7449-4413-a084-1eb5242e2cf4.png)
Setting SELinux to permissive is not a good security practice
Setting SELinux to permissive is not a good security practice
Why not port knocking over TOR?
Well the Star64 from Pine is pretty good, just doesn’t have enough processing power and IO for my liking.
Framework has a laptop in progress if you’re interested
Yeah that’s your situation. Some people are fine with it
Ah, you mean they put the cert in a transparent proxy which logs all traffic? Neat idea, I should try it at home
Private CA is the only way for domains which cannot be resolved on the Internet
Which book is this?
Now look here chap, Quadlet admittedly works fine. I personally just k3s anyway but .pod files work too.
Isn’t being obedient to SELinux a good thing? You could set it to permissive if you want, but MAC systems are essential for security and I personally wouldn’t go without them
Funnily enough Docker compose has never worked for me on Podman. There always seems to be something that is incompatible (also due to me running on Debian). However, I feel like it should become a standard amongst homelabbers and professionals to use Kubernetes manifests going forward, since it is the most portable.
Isn’t c-o really hard to hit, or am I missing something?
Nice config bro
NFS is a pain, no question about it. I used to use longhorn but these days since I’m doing a single node k3s I’m just doing hostpath. It’s that PVCs make intuitive sense to me, but I guess podman will likely work just fine for such cases other than canary deployments and OOTB service-meshes
Well I guess podman works fine for the first few months. Interestingly I still use build-ah heavily for building my custom images
Not needing Kubernetes is a broad statement. It allows for better management of storage and literally gives you a configurable reverse-proxy configured with YAML if you know what you’re doing.
Fail2ban + key-based SSH + self-hosted WAF if you can spin up another machine == 80% of your Web hosting problems gone
Thanks for the comment, that was a good read
You can do that with Wireguard and NAT.
Traefik’s marketing as the “Docker reverse-proxy” put me off since I like technologies to stay agnostic of each other (personal preference).
Your arguments are correct, and usually I’d run a separate web server but I suppose for a homelab having less things to manage is great
I need to try this, thanks