41·
7 months agoBuying a domain. There might be some free services that, similar to DuckDNS in the beginning, work reliably for now. But IMHO they are not worth the potential headaches.
- 2 Posts
- 15 Comments
Joined 1 year ago
Cake day: April 20th, 2024
You are not logged in. If you use a Fediverse account that is able to follow users, you can follow this user.
DuckDNS pretty often has problems and fails to propagate properly. It’s not very good, especially with frequent IP changes.
I’d appreciate it very much!
Great suggestion to secure the backups themselfes, but I’m more concerned about the impact an attacker on my network might have on the external network and vice versa.
That’d be the gold standard. Unfortunately, the external network utilizes infrastructure that doesn’t support specifying firewall rules on the existing separate VLAN, so all rules would have to be applied on the Pi itself or on yet another device between, which is something I’d like to avoid. Great general advice, though!
While this is a great approach for any business hosting mission critical or user facing ressources, it is WAY overkill for a basic selfhosted setup involving family and friends.
For this to make sense, you need to have access to 3 different physical locations with their own ISPs or rent 3 different VPS.
Assuming one would use only 1 data drive + an equal parity drive, now we’re talking about 6 drives with the total usable capacity of one. If one decides to use fewer drives and link your nodes to one or two data drives (remotely), I/O and latency becomes an issue and you effectively introduced more points of failure than before.
Not even talking about the massive increase in initial and running costs as well as administrive headaches, this isn’t worth it for basically anyone.
str(float("100.0")) + "%"
Because this repo is going viral from time to time to developers, I’m open for discussion if you want to promote a product/service in this README file. Just mail me at XXXX
Ew.
I’ve been tempted by Tailscale a few times before, but I don’t want to depend on their proprietary clients and control server. The latter could be solved by selfhosting Headscale, but at this point I figure that going for a basic Wireguard setup is probably easier to maintain.
I’d like to have a look at your rules setup, I’m especially curious if/how you approached the event of the commercial VPN Wireguard tunnel(s) on your exit node(s) going down, which depending on the setup may send requests meant to go through the commercial VPN through your VPS exit node.
Personally, I ended up with two Wireguard containers in the target LAN, a wireguard-server and a **wireguard-client **container.
They both share a docker network with a specific subnet {DOCKER_SUBNET} and wireguard-client has a static IP {WG_CLIENT_IP} in that subnet.
The wireguard-client has a slightly altered standard config to establish a tunnel to an external endpoint, a commercial VPN in this case:
[Interface] PrivateKey = XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Address = XXXXXXXXXXXXXXXXXXX PostUp = iptables -t nat -A POSTROUTING -o wg+ -j MASQUERADE PreDown = iptables -t nat -D POSTROUTING -o wg+ -j MASQUERADE PostUp = iptables -I OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECT && ip6tables -I OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECT PreDown = iptables -D OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECT && ip6tables -D OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECT [Peer] PublicKey = XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX AllowedIPs = 0.0.0.0/0,::0/0 Endpoint = XXXXXXXXXXXXXXXXXXXXwhere
PostUp = iptables -t nat -A POSTROUTING -o wg+ -j MASQUERADE PreDown = iptables -t nat -D POSTROUTING -o wg+ -j MASQUERADEare responsible for properly routing traffic coming in from outside the container and
PostUp = iptables -I OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECT && ip6tables -I OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECT PreDown = iptables -D OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECT && ip6tables -D OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECTis your standard kill-switch meant to block traffic going out of any network interface except the tunnel interface in the event of the tunnel going down.
The wireguard-server container has these PostUPs and -Downs:
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADEdefault rules that come with the template and allow for routing packets through the server tunnel
PostUp = wg set wg0 fwmark 51820the traffic out of the tunnel interface get marked
PostUp = ip -4 route add 0.0.0.0/0 via {WG_CLIENT_IP} table 51820add a rule to routing table 51820 for routing all packets through the wireguard-client container
PostUp = ip -4 rule add not fwmark 51820 table 51820packets not marked should use routing table 51820
PostUp = ip -4 rule add table main suppress_prefixlength 0respect manual rules added to main routing table
PostUp = ip route add {LAN_SUBNET} via {DOCKER_SUBNET_GATEWAY_IP} dev eth0route packages with a destination in {LAN_SUBNET} to the actual {LAN_SUBNET} of the host
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE; ip route del {LAN_SUBNET} via {DOCKER_SUBNET_GATEWAY_IP} dev eth0delete those rules after the tunnel goes down
PostUp = iptables -I OUTPUT ! -o %i -m mark ! --mark 0xca6c -m addrtype ! --dst-type LOCAL -j REJECT && ip6tables -I OUTPUT ! -o %i -m mark ! --mark 0xca6c -m addrtype ! --dst-type LOCAL -j REJECT PreDown = iptables -D OUTPUT ! -o %i -m mark ! --mark 0xca6c -m addrtype ! --dst-type LOCAL -j REJECT && ip6tables -D OUTPUT ! -o %i -m mark ! --mark 0xca6c -m addrtype ! --dst-type LOCAL -j REJECTBasically the same kill-switch as in wireguard-client, but with the mark manually substituted since the command it relied on didn’t work in my server container for some reason and AFAIK the mark actually doesn’t change.
