• 1 Post
  • 52 Comments
Joined 1 year ago
cake
Cake day: June 26th, 2023

help-circle






  • You make a good point. But I still find that directly exposing a port on my home network feels more dangerous than doing so on a remote server. I want to prevent attackers sidestepping the proxy and directly accessing the server itself, which feels more likely to allow circumventing the isolations provided by docker in case of a breach.

    Judging from a couple articles I read online, if i wanted to publicly expose a port on my home network, I should also isolate the public server from the rest of the local LAN with a VLAN. For which I’d need to first replace my router, and learn a whole lot more about networking. Doing it this way, which is basically a homemade cloudflare tunnel, lets me rest easier at night.


  • Your first paragraph hits the nail on the head. From what I’ve read, bots all over the net will find any openly exposed ports in no time and start attacking it blindly, putting strain on your router and a general risk into your home network.

    Regarding bandwith: 100% of the traffic via the domain name (not local network) runs through the proxy server. But these datacenters have 1 to 10 gigabit uplinks, so the slowest link in the chain is usually your home internet connection. Which, in my case, is 500mbit down and 50mbit up. And that’s easily saturated on both directions by the tunnel and VPS. plus, streaming a 4K BluRay remux usually only requires between 35 and 40 mbit of upload speed, so speed is rarely a worry.


  • Hey! I’m also running my homelab on unraid! :D

    The reverse proxy basically allows you to open only one port on your machine for generic web traffic, instead of opening (and exposing) a port for each app individually. You then address each app by a certain hostname / Domain path, so either something like movies.myhomelab.com or myhomelab.com/movies.

    The issue is that you’ll have to point your domain directly at your home IP. Which then means that whenever you share a link to an app on your homelab, you also indirectly leak your home location (to the degree that IP location allows). Which I simply do not feel comfortable with. The easy solution is running the traffic through Cloudflare (this can be set up in 15 minutes), but they impose traffic restrictions on free plans, so it’s out of the question for media or cloud apps.

    That’s what my proxy VPS is for. Basically cloudflare tunnels rebuilt. An encrypted, direct tunnel between my homelab and a remote server in a datacenter, meaning I expose no port at home, and visitors connect to that datacenter IP instead of my home one. There is also no one in between my two servers, so I don’t give up any privacy. Comes with near zero bandwith loss in both directions too! And it requires near zero computational power, so it’s all running on a machine costing me 3,50 a month.







  • Many people do not want to seed downloaded content forever for storage reasons. In these cases, you would download the file with your download client and leave it in that download directory to allow seeding. It’ll be hardlinked to the Radarr/Sonarr folder for indexing, which does not use up extra storage space. Once a certain seeding/time goal is reached on the torrent, the torrent file will be deleted to make room for new torrents. This does (to my knowledge) not delete the file from the disk, meaning it is still accessible for your media center.

    Especially for people who run their software on hosted solutions with limited storage space, this is important to do. If you have all your software running on a local server with (virtually) infinite storage, this is not as much of a worry to you. It is probably still in your best interest to use hardlinks instead of copies, to save on storage space.


  • May I ask: are you sure you need a media center with transcoding? Because it may be totally sufficient for you to access files through a file explorer and play them with VLC/mpv or whatever else. Having a media center is only really useful if you need external access to your media. I set all that stuff up once, then realized i never watch shows/movies on the go. And if I do, i know beforehand and can copy the raw files to the device i plan to watch on.





  • dont put money into that “announcement”. they “exposed” her to be an old cracker who was in the scene many, many years ago. that person is to this day fighting a court case about their time in the scene. they’ve also written a post somewhere on the net talking about this and how hurt and confused they are to be dragged back into this mess. and the group that did the “exposing” has, as far as i have seen, not provided a single piece of evidence for their claims.

    innocent until proven guilty. no one knows who empress is, so you may as well believe she is the woman she says to be.