I’m actually hosting it public-facing, because in theory, gaining access to the VM and the vault shoult be unproblematic - since the vault is only decrypted client-side

Agreed.

You can also selfhost bitwarden/vaultwarden for even better privacy.

Sadly, we won’t see a second season, because some “fans” on the internet got mad that women, people of color and - very shocking - queer people exist in the Star Wars universe.

It sucks that these people exist, for many reasons. One of these reasons (surely not the worst one, but the one I want to focus on) is that it muddies all criticism of a project. Your comment implied that this was the sole, or main, reason that The Acolyte was canceled, so I want to jump in here to say:

Having more women, people of color, and queer characters was the only refreshing thing about The Acolyte, and I wish more Star Wars projects took notice. Other than that though, the show is an utter disaster. It was incompetently written and directed, its story and characters make no sense, and the effects can be jarring.

Characters either have no defined motivations, or their motivations flip flop at the drop of a hat. Scenes dealing with the Jedi order and the republic fuck with established lore and do lasting damage to the Jedi order (not in the sense that they are shown as morally gray, but in that they are utterly incompetent and seemingly don’t remember the appearance of the Sith during living memory, for example).

Speaking of which, yes, the show tries to portray Jedi/Sith as a gray area, but

a) that has been done to death at this point, seriously, every other SW project tries to do a “ooooh but maybe Jedi not completely good!”, and b) The Acolyte is probably the most incompetent version of that I have seen (so far!).

I hope I have demonstrated that this show can be critiqued bar any bigotry, and I think it should be acknowledged that that, together with the giant sum of money it ate, are the reasons it got canceled - I am sure Disney also does not like the bigotry, but sadly, they get that with every project, even those that do not get canceled…

In any case, there is no comparison to Andor to be made, SMH.

Ah, my bad then! I didn’t see a repo linked in the post or on the site. That’s great, then!

Cool idea. But since it doesn’t seem to be open source and self-hostable, I won’t trust it.

Isn’t that what Sichuan peppers do?

Managing 30+ machines with NixOS in a single unified config, currently sitting at a total of around 17k lines of nix code.

In other words, I have put a lot of time into this. It was a very steep learning curve, but it’s paid for itself multiple times over by now.

For “newcomers”, my observations can be boiled down to this: if you only manage one machine, it’s not worth it. Maaaaaybe give home-manager a try and see if you like it.

Situation is probably different with things like Silverblue (IMO throwing those kinds of distros in with Guix and NixOS is a bit misleading - very different philosophy and user experience), but I can only talk about Nix here.

With Nix, the real benefit comes once you handle multiple machines. Identical or similar configurations get combined or parametrized. Config values set for Host A can be reused and decisions be made automatically based on it in Host B, for example:

• all hosts know my SSH pub keys from first boot, without ever having to configure anything in any of them
• my NAS IP is set once, all hosts requiring NAS access just reuse it implicitly
• creating new proxmox VMs just means adding, on average, 10 lines of nix config (saying: your ID will be this, you will run that service) and a single command, because the heavy lifting and configuring has already been done, once -…

Chat, is this AI-generated ads on Lemmy?

Are we talking permanent background tracking? Or sending a message “hey, I’m here”?

No

Sure! As long as it’s nixpkgs.

I still find it hilarious that since dd-wrt and OpenWrt are just… Linux, you could install Super Mario Bros on there. I checked, nobody seems to have tried.

Oh, definitely, but there are varying degrees of difficulty, esp. with what kinds of packages / package management you have available :D

Ah, that make sense. Is Wireguard P2P?

Yes, in the sense that each node/device is a peer. But the way I’d suggest you configure it in your case is more akin to a client/server setup - your devices forward all traffic to the “server”, but it never takes initiative to talk “back” to them, and they do not attempt to communicate with each other. Unless you have a separate usecase for that, of course.

You both are perfect for each other, so don’t screw it up!

❤️

Closing in on 8 years

I’m actually surprised nobody suggested simply using the Pi with OpenWrt as my own router. Though, that would make it hard to host Jellyfin.

A brief internet search shows that surprisingly, hosting Jellyfin on OpenWRT should work… No idea how well though. Come to think of it, having OpenWRT on the pi might make it a lot easier to configure, with graphical settings available and so on.

Could you explain Wireguard vs. Tailscale in this scenario?

I’ve never used tailscale, I’m afraid. Normally I would say: just use whatever seems easier to set up on your device/network; however, note that tailscale needs a “coordinate server”. No actual traffic ever goes through it, it just facilitates key exchanges and the like (from what I understand), but regardless, it’s a server outside your control which is involved in some way. You can selfhost this server, but that is additional work, of course…

Thank you all so much for your help! This is likely the solution I will go with, combined with another one, so again thank you so much!

Glad I could help, after being so unhelpful yesterday :)

P.S. I don’t care if you wrap an ethernet cord around her finger, get going!