Now do I actually need the kill-switch in wireguard-server? Is the kill-switch in wireguard-client sufficient? I’m not even sure anymore.
Oh I’m fully aware. I personally don’t care, but one could add a capable VPS and deploy the Wireguard Host Container + two Client Containers, one for the LAN and one for the commercial VPN (like so), if the internet connection of the LAN in question isn’t sufficient.
Oh, neat! Never noticed that option in the Wireguard app before. That’s very helpful already. Regarding your opnsense setup:
I’ve dabbled in some (simple) routing before, but I’m far from anything one could call competent in that regard and even if I’d read up properly before writing my own routes/rules, I’d probably still wouldn’t trust that I hadn’t forgotten something to e.g. prevent IP/DNS leaks.
I’m mainly relying on a Docker and was hoping for pointers on how to configure a Wireguard host container to route only internet traffic through another Wireguard Client container.
I found this example, which is pretty close to my ideal setup. I’ll read up on that.
221·9 months agoAn dieser Stelle reposte ich nochmal zwei einfache Wege, um seinen User (Settings und abonnierte/geblockte Communities) von einer Lemmy Instanz auf eine andere umzuziehen, beispielsweise von feddit.de auf feddit.org, von meinem ursprünglichen Post unter feddit.de/c/main ( https://alexandrite.app/feddit.de/post/11325409)
Weg 1, falls man noch einen Browser mit aktiver Session auf feddit.de hat:
Lemmy bietet seit Version 0.19 eine Funktion an, um die user data zu ex- und importieren. Das geht normalerweise über einen Button in den Settings des Webinterfaces, das geht aktuell bei feddit.de nicht.
Aber der zugrundeliegende API-Aufruf funktioniert noch, solange man noch mit einem Browser auf feddit.de eingeloggt ist:
- Man gehe auf https://feddit.de/api/v3/user/export_settings und speichert die zurückgegebene Datei als irgendwas.json
- Man nehme einen (neuen) Account auf einer stabilen Instanz der Wahl, gehe auf /settings und lade irgendwas.json über den Import-Button hoch.
- Voilà, man genieße die neue Instanz.
Das funktioniert mit jeder Instanz >=0.19, man muss lediglich das “feddit.de” in der URL ersetzen. Und wenn das Webinterface funktioniert, geht das auch über den Export- Button in den Settings.
Weg 2:
Für die Leute, die keine offene Browser Session haben, hier ein kleines, aber funktionales Bash Script, welches im Ausführungsverzeichnis eine
myFedditUserData.jsonerstellt, welche bei anderen Instanzen importiert werden kann.Anforderungen:
- Linux/Mac OS X /Windows mit WSL
- jq installiert (Unter Ubuntu/Debian/Mint z.B. per
sudo apt install -y jq
Anleitung:
- Folgendes Script unter einem beliebigen Namen mit
.shEndung abspeichern, z.B.getMyFedditUserData.sh - Script in beliebigen Textprogramm öffnen, Username/Mail und Passwort ausfüllen (optional Instanz ändern)
- Terminal im Ordner des Scripts öffnen und
chmod +x getMyFedditUserData.shausführen (Namen eventuell anpassen) ./getMyFedditUserData.shim Terminal eingeben- Nun liegt im Ordner neben dem Script eine frische
myFedditUserData.json
Anmerkung: Das Script ist recht simpel, es wird ein JWT Bearer Token angefragt und als Header bei dem GET Aufruf von https://feddit.de/api/v3/user/export_settings mitgegeben. Wer kein Linux/Mac OS X zur Verfügung hat, kann den Ablauf mit anderen Mitteln nachstellen.
