Ah, you are using pretty different deployment then, even the used postgres image is different then the usual deployment ( pgautoupgrade/pgautoupgrade:16-alpine instead of postgres:16-alpine) this might or might not cause differences.

I would try increasing POSTGRES_POOL_SIZE to 10-20, but I am guessing here, the idea being that lemmy is hammering postgres through the default 5 conns which increases CPU but that is a bit of stretch

do you also have pict-rs connected to this postgres instance? that is surprisingly low number to me, I would have expected anywhere between 20-50 active connections (I use 50 for lemmy and 20 for pict-rs, configured in their respective conf files)

extension “pg_stats_statements” is not available

According to this https://stackoverflow.com/a/72966651/5881796

The extension is not loaded: CREATE EXTENSION pg_stat_statements;

hmm, how many connections are used SELECT count(*) FROM pg_stat_activity; ?
I am not a master postgres admin but my intuition has been that the amount of connections is a big factor in how pg behaves with cpu and mem.

Do you have any tweaks of pg settings? Eg. shm mem, shared_buffers etc. ?

If not you migh want to: https://pgtune.leopard.in.ua/

Steam is close but actually not electron, they use CEF - Chromium Embedded Framework which is something Electron uses too under the hood (afair)

I know HEALTH.
Are you telling me I have been listening to cum metal?

Registration hooks could be powerful

Thanks for the explanation, I have played with like 30 mods max so the built-in mod manager seemed enough.

Also FYI all your english comments here are posted with language set to dansk so I couldn’t find it even though I got the notifications (seems lemmy does not really tell you you are trying to visit a comment in language you don’t have enabled in settings).

Why would you need this?

Maybe this https://github.com/Alinto/sogo

I wouldn’t recommend putting ssh behind any vpn connection unles you have a secondary access to the machine (for example virtual tty/terminal from your provider or local network ssh). At best, ssh should be the only publicly accessible service (unless hosting other services that need to be public accessible).

I usually move the ssh port to some higher number just to get rid of the basic scanners/skiddies.

Also disable password login (only keys) and no root login.

And for extra hardening, explicitly allow ssh for only users that need it (in sshd config).

Non-zero days

I don’t use nginx proxy manager but websocket has to be enabled for apps that use websockets (duh) - you would have to dive into docs or example infra configs to check if the service uses it.
Rule of thumb here would be to enable it for everything. Optionally you could check if the service works with/without it.

E: Websockets are used when a website needs to talk in “real-time” with the servers - live views and graphs will usually use it also notifications, generally if the website does not reload/redraw fully but data seems to change then there is a high chance it uses websockets under the hood (but there are ways to do it without ws, ex. SSE).

Example: Grafana uses websockets but qbittorrent web ui uses other means (SSE) and does not require ws.

borg backup with rsync.net

Borg does de-duplication and compression, I’ve used it for multiple things like backing up minecraft servers and it can reduce the final backup size by a lot (like 1-2 TBs to a hundred of GB, though that was with content that was highly compressible and didn’t change much over-time so the deduplication did a lot too).

There is also borgbase.com which looks a bit better and focuses only on borg repositories instead of also being compatible with just about any usual tools (eg rsync, rclone etc)

I would try momentarily replacing the defined dns servers with nameserver 1.1.1.1 and see if stuff improves, though the pull error would hint that docker did resolve the name but somehow didn’t get an answer.
Hard to guess what else could be a problem apart from some obvious stuff - check if the internet connection is healthy and stable (ping, watch for spikes in ms or drops, also any outgoing firewall filters?)

nope

There is also FX which can do this too, additionally you can browse/download/upload files to/from the phone locally from PC through browser (the app opens up a web server).

We’ve consolidated all our code into a single repository – just clone ente-io/ente on GitHub, and you will have at your disposal a state of the art, end-to-end encrypted, full stack (mobile/web/desktop clients, the server, and a CLI to boot) alternative to Google Photos and Apple Photos.

I have been on the hunt for Awesome WM wayland alternative and this actually looks pretty close to my current setup.