Data Hoarder 💾

• Fleet: 2–3 devices · More than 50 TB
• Motivation: Independence from Big Tech & subscriptions, Fun / the hobby itself, Privacy & data ownership
• My MVPs: Jellyfin, Plex, Foundry, Immich, Pangolin

Yeah, will not work for everything. Things with actual phone/TV apps generally dont like it. That being said, it still helps for a large swath of my setup

I’ve had good success spinning up an authentik instance, and having my reverse proxy hit it first before it routes to the actual app. Puts another security layer in front in case sonarr itself has an issue, for ex.

Caddy snippet

handle {$host} {
		route {
			# always forward outpost path to actual outpost
			reverse_proxy /outpost.goauthentik.io/* authentik-server-1:9000

			# forward authentication to outpost
			forward_auth authentik-server-1:9000 {
				uri /outpost.goauthentik.io/auth/caddy

				# capitalization of the headers is important, otherwise they will be empty
				copy_headers X-Authentik-Username X-Authentik-Groups X-Authentik-Entitlements X-Authentik-Email X-Authentik-Name X-Authentik-Uid X-Authentik-Jwt X-Authentik-Meta-Jwks X-Authentik-Meta-Outpost X-Authentik-Meta-Provider X-Authentik-Meta-App X-Authentik-Meta-Version
			}
			
			reverse_proxy {this_host_or_ip}:{this_port}
		}
}

Not gonna solve all your problems. Works for 70% of apps. Nice to slap on when you can.

• havent figured out how to rate well when driving. Definitely a PITA.
• i considered skipped counts a bit, but ultimately felt it would end up hiding songs that were good but required me to be in a specific mood to appreciate. I wanted to be the judge of if something was good and feel free to skip good things when I felt like it.
• another thing my suite was missing was the new music discovery story. Made a personal app myself to fill that gap, but would love to see a more robust community solution someday. Maybe ill give it a proper dev pass someday and publish

Star ratings and smart playlists! Oh my! I love this stuff. Im currently using plex, which allows for half stars since im a masochist

I dont know that I need the full ten options, but 5 wasn’t quite enough for me. If there was like 7 star system id do that, hah.

• 0.5 - I would delete if other people weren’t listening to the library. Never play again
• 1 - on my shitlist. Unless something changes, will probably go to 0.5 stars the next time I hear it.
• 1.5 to 2 - Not opposed, but forgettable or slightly not my style
• 2.5 - average content. Not memorable but fine
• 3 - solid content, still not memorable
• 3.5 - the good stuff. I’ll put it on a solo car ride and generally not skip
• 4 - Amazing songs. If I was to put a Playlist on for other people and not worry about it
• 4.5 - Favorite songs. Maybe a fault or two but will still stay with me for a lifetime
• 5 - Id play these for anyone without hesitation and then look at them and say “was that not perfection?!”

For smart playlists:

• playlists by star rating
  • alts for excluding facemelting stuff to play in public
• Car ride - 3.5 stars and up + havent heard in a month
• “Frontier” playlist. Only play things i havent heard in a year that aren’t 0.5 stars

I generally listen to my frontier Playlist and try to rate as I go. Other playlists for when im listening but busy and just want the good stuff.

I havent found a good way to tag on the go, unfortunately. Maybe someday

I use pangolin as the front, which checks in with Authentik as the SSO before it lets anyone through to the actual apps. Pangolin itself acts a bit like my reverse proxy so my caddy takes a back seat and isnt used for too much. Pangolin comes with crowdsec as well.

Yup, its a good game as well. It’s a bit too zippy fast paced for my tastes. Everyone jumping and ziplining everywhere ruins a lot of the cool positional tactics that can manifest in games that keep the movement abilities modest. By the time someone calls out a position its already moot information. But finals makes up for it in other ways like the destruction, etc. Definitely a good game

The hook for me is the lack of respawn numbness. Something about insta respawn shooters just turns my brain off and lulls me into boring mental stagnation as I throw myself on the gears. It’s the high longer term stakes that are the interesting part. Failing in the heat of the short moment, and thinking back on what you mightve done better. But you’ll never experience that exact situation again, so you just try to carry your lessons forward. It’s a different pacing that keeps things novel and memorable

To each their own, but i enjoyed every second of my several years playing PUBG. It’s the same hook as Ironman style high paranoia solo games like Project Zomboid or many others. High stakes, ambient stress, and extremely quick and sudden failures that hone your instinct for next time. I enjoy single player games and many other genres as well for different reasons/goals. I dont think the royale/extraction genres are just fundamentally faulted like you suggest

Sounds great in theory, but I always feel bad transforming my data too much so I can no longer seed, hah. Maybe someday

Posted in a similar thread

My baseline is a public VPS with Pangolin/Crowdsec installed. I have authentik as a login system. Pangolin let’s me put authentik in front of any service so they have to log into it before it gets to the service in question whatsoever. This is different than the app itself just using Authentik as the OIDC provider. Helps give a bit of peace of mind with the services which themselves might not be security focused. Also, these pangolin routes are able to block anything outside my country by rules, so that trims a good portion of attacks as well.