Das Script:
#!/bin/bash # Basic login script for Lemmy API # CHANGE THESE VALUES my_instance="https://feddit.de" # e.g. https://feddit.nl my_username="" # e.g. freamon my_password="" # e.g. hunter2 ######################################################## # Lemmy API version API="api/v3" ######################################################## # Turn off history substitution (avoid errors with ! usage) set +H ######################################################## # Login login() { end_point="user/login" json_data="{\"username_or_email\":\"$my_username\",\"password\":\"$my_password\"}" url="$my_instance/$API/$end_point" curl -H "Content-Type: application/json" -d "$json_data" "$url" } # Get userdata as JSON getUserData() { end_point="user/export_settings" url="$my_instance/$API/$end_point" curl -H "Authorization: Bearer ${JWT}" "$url" } JWT=$(login | jq -r '.jwt') printf 'JWT Token: %s\n' "$JWT" getUserData | jq > myFedditUserData.json
@elvith@feddit.org hat mein Script auch in PowerShell nachgebaut, welches unter Windows ohne WSL auskommt: https://gist.github.com/elvith-de/89107061661e001df659d7a7d413092b
# CHANGE THESE VALUES $my_instance="https://feddit.de" # e.g. https://feddit.nl $target_file = "C:\Temp\export.json" ######################################################## #Ask user for username and password $credentials = Get-Credential -Message "Logindata for $my_instance" -Title "Login" $my_username= $credentials.UserName $my_password= $credentials.GetNetworkCredential().Password # Lemmy API version $API="api/v3" # Login function Get-AuthToken() { $end_point="user/login" $json_data= @{ "username_or_email" = $my_username; "password" = $my_password } | ConvertTo-Json $url="$my_instance/$API/$end_point" (Invoke-RestMethod -Headers @{"Content-Type" = "application/json"} -Body $json_data -Method Post -Uri $url).JWT } # Get userdata as JSON function Get-UserData() { $end_point="user/export_settings" $url="$my_instance/$API/$end_point" Invoke-RestMethod -Headers @{"Authorization"="Bearer $($JWT)"} -Method Get -Uri $url } $JWT= Get-AuthToken Write-Host "Got JWT Token: $JWT" Write-Host "Exporting data to $target_file" Get-UserData | ConvertTo-Json | Out-File -FilePath $target_file
6·10 months agoEin Kollege hat sich sein “normales” Fahrrad selbst mit einem Chinesischem Nabenmotor elektrifiziert, dort ist aus Bastler Sicht alles sehr viel zugänglicher. Für ein zukünftiges E-Bike würde ich persönlich also auf jeden Fall in die Richtung tendieren.
Dazu sei auch gesagt, dass man gute Teile, um ein bestehendes Rad inklusive Akku auf Pedelec umzurüsten, bereits verhältnismäßig günstig für um die 500€ bekommt. Das sieht dann am Ende nicht so sexy wie ein fertiges E-Bike aus, da die Kabel normalerweise am statt im Rahmen verlegt werden, aber so ein Umbau ist naturgemäß modular und auch transferierbar. Der Umbau ist eigentlich für jeden machbar, Videos gibt es genug.
Man sollte sich aber mit den Vor- und Nachteilen der verschiedenen Antriebsarten auseinandersetzen, wesentlich hier Mittel- und Nabenmotor. Auch werden viele Kits so ausgeliefert, dass theoretisch eine in Deutschland für Pedelecs nicht zugelassene Konfiguration möglich ist, beispielsweise durch Gashebel und höherer Unterstützung als 25 km/h.
5·11 months agoWhile this is certainly a cool concept, local voice assistants like this are currently a novelty. Cool to play around with, though!
You can expect around 5 seconds processing time to start generating the response to a basic question on a very basic model like Llama 3 8B.
For context, using Moondream2 (as recommended) on a RasPi 5, it takes around 50 seconds to process an image taken by the Camera and start generating a description.
I simply can’t wrap my head around the thought process behind launching a clusterfuck like this. Y Combinator probably didn’t do their due diligence and simply rode the fading AI Bubble, so I can at least understand how the funding might have been approved.
But actively leaving your $250,000+/year job to team up with some questionable choices to basically fork two OS projects, change the discord links and generate an illegal licence for that shit show, all while proudly stating, publicly, “dawg i chatgpt’d the license, anyone is free to use our app for free for whatever they want. if there’s a problem with the license just lmk i’ll change it. we busy building rn can’t be bothered with legal” when they are made aware of the fact.
This is absolutely insane, sounds like someone was about to get fired and decided to use some personal relations and fresh graduates to somehow successfully cash in one last time with absolutely no regard of even the basics. Pretty wild that those guys even managed to figure out how to found a Startup. Probably asked ChatGPT for instructions there, as well.