At least they’re admitting their fault.

Edit; Their matrix room if anyone is interested.

https://matrix.to/#/#selfhosted:selfhosted.chat

I would argue and say that it is poor implementation on your developers behalf, Lemmy itself supports it, your client is failing to properly render the image.

As mentioned previously, Voyager displays the image as intended.

from an actual search company that values privacy.

California company obliged by FVEY? While I appreciate their efforts, American based companies kind of have a history of abandoning their privacy-respecting ways once subpoenaed.

Entirely depends on the instance admin and whether or not they keep it maintained and up to date.

If you don’t trust the platform then you shouldn’t be using it. No bandaid like antivirus or firewall can help with that.

I mean, if you don’t have a firewall on the device itself then your router certainly does, your device requests xyz port open your router will oblige with UPNP unless explicitly denied.

The on-device firewall is just an extra step before it hits your router’s firewall anyways, I’m sure your devices have made contact with servers behind your back that you know nothing about.

Web browsers look for either port :80 or port :443 by default, your reverse proxy sits on those ports, hence why you don’t need to input a port at the end of the domain.

Get yourself a load balancer like Traefik or SWAG, buy a domain, setup ACME certificates for SSL/TLS and start pointing your load balancer to your services.

The firewall is annoying? I would argue and say the firewall is protecting your computer from connecting to a rouge server, annoying or not it’s better than some douche abusing an exploit in your system.

perhaps if you open the Wiki link where the image was taken from, for me it’s animated on Voyager.

OpenSnitch is a nice for the desktop environment, deny by default and prompts the user when an application requests a open port, at first the prompts can get a little overwhelming given how many things want to connect to xyz server but eventually lightens up.

Couldn’t APNG be considered?

Pity and Shame typically go hand an hand, you’ll hear people say “That’s a shame” but you can replace shame with pity “That’s a pity” and achieve the same result.

However when addressing another person, you won’t hear people say “I shame you” instead you’ll hear “I pity you” to show displeasure or anger to another person.

Hope this helps!

Little late but I doubt Microsoft wants to relive the horrors of JTAG/RGH Xbox 360’s hence the locked down systems.

Note to self, avoid https://grrrgraphics.com/

If you manage to get Docker Compose installed on that Mac (I don’t know Dockers limitations with Macs) create a docker-compose.yaml file with the contents of;

services:

  jellyfin:

    image: jellyfin/jellyfin

    container_name: jellyfin

    # Optional - specify the uid and gid you would like Jellyfin to use instead of root

    user: uid:gid

    ports:

      - 8096:8096/tcp

      - 7359:7359/udp

    volumes:

      - /path/to/config:/config

      - /path/to/cache:/cache

      - type: bind

        source: /path/to/media

        target: /media

      - type: bind

        source: /path/to/media2

        target: /media2

        read_only: true

      # Optional - extra fonts to be used during transcoding with subtitle burn-in

      - type: bind

        source: /path/to/fonts

        target: /usr/local/share/fonts/custom

        read_only: true

    restart: 'unless-stopped'

    # Optional - alternative address used for autodiscovery

    environment:

      - JELLYFIN_PublishedServerUrl=http://example.com/

    # Optional - may be necessary for docker healthcheck to pass if running in host network mode

    extra_hosts:

      - 'host.docker.internal:host-gateway'

Edit the volumes so that the drive you want to use is exposed to the container and then run;

sudo docker compose up -d

In a shell while in the folder with the docker-compose.yaml file you just created. If everything works then the server should be running on port :8086 open your browser and make an http:// request to the ip of the server followed by the port.

Example; http://127.0.0.1:8096/

Documentation.

Edit: removed unnecessary \

Edit 2: I really should have read the post more thoroughly, while my example above works fine for a Jellyfin server (which you apparently already run) it also can be adapted for other services. Read and interpret the documentation as best as you can, that goes for any service.

systemd optional, no snap, no flatpak, stable.

systemd optional, no optional snap, no optional flatpak, stable.

With Debian nearly everything is optional.

Debian for its stability, but you can easily break it with one wrong command.

Don’t break Debian. While Debian does an amazing job at documentation it can be overwhelming for newer folks.

Every homepage made with Homepage.dev looks the same to me, no matter how much you configure their settings.yaml or services.yaml it all looks the same.

Surprised you didnt slap a background image on it and blurred it.

To say it’s debatable if it’s a suite of tools is just wrong.

How is it wrong to say it is debatable when Traefik and WireGuard have quite literally done majority of the development. Pangolin is just a man in the middle.

Pangolin uses gerbil with newt for those wireguard tunnels. That’s a massive improvement already. It also adds a bunch more features like vpn.

According to the Newt ReadMe -

Newt is a fully user space WireGuard tunnel client and TCP/UDP proxy, designed to securely expose private resources controlled by Pangolin. By using Newt, you don’t need to manage complex WireGuard tunnels and NATing.

Seems to me that WireGuard is their primary dependency, without WireGuard what use is it?

you can crowdsec

According to Pangolin docs they rely on the Crowdsec middleware offered by Traefik.

By default, Crowdsec is installed with a basic configuration, which includes the Crowdsec Bouncer Traefik plugin

I can’t be much of a help with Caddy however, for Traefik you can use the OIDC Middleware to forward requests to your authentication service.

Plus I worry I set something up wrong and expose my network

The only port that would need opening is :443, leave port :80 closed so that people cannot connect to your services insecurely. Slap fail2ban or geoblock on it and call it a day. Also, DDNS allowlist for that deny-first approach.

Traefik is what it uses to proxy things. You’re comparing a full suite of tools with just one piece.

I mean, that’s debatable. Taking a look at their docker-compose.yml there are 3 containers they recommend running, with a 4 optional container.

• image: docker.io/fosrl/pangolin:latest # Pangolin itself
• image: docker.io/fosrl/gerbil:latest # WireGuard server
• image: docker.io/traefik:v3.6 # Traefik Reverse Proxy
• image: hhftechnology/middleware-manager:latest # Optional middleware manager for Traefik

To say this is a “full-suite” is a bit much when majority of the heavy lifting is done by Traefik, the middleware’s you assign to Traefik and WireGuard. Pangolin if I’m reading this correctly;

“Pangolin combines reverse proxy and VPN capabilities into one platform.”

Which is great! However as I mentioned previously, does not integrate well when these services are already setup to work standalone.

I suspect the same reaction from folks when they hear “download pangolin from the App Store, and use xyz credentials to connect.” And “download WireGuard from the App Store, and use xyz file to connect.”