I mostly found it funny they felt the neet to upgrade from mint on a family members computer to anything else, because I can’t imagine mint not already working fine for them.

I fail to see the benefit in “Upgrading” to kubuntu (or anything else) in this case.

But yes u right hehe arch btw but also mby mint btw 🤔

Upgrade Mint to Kubuntu 💀

You’d think that, but go research or watch a video and get informed on how these bimbos use their networth (stocks) as collateral for bank loans of still more money than we will ever see in our life times (that they never really pay back btw).

Both statements can be true at once (yours and the comment you replied to).

There could be too many people too, but A.I. is taking (atleast some) junior dev jobs.

Companies are not hiring juniors and instead giving A.I. to the rest of their employees thinking that that will offset the loss of junior jobs.

Of course not every company will be like that, but it seems to be a common trend. If the trend continues, we could end up in a world where there’s a big mid-level to senior shortage because juniors stopped being hired (and therefore trained).

Because he’s watched all the free videos ;(

Hehe yep, that’s a good takeaway and the same as what I think.

Thank you too, i enjoyed this discussion.

No problemo.

Thanks for pointing out the reverse proxy comment. I think I was wrong to say simply putting jellyfin behind a reverse proxy will increase your security.

The benefits may only be minute or non-existent if you don’t use the reverse proxy for handling other stuff like HTTPS (and redirects to https, etc), restricting access or adding extra authentication requirements (mainly https).

It may also be good to note that Jellyfins docs explicitly do not recommend directly exposing jellyfin ports to the internet (a reverse proxy or using a vpn are recommended instead).

Still I will continue to feel safer always using a reverse proxy when I expose to the internet (maybe my misconceptions).

Your SSH setup is good.

ssh is a very resilient piece of software so I doubt with your setup you would encounter any issues.

Enforcing use of a VPN to get into your network before being able to ssh into a machine is mostly just an extra layer of defense, though using a non-standard port, only allowing key logins and disabling root user login are all layers of defense you have already added.

I thinj you’ll be fine, but if you are worried, you could setup a VPN or alternatively something like Fail2Ban if you notice any brute-force attacks (which may be unlikely with the use of a non-standard port).

What I meant with the Jellyfin question was kind of, how is having it exposed via a reverse proxy different from exposing its port right away? Is it because the only allowed connection would be HTTPS/encrypted etc, maybe?

It’s down to how secure the software is really.

Jellyfins (and other software) don’t use really secure web servers for getting themselves accessible via the network.

Caddy (a reverse proxy, for example) is made to be exposed to the internet and so it is more resilient and safe to use.

So putting the resilient software (a good reverse proxy) infront of Jellyfin (or most other software) simply increases your security by having the more safe web server be the one interfacing with end users.

Have fun on your journey!

Hm, I’m gonna remain skeptical.

Using the random ip you get from mobile data or using dynamic dns feels risky. Maybe that’s because I’m not smart, but the whole trust level is mail thing seems very heuristical and the risk of damaging my domains trust factor doesn’t seem worth it.

I’m not skeptical about having two ip addresses, but rather using ones that I don’t have control over (i don’t have the only right to use).

I might be wrong on the PTR record thing, seems it might be possible with DDNS providers but not 100% sure.

For mail this won’t work.

For one, you have to now think about dynamic dns because you have your one static ip and then whatever ip your data backup will rollover onto. This isn’t ideal. Probably going to ruin any trust your domain will have.

Second, there is no way you’re getting a reverse PTR record setup to work in this config.

So, no, it’s not gonna work (clarification, technically may work, but you are gonna have issues and it’s probably not recommended).

It may work fine if you have random services, but tbh I don’t ever want to use or deal with a ddns service myself.

And now it is (helping) ruining the housing market for us normal folk, with all these “entrepreneurs” buying up houses to list for high short stay rents on airbnb.

If you don’t want to worry too much, you can setup a vpn (like wireguard) on your server for ssh access.

Using a non standard port is a good idea, but not entirely foolproof because bots might still port scan (even if unlikely that they do that for ssh I’m not sure). At a mininum, you probably want to use keys for login like the other commenter on the main comment said.

Personally, using a vpn for when I want access to SSH when I’m out is worth the couple hours setting it up the one time (very simple setup with wireguard-easy for example). Maintenence time spent on upgrading is very low.

(Tl;dr personally I’d use a vpn to access ssh specifically rather than exposing it to the internet)

Same thing for Jellyfin?

Not 100% sure what you mean, but to clarify: Don’t accidentally expose jellyfins port to the internet (eg the default port 8096). Make sure it is only accessible from outside your network through your reverse proxy.

I agree, there is a lot of paranoia, but honestly that’s probably a good thing, because the people who are paranoid might not know that much, so a good amount of paranoia is healthy there.

The chance of being exploited is very low for me to care too too much. Why spend countless days locking up my entire infra when there’s a very low low chance anyone could exploit me in the first place (obviously get your setup to a good standard, I don’t recommend not reading up on anything and exposing server, etc. Just for me, I don’t need to over do it).

That being said, personally I have ssh behind a vpn because that’s a very important service that only I am accessing anyways, so it makes sense for me to disable that attack vector.

Oh okay, so it doesn’t work then is what I’m gathering (for email).

Cool, thank you for the knowledge!

If you have a regular data plan that you use if your internet goes down, you’re server would technically have an internet connection, but your services (like email) still wouldn’t work would it?

Do you have some type of setup that keeps that working on data?

I don’t know how buying the ISPs data addon works, but I’ve been skeptical that the swap over would keep anything online either (but getting a generic data plan surely cant work at all right?).

If your app interfaces with the OS, like most apps would (reading a file, managing the window, etc), then you would be writing rust, no?

Doubt it

Lol the commenter you replied to didnt expect a one of a kind person to reply.

Normal people don’t have a ginormous battery and a generator for when the power goes out.

Every ISP is dogshit too. If it doesn’t go down from incompetence, it’s their physicial infra being broken from weather or some other “natural event”.

Even then, I can’t justify paying their crazy rates for 5g backup year round just for it to kick in once or twice a year or a couple nights where I’m not awake anyways.

Every email server that sends mail should have a rety mechanism if it fails to deliver too, so you shouldn’t miss any mail as long as your server isn’t offline for too long.

Ofc you are allowed to need 99.99% uptime for your home server, just disagreeing that it’s a need for most of us (including me).