kumi

Right. Then if this would have been a locally hosted scenario, it's like making a post to complain about the service of their electricity company or ISP. Could similarly be reasonably considered on- or offtopic. But I think this sub is more in the spirit of "there is no cloud, just someone elses computer". I'm with mod on this one.

Just a small number of base images (ubuntu:, alpine:, debian:) are routinely synced, and anything else is built in CI from Containerfiles. Those are backed up. So as long as backups are intact can recover from loss of the image store even without internet.

I also have a two-tier container image storage anyway which gives redundancfor the built images but thats more of a side-effect of workarounds.. Anyway, the "source of truth" docker-registry which is pushed to is only exposed internally to the one who needs to do authenticated push, and to the second layer of pull-through caches which the internal servers actually pull from. So backups aside, images that are in active use already at least three copies (push-registry, pull-registry, and whoevers running it). The mirrored public images are a separate chain alltogether.

This has been running for a while so all handwired from component services. A dedicated Forgejo deployment looks like it could serve for a large part of above in one package today. Plus it conveniently syncs external git dependencies.

If not for political reasons then why limit first version to Google/GitHub rather than starting with generic OIDC (which should include those two anyway)?

We also took your feedback seriously and we are now implementing proper sign-in options like: Google GitHub (and more coming later)

Sounds like you have a stable life and infra needs and either very lucky or really good with backups and keeping secondaries around. Good on you.

The advantage to using something like terraform is repeatability, reliability across environments and roll-backs.

Very valuable things for a stress-free life, especially if this is for more than just entertainment and gimmicks.

I'd rather stare at the terminal screen for many hours of my choosing than suddenly having to do it at a bad time for one.. 2... 3... (oh god damn the networking was relying on having changed that weird undocumented parameter i forgot about years ago wasnt it) hours. Oh, and a 0-day just dropped for that service you're running running on the net. That you built from source (or worse, got from an upstream that is now mia). Better upgrade fast and reboot for that new kern.. She won't boot again. The bootdrive really had to crap out right now didn't it? Do we install everything from scratch, start Frankensteining or just bring out the scotch at this point?

Also been at this for a while. I never regretted putting anything as infra-as-code or config management. Plenty of times I wish I had. But yeah, complexity can be insiduous. Going for High Availability and container cluster service mesh across the board was probably a mistake on the other hand...

Hyprland and Niri aren't even DEs. That's up to the user to sort out, if they want one. So yeah not the best first picks for a beginner who just wants their damn desktop experience now please.

NFS works great for media files and stuff but be careful and know what you are doing before you go put database storage on it.

My guess is some firmware or modules that just makes it that big and if you want room for snapshots you need to resize (or uninstall some variant if not needed). OS installer might have too small default size for a setup like this.

300MBish for a kernel is totally normal and you have 3 variants installed.

One way to go about the network security aspect:

Make a separate LAN(optionally: VLAN) for your internals of hosted services. Separate from the one you use to access internet and use with your main computer. At start this LAN will probably only have two machines (three if you bring the NAS into the picture separately from JF)

• The server running Jellyfin. Not connected to your main network or internet.

• A "bastion host" which has at least two network interfaces: One connected outwards and one inwards. This is not a router (no IP forwarding) and should be separate from your main router. This is the bridge. Here you can run (optional) VPN gateway, SSH server. And also an HTTP reverse proxy to expose Jellyfin to outside world. If you have things on the inside that need to reach out (like package updates) you can have an HTTP forward proxy for that.

When it's just two machines you can connect them directly with LAN cable, when you have more you add a cheap network switch.

If you don't have enough hardware to split machines up like this you can do similar things with VMs on one box but that's a lot of extra complexity for beginners and you probably have enough of new things to familiarize yourself with as it is. Separating physically instead of virtually is a lot simpler to understand and also more secure.

I recommend firewalld for system firewall.

Here, you dropped this: /*

BTW ncdu -x /boot

Partitioning in the Debian installer being half-broken is something nobody talks about but IME still a thing.

What do is step through the installer to the point where you're at, ctrl+F* to get a shell, set it up manually using fdisk/mdadm/lvm/cryptsetup/mkfs, and then back again to rescan and just assign the mounts and filesystems

I think I still have a half-written guide for just this in drafts somewhere actually. If you get stuck you can DM and maybe I dig something up

I do not ask you to read?

So that's the mistake I made and the important part. Thanks for clarifying.

I still feel misled that it's labelled as somehing it isn't ("my reasoning").