I missed that you said you were using OPNsense, so the up/down would be handled there. If it’s working now, don’t worry about it.

1. Tailscale is not a reverse proxy
2. There’s nothing you can’t “undo”. I think you’re overthinking this.
3. If you don’t need the extra storage, you don’t need a NAS.
4. You can run most of the services you mention on that OPi board right now as long as you have the system resources.

If your routes aren’t changing, then your device, as a client, isn’t going to reach anything. You’ll need to see a route for the 10.20.0.0/24 subnet show up that points to whatever the endpoint address is on the other end.

So if that’s all your server config is, it’s only going to allow one peer at a time. You can confirm this by disconnecting your android device from the tunnel, and then connecting using the same info from your Linux device.

You also at a minimum should have PostUP and PostDown directives to properly forward incoming traffic on your wg interface.

Netgear is…kinda shit. Is that 1Gb for the whole switch, or per-port? Any traffic steering on the network?

Okay, so what’s your network look like?

Specs on your router, is this wired or wireless to the Shield, how much other traffic are the other network clients pulling, and is this a constant, or just happens intermittently?

If you went from “everything works”, to “now it stutters”, then you either have a networking issue, or a resource issue on the source.

Did you update something recently?

Do you have network stats from your router?

Do some devices work fine, and others don’t?

1. what are your routes before and after connecting to the VPN?
2. You say “resolve”, do you mean by DNS, or you actually can’t ping the actual IP address once connected?
3. What is your Wireguard server config?

deleted by creator

VNC has long been abandoned by the engineering world. It’s inefficient, it has no transport security, and the implementations are very subjective.

VNC is dead. I’d try to talk them off that if it’s a requirement.

Ghost, Hugo, Jekyll…etc. all the same ones you’ll probably find by searching around.

Ghost is probably the most fleshed out if you’re looking for guardrails and a UI.

Keep it segregated from your internal network, no password auth, or better yet, install a privatenet client (Tailscale, Zerotier…etc) and don’t open SSH ports at all, consider using a Cloudflare Tunnel or similar…that’s a basic start.

Honestly, if you’re serving a static site, just deploy it on Digitalocean Apps or R2 for free and skip all the worry and get all the Cloudflare protection built-in.

Nice write up, but there’s just going to be a LOT of false positives.

And that’s not even letting on that literally ALL DNS queries work from cache unless you are specifically doing a live query.

None of your software is. It’s asking your OS. Your OS is asking your resolver service. Your resolver service is asking your router. Your router is 5000% caching DNS queries.

So you’re asking if there is any other way to work around physics and get a better response time to servers that are thousands of miles away?

No.

Sorry.

DLNA

I was confused by the title because fprintd has been around for a long time. Didn’t realize Cinnamon didn’t support it.

Sure it’s not a proprietary binary DB, right? Probably just sqlite or something? Bet you can just dump it.

But yeah, switch to something without those problems. There’s lots of them out there.

If your requirement is a GUI, you’re not going to find anything. HA Proxy is also the most performant out of anything out there last I looked, and it’s got one of the simplest configuration setups.

• Traefik: kinda slow, mostly meant for large numbers of microservices, pretty verbose configuration
• Envoy: middle of the road, also most meant for cloud services, but should work with anything
• nginx: does have a popular 3rd party GUI, seems to be confusing for most that don’t work with it a lot
• caddy: fewer LB specific options if you’re just talking about service routing and response time, pretty easy to confirm for most, and some sort of decent 3rd party UIs, but they won’t have all the options available.

First, I think you’re attacking this from the wrong angle. You’re focused on ECC memory for some reason, but that’s not going to prevent bitrot, just potentially reduce errors in transfer, or catch issues. Your filesystem of choice has more to do with degradation in storage.

Second, you haven’t mentioned any of the boards and their storage capabilities. Do they support the correct number of drives you want to use? Do they support hot-swap, and is that even something you care about?

Last, you want more services, and but are worried about power consumption…that’s not how that works. More services means more CPU and MEM util, which means more power usage. You can either constrain your TDP at that point by using an UNDERpowered CPU and have that tradeoff, or provide a more capable CPU and take an increased TDP. There is no third option, that’s just how it works. Pick the more capable CPU and take the power hit (really, it’s going to be minor compared to a large server), and just run the things you need to run instead of coming back in a year and wanting to flip it again.