Eh… Marriage is not really common in either of our families. We agreed to go sign the papers if there ever is a tax reason, lol. Sorry if that’s a bit unromantic :D Nice rings though ^^

I am actually considering getting an EV for transporting my Cello :/

It’s unfortunately not possible to reliably transport it by bike (strong winds, icy conditions on my rather hilly ride to the city). Makes me miss out on re-joining an orchestra.

Everything else (groceries, work,…) would still be by bike, just… That.

That’s great. Hope other states follow suite.

Hi again.

How about the following idea:

Set up ProtonVPN on the raspberry pi.

On all other devices (or at least those you want to use Jellyfin on), switch from using Proton to using Wireguard. Unlike your phone, the raspberry pi has no trouble running multiple VPNs. I think the ProtonVPN limitations in regard to not allowing split tunneling don’t apply here, since all outgoing traffic will still go via Proton.

Essentially, the Pi would function as a proxy for all of your traffic, “and also” host Jellyfin. You would still connect to http://192.168.20.10:8096/ (or whatever) on your devices, but that address would only resolve to anything when you are connected to the pi via Wireguard. No HTTPs, but “HTTP over Wireguard”, if you will.

Nots that this requires you trusting the pi to the same degree that you trust your phone.

For your static devices (PC, TV) this should solve the problem. Devices which you take with you, like your phone, unfortunately will loose internet connectivity when you leave your home until you switch off Wireguard, and switch on Proton, and not be able to connect to Jellyfin when you return home, until you switch them back.

Essentially, you would have a “home” VPN and a “on the go” VPN, though you never need to connect to both. There might be ways to automate this based on WiFi SSID on Android, but I have not looked into it.

The Pros:

• this should meet all your requirements. No additional expenses, no domain, no dynDNS; no selfsigned certificate or custom CA; traffic is never unencrypted; works on all common devices.
• Wireguard is sufficiently lightweight to not bog down the pi, normally
• this is actually well within the intended use-cases for Wireguard, so no “black magic” required in configuring it
• if you ever do decide to get a domain, you can configure everything to always be connected to your pi via Wireguard, even on the go! Not required though.

The Cons:

• when you are new to selfhosting, Wireguard is a bit daunting to set up. It is not the easiest to debug (don’t worry, it’s easy to tell IF it is working, but not always WHY it isn’t working). Some manual route handling is probably also required on the pi. It should definitely be doable though, but might turn this Jellyfin thing from a weekend project to a 2 week project…
• I have no experience with how well the pi runs Jellyfin. If the answer is “barely”, then adding multiple concurrent Wireguard sessions might be a bad experience. Though in this case, you could only switch Proton to Wireguard whenever you want to watch Jellyfin.
• the manual switching might be annoying, but that is the price to pay here, so to speak

Edit: someone else already mentioned setting up your own trusted network with a second router. IMO that is the better, more hassle-free option IF you are willing to shell out the money. My suggestion is the “free” version of that, essentially 😄

Hi again. Sorry for being so rude yesterday. Your new post actually clears the situation up a lot.

We might have an idea for you, will comment on the new post.

Hi. I am a software engineer with a background in IT security. My girlfriend is a literal network security engineer.

I showed her this thread and she said: don’t bother, just use http on your local network.

Anyways, I am going to disengage from this thread now. Skepticism against things one doesn’t fully understand can be healthy, but this is an insane mix of paranoia and naïveté.

You are not a target; the things you are afraid of will never happen; and if they did, they would not have the consequences you think they would.

Your router will NOT magically expose your traffic to the internet (what would that even mean?? Like, if it spontaneously started port forwarding to your Jellyfin server (how? By just randomly guessing the port and IP???), someone would still need to actively request that traffic, AND know your login credentials, AND CARE).

Your ISP does not give a shit about you owning or streaming copyrighted material over your local network. It has no stake in that.

Graphene is not an ultimate arbiter of IT security, but the reason it “distrusts networks” is because you take your phone with you, constantly moving into actual untrusted networks (i.e. ones you do not own).

Hosting Jellyfin on Graphene will not make it more secure, whatsoever.

If every device is assumed compromised, and compromising devices with knowledge that you watch media is a threat in your model, then even putting an SD card with media in your phone and clicking play is dangerous. Which is stupid.

If you actually assume your router is malicious, then please assume that when you initially downloaded your VPN client, it was also compromised and your VPN is not trustworthy.

The way I see it, you have two options:

1. educate yourself on network security to the point of being able to trust your network setup; or
2. forget about hosting anything

This isn’t really true. Even IF your router would fail catastrophically in the right way to expose your Server to the internet, or of it actually “ratted your traffic out” to the ISP and the ISP cared (which it does not), it’s not illegal to hist Jellyfin, or put media on it which you own (which is not discernible from just… Media being streamed).

Also your ISP has no part in your local network traffic.