I just don’t like my logs filling up with scripted login attempts. Even with fail2ban, for a while there I was getting 100+ login attempts every day, and it upset my sense of order.

This is an old post about ipv6, but it inspired me to go looking, and I wanted to share my findings.

1. for globally routeable IPv6 addresses, probably do let it happen automatically, either direct from the ISP, through the router by prefix delegation, or your own implementation of prefix delegation.

2. for devices you want to access, internally, create a ULA within the fd00::/8 space, and assign numbers (and names) however you like. Translate all your 192.168.x.y IPv4 addresses to fd00::x:y and go. Only limitation is you won’t be able to access those devices, using the ULA, from outside your network.

3. you can do both of these on the same subnet, and devices pick up both addresses then use the global address for internet and the ULA for intranet.

That means you can do dhcp, dynamic DNS, private domains, and all the stuff you know about IPv4 for IPv6, and still do all the stateless autoconfig that “they” want. Some devices, like my android phone, never played well with dhcpd6, but immediately preferred IPv6 as soon as I let them SLAAC.

If the prefix assigned by the ISP doesn’t change, then device SLAAC address shouldn’t change, either, because they’re calculated from MAC, so if you need to access some internal devices from the internet, you have to mark that address, but (IMO) marking the full address is not that much worse than marking the prefix and remembering the device number.

I do ssh because I’m more comfortable with it: it’s ubiquitous and as close to bulletproof as any security. Put it on a nonstandard port, restrict authentication to public keys, and I have no qualms.

Heh. House I rented was built before ubiquitous electricity. At some point, someone slapped a fuse box on the outside of the back wall and drilled a bunch of 1" holes in said wall to pass wiring. House was built on piers, so they just dragged wires around to places where they wanted outlets, which were mostly planted in the floor. Not a ground wire on site. I have no idea how they got away with renting that out, but it’s not like I called code enforcement, either.

Yeah, I think it really depends on use case. Like, I’m trying to imagine what aspect of my home lab could go so wrong, while I’m out of the house, that it would need fixed right away, and there’s nothing. I only leave my house for work or maybe a week of vacation, though, and I can imagine someone who’s occasionally away from home/house for 6-month deployments, or has a vacation home they only visit four weekends a year, might want more extensive remote maintenance. I’d still want to do that via ssh or vpn, but that’s me.

fd00:: is the new 192.168

Yeah, my ISP “supports” IPv6, but assigns a /128 to users. It seems to wipe out most of the desirable features of IPv6, and has probably given me a distorted view of its philosophy. OTOH, it did force me to learn how to do DNS views, so names can have the ULA address inside and the global address outside the house, which is pretty cool.

IPv6 does have private spaces. Any prefix beginning with fd is ‘private,’ and (IIRC) there’s a formula to generate the next 40 bits of prefix to minimize the chance of intersections. i.e., you can generate your own internal /48 functionally equivalent to 192.168/16 or 10/8

Don’t know if you can use that with SLAAAC, but it works if you run a dhcpv6 and makes ipv6 feel a lot like ipv4. You have to NAT everything inside &c, but if you already have a functioning internal IPv4 network, IPv6 is just a matter of figuring out which config options need to be changed (eg, dhcp6.name-servers for option domain-name-servers)

Definitely agree for a single install. If OP has a bunch of these installs to do, then editing an install USB to configure networking and enable sshd might be worth the effort. Do the install over ssh and hope the machine starts up as desired, but even then, if it doesn’t just magically appear on the network, he’s going to need a monitor to see where the startup failed.

Raspberry Pi’s disk imager will let you pre-configure networking, accounts, and ssh, so you just write the image to an SD card, plug it in, and go. That’s a great solutions for systems usually meant to be headless and removable media. If OP’s client hardware allows, he could plug in the M2 or SATA drive meant to be the server’s startup, install Deb there, and. transfer to the server hardware. That’s definitely more work that just swapping the keyboard & monitor, but it accomplishes OP’s stated goal. (Otherwise, a lot of this thread follows the linux meme of “How do I [X]?” “[X] is dumb, do [Y] instead.”)

Especially if she has 20 years’ experience with CC apps. All of the deeply entrained jargon, keyboard shortcuts, menu structures… Switching apps after that long takes months of training and practice, and the cost of that training is a key lever of enshittification.

