Is a VPN needed to keep your ip from being exposed ?

No more so than using any search engine directly, it’s a nice to have. Don’t let perfect be the enemy of good enough.

Is just using an existing searxng instance just less secure then?

By the time you’ve investigated it, you could have stood up your own instance…

Sounds like a them problem then.

podman exists and doesn’t force root…

It’s yours, no issues trusting a public instance with your searches. Pages full of settings to tweak as you like. Less problems with an algorithm ‘helping’ you. It averages searches over multiple search engines that you choose, you can set up your own (or a curated) block list of crappy AI slop sites, don’t like fandom.com or something, gone. Manage your own bangs, e.g. !aa for annas-archive. Pipe it through a VPN with gluetun for better isolation. If you have your head around docker already it’s more like half an hour to set up, so why not?

Can hook it up to perplexica and a local LLM for a fully local AI search that you define, use it as a MCP server, do deep research with it…

I do it with a gluetun container (more versatile) zero issues, but you can just mainline wireguard as an interface if you prefer, also works fine, on bazzite.

know truth from fiction.

You jest, but…

You are aware that Netflix et.al. put compression on their streams (usually quite a bit in regards to bitrate) ? It is often the case that BluRay rips etc. are available better on the high seas…

While I generally agree and consider this insightful, it behooves us to remember the (actual, 1930s) Nazis did it with newspapers, radio and rallies (… in a cave, with a box of scraps).

Thinkpads have long had first tier linux support, in fact many models have shipped with linux for at least a decade (?), checking that is a really good way to be sure, but you’re going to be fine with W, P, T, X lines, many enthusiasts make light work. They were deployed (might still be) to Red Hat kernel devs for a long time, which helps things along. Fingerprint drivers tend to be proprietary and hit or miss, but passwords work.

Honestly learning to install linux yourself, and configure it to your liking, is actually, imo, a really important path to learning and you’re likely doing yourself a disservice avoiding it. It’s part of the avoidance of vendor lock in you want. Installation is surprisingly easy now, start with something simple, Mint is often recommended these days, find a decent, recent, youtube and you’ll probably be up and running in an hour. Find the apps you need for your workflow (which will take considerably longer). Get familiar with the terminal. Best thing you can do after that is burn it down and install a new distro, leaving any mistakes behind, keeping your list of apps. Arch if you want to get really deep into it, or Fedora / Bazzite are good choices and very stable. Best of luck.

You can cycle the smaller drives to cold backup, that’s not a waste. You do have backups, which RAID is not, right?

Sure, works fine for inference with tensor parallelism, USB4 / thunderbolt 4/5 is a better (40Gbit+ and already there) bet than ethernet (see distributed-llama). Trash for training / fine tuning, that needs higher inter GPU speed, or better a bigger GPU VRAM.

Seems like data integrity is your highest priority, and you’re doing pretty well, the next step is keeping a copy offsite. It’s the 3-2-1 backup strategy, 3 copies, 2 media (used to mean CDs etc but now think offline drives) 1 offsite (in case of fire, meteor strike etc), so look to that, stash a copy at a friends or something.

In your case I’d look at getting some online storage to fill the offsite role while you’re overseas (paid probably, but a year of 1 or 2 Tb is quite reasonable) leaving you with no pressure on the selfhosting side, just tailscale in, muck around and have fun, and if something breaks, no harm done, data safe.

I’ve done it for what seems like forever and I’d still be worried about leaving a system out of physical control for any extended period of time, at the very least having someone to reboot it if connectivity or power fails will be invaluable, but talking them through a broken update is another thing entirely, and you shouldn’t make that a critical necessity, too much stress.

I say go for the desktop for grunty work and pick up an older thinkpad for the mobile use case or just remote in with your macbook. I have a T580 (last of the dual batteries, infinite battery life baby), works an absolute treat on linux and next best build quality to a macbook but with a repair manual and massive upgradeability.

Don’t sleep on switching to nvme.

The old adage is never use v x.0 of anything, which I’d expect to go double for data integrity. Is there any particular reason ZFS gets a pass here (speaking as someone who really wants this feature). TrueNAS isn’t merging it for a couple of months yet, I believe.

Yup (although minutes seems long and depending on usage weekly might be fine). You can also combine it with updates which require going down anyway.

You’ll be wanting sudo ostree admin pin 1 seeing as 0 was broken. Double check with rpm-ostree status.

Proceed to rpm-ostree update, if that does nothing it means 0 is up to date, personally I’d just wait for a new update using the working deployment, but you can blow away 0 and get it again if you’re keen.

Basically, you want to shut down the database before backing up. Otherwise, your backup might be mid-transaction, i.e. broken. If it’s docker you can just docker-compose down it, backup, and then docker-compose up, or equivalent.

Hanlon’s razor: Never attribute to malice that which is adequately explained by stupidity (or incompetence).

This works for individuals, but when it comes to corporations, you really have to ask, why not both?

Clear as mud. (I actually dimly get it, I’m a dev, but mere mortals will be clueless and move on). Farcaster is right, you need to define terms and give examples of actually getting this up and running, you’ve got way too much internal context that you’re not making explicit. Not an attack, trying to help, project sounds cool.