Some things don’t like that authentik layer in front though. Audiobookshelf’s phone app for example cant handle it. For that, I route those domains through cloudflare tunnels. Their tunnels do a good job blocking lots of attacks, so not having authentik in front is more acceptable.

But then there’s jellyfin that doesnt want to be on cloudflare tunnels and doesnt want authentik in front. For that, I just have it on my pangolin side with only crowdsec helping. Not ideal, but best I can do without making my grandma install a VPN on a raspberry pi in so her TV can connect or some shit.

And lastly, I have some private services like forgejo that don’t like authentik in front and only I myself care about. I tailscale to those rather than exposing sometimes.

What youre talking about is having an app refer to authentik to find out who a user is.

Internet -> audiobookshelf -> asks authentik who it is

In addition to that, you can set pangolin up so that it doesnt even hit that app in the first place at all unless the user is already signed into authentik.

Internet -> pangolin makes user log into authentik before forwarding along -> audiobookshelf -> asks authentik who it is

So if the app in question has a security vulnerability, its not a problem because no one even gets to the app at all to begin to try to exploit it unless they’ve logged into authentik first.

My baseline is a public VPS with Pangolin/Crowdsec installed. I have authentik as a login system. Pangolin let’s me put authentik in front of any service so they have to log in hit before the service in question. Helps give a bit of peace of mind with the services which themselves might not be security focused. Also, these pangolin routes are able to block anything outside my country by rules, so that trims a good portion of attacks as well.

Some things don’t like that authentik layer in front though. Audiobookshelf’s phone app for example cant handle it. For that, I route those domains through cloudflare tunnels. Their tunnels do a good job blocking lots of attacks, so not having authentik in front is more acceptable.

But then there’s jellyfin that doesnt want to be on cloudflare tunnels and doesnt want authentik in front. For that, I just have it on my pangolin side with only crowdsec helping. Not ideal, but best I can do without making my grandma install a VPN on a raspberry pi in so her TV can connect or some shit.

And lastly, I have some private services like forgejo that don’t like authentik in front and only I myself care about. I tailscale to those rather than exposing sometimes.

Only other thing I think I need to add sometime is some VLAN separations?

Solidarity. New people are being forced to deal with this enshittification wave. We may be immune to it (for now), but the more people involved and excited about the alternative the better it’ll be. Yeah, I got mine… but we can also be involved in something better.

I think the thing is, every news cycle there IS a few people who’s time has come. And so jellyfin is brought up

I say this as someone who has a plex lifetime and is still using plex. I appreciate everyone getting riled up and passionate, because that means the fallback will be that much more polished when my time comes.

You sound like someone pulling up the ladder and yelling at the people below to shut up. Anyone new to the space is dealing with this absurd $750 lifetime price. Of course they’re yelling

Best I’ve done so far is crowdsec + pangolin geoblocking to just my country. I cant install tailscale subnet routers at all my friends to get their TVs to work. Non starter.

Donetick is what I use for this kind of stuff. Still needs a bit of work on the OIDC systems, though

Looks like a cool idea! I could see the mappings getting out of hand real quick if you actually braindumped everything in there. I think it needs some more collapsing functionality so i can close sections when im not focused on them.

True, everything is everywhere and this aims to put everything in one place… but that can be equally detrimental to ALWAYS have everything in one place. I guess you have some “control” in how far you put things from each other, but probably needs more tooling besides that for organization and especially “archiving”.

Awesome!! I had been wanting to make something like this, but never got around to it. Excited to try it out tomorrow

It’s set up on the same box as my caddy install. I believe it’s getting passed the real IP because that’s what gets banned, and what I type in to unban it.

It just sees normal operations as http probing. Like if some other service goes down, my GetHomepage will then 404 and that’s seen as probing. It bans surprisingly quick. Even after just one or two events (normal for someone just visiting the homepage) it’ll just kick em right out

I’ve been having to inspect every alert and hand write whitelist parsers to whitelist 404s or whatever it may be for that app. Slowly accumulating a workable collection… but seems like I’m missing something as no one else seems to complain about this in threads like these

Another example is my brother got banned for normal audiobookshelf usage. He just thought the server was buggy. It was just blocking him without us really noticing or thinking much of it at the time. Not great