With 25 GbE, even 10, I’d be tempted to PXE boot client systems. Maybe still have a local PCIe SSD for windows game files.

Dunno how that would actually work with Windows, but it was fun when I did it for beowulf nodes. Setting RPis to netboot is a little involved, but you can create an OSMC image and give all your TVs a consistent ‘smart’ interface. You don’t even need 10GbE to be pretty functional for the Pi, but my experience is that WiFi is not fast enough.

There are 3rd party plugins for kodi to work with a lot of streaming services, using your account and not ‘cheating’ in any way that’s obvious to me.

Netflix: https://forum.kodi.tv/showthread.php?tid=329767

Fairly extensive collection: https://github.com/matthuisman/slyguy.addons

I don’t get this counter-argument. Is TFA actually suggesting that the average grandma quit using Yahoo mail or Facebook and set up her own email server and mastodon instance? The only people even considering self-hosting are people with technology interest and reasonable passion. It’s an article written for a niche techie website, and we’re discussing it on a forum for self-hosting nerds.

The counter-argument is like saying the average layman should stick to televised football, because they don’t have the physical savvy or aptitude for the game, and most people aren’t gonna put in the time or effort to build their strength & endurance to compete. It may be an accurate statement, but the people you’re addressing (grandma) weren’t TFA’s target audience and weren’t even going to try in the first place, and you discourage people who might really enjoy giving the hobby a try.

Depends on how you calculate costs. Like, I have Kodi running on a RPi for home entertainment/theater. There’s no way to outsource that, but the RPi is idle most of the time. Adding services to it is effectively or marginally free, except for my time, and there’s still a significant time cost to get paid, off-site cloud services set up.

But charging for your own time is kind of disingenuous. You don’t include your time in the cost of eating (a Big Mac worth $60??), watching a video, or going on vacation. The only people self-hosting have a personal, hobby/entertainment interest in it, and I think it’s more accurate to compare the costs of self hosting with the costs of other forms of entertainment. Do you get more fun-value out of the costs of self hosting or out of a theater ticket?

I’m a big fan of Backblaze’s failure statistics. https://www.backblaze.com/cloud-storage/resources/hard-drive-test-data

Annualized failure rates go from 0.3%/year to 3+%/year, even just looking at the drives they have million+ hours for, and I’d rather be at the lower end of that 10x range.

HA doesn’t require 4/4/32, that’s just the hardware the HA people sell. (which, given that your phone may be 8/16/128, is hardly “robust”). Generally, the Home Assistant crowd kind of target an audience that’s probably already running some kind of home server, NAS, or router, and HA can probably be installed on that device.

Theoretically, there’s no reason the HA server couldn’t be installed on your phone, except then your smart home functions would only work while your phone is in the house and not sleeping. Kind of defeats the point of a lot of it, unless you’re just thinking of smart home like “remote control for everything.” Regardless, much smaller niche for an already-small market, and apparently not a priority for the dev team.

I can see that. Most of my house gets enough light - or streetlights at night - to walk through with the lights out at midnight. Add in a lumen sensor, though, to dial lights up when it’s cloudy and down when it’s sunny…

When I think of automations, it’s either things like coordinating big power draws to cheap electricity or trivial quality of life enhancements, like turning out the lights in an empty room. The latter, I have trouble justifying to spend on occupancy sensors and smart switches if it’s only going to save 20 Watts of LED or five steps. Once it’s become your hobby, it’s much easier to say, “I’m going to buy these sensors because they’re fun to play with and it gives me joy to see them work.”

I didn’t think I was. I got sucked in by sensors to monitor indoor temp, humidity, air quality… A smart switch to turn lights on and off when I’m not home. Now I’m thinking of how to turn the HVAC fan off when IAQ is good and temperature is comfortable. I’m not ready to have the house turn lights on when I enter a room or start the oven when I get within a mile of the end of my commute, but it’s been growing, one $30 gadget at a time with no subscriptions and no data leaving my LAN.

+1 porkbun. $1.60 for a .top whois privacy. 2FA with security key. Even let me host my own nameserver, so I can have separate internal and external views.

I recently set up DNSSEC on my home domain, and I have been shocked to learn that none of my financial institutions use it. Going back through my logs, the only external host that even tries is api.weather.gov, and only for the CNAME pointing to a CDN host.