Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
  • Post
  • Reply
bobfather
Sep 20, 2001

I will analyze your nervous system for beer money
Vaultwarden is an excellent password manager that is about as feature-rich as 1Password but is open source and free. It is based on Bitwarden, who offer free apps for iOS, Android, Windows, MacOS, and browser extensions for all major browsers.

Adbot
ADBOT LOVES YOU

bobfather
Sep 20, 2001

I will analyze your nervous system for beer money
If you do that, you might as well mention self-hosting Wireguard as being the easiest way to VPN in to access services that should not be exposed to the internet.

bobfather
Sep 20, 2001

I will analyze your nervous system for beer money
To explain that idea even more, you can set up Nginx Proxy Manager to grab your LetsEncrypt wildcard certs for your domain, create a proxy host that redirects subdomain.yourdomain.com to whatever internal service you are self-hosting, and then set your router to do a DNS host override to redirect traffic from subdomain.yourdomain.com to the host running Nginx Proxy Manager. Voilà - valid LetsEncrypt certs on any internal service you care to run.

bobfather
Sep 20, 2001

I will analyze your nervous system for beer money

Neslepaks posted:

I guess you could do that yeah. For my part I just have a wildcard cert for *.internal.mydomain.com that I use internally and then I just provision normal LE certs for anything external like https://www.mydomain.com.

I think we’re talking about the same thing. I merely described one way to use a wildcard LE cert to secure services that are only available on the LAN.

bobfather
Sep 20, 2001

I will analyze your nervous system for beer money
If you self-host a UniFi controller, version 6.5.54 has the log4j mitigation. Update your machines!

For self-hosting UniFi controller, one could use this script if you carefully audit it every time you want to execute it (see BSD's post below). However, one would be better served setting up the controller in Docker, for example, using linuxserver's script.

Note that if you use the docker-compose code as is, you may run into issues with your new instance of UniFi Controller failing to adopt your APs. To solve this, you may have to revert to the old interface (Settings > System > uncheck New User Interface), then go to Settings > Network Application and change 'Console Hostname/IP' to the controller's IP address and also check 'Override inform host with the UniFi OS Console’s hostname/IP.' Restart the controller and your APs should adopt.

bobfather fucked around with this message at 17:19 on Dec 13, 2021

bobfather
Sep 20, 2001

I will analyze your nervous system for beer money

BlankSystemDaemon posted:

It should go without saying, but BE VERY CAREFUL about curling a bash script into your shell (which is effectively what these instructions involve), as it's essentially the same as giving someone remote code execution privileges on your shell, with the added option of enabling privilege escalation for them for free if sudo or doas is involved.

Thanks for this, and yeah, sorry. I will edit my post with caveats.

bobfather
Sep 20, 2001

I will analyze your nervous system for beer money

odiv posted:

Anyone get into PBX? Just installed the Asterisk add-on in home assistant and thinking about getting into a small home phone system.

I rolled a PBX using FreePBX with CallCentric as the VOIP provider. I think newer PBX softwares are simpler to setup and use than FreePBX, with the caveat that most are not free for multiple users. If I had to do it all over again, I wouldn't do it again, because like SamDabbers said, cellphones.

bobfather
Sep 20, 2001

I will analyze your nervous system for beer money

TraderStav posted:

Think I have those but not redacted. No idea how many are used regularly or not. Sounds like there's been some institutionalization occurring.

Some of these sites don’t like to be named in public forums.

Adbot
ADBOT LOVES YOU

bobfather
Sep 20, 2001

I will analyze your nervous system for beer money

Cyril Sneer posted:

Can I ask a stupid n00b question?

I want to setup my own web server (yes I know how to do this part) but I don't have a static ip address. I understand there are ways to deal with this, but I don't really understand the pros/cons of the different options.

(1) no-ip.org offers a free DDNS service, where you can pick your own hostname along with one of their domain names (so like cyrilsneer.no-ip.org). You have to re-confirm every 30 days, but whatever. Then, I run their DUC client on my machine.

(2) On the other hand, lots of the domain registrars (i.e., namecheap) seem to offer DDNS for free, and provide instructions on how to set it up with your own domain. Thus if one has a domain (which I do), then this would seem to obviate the need for no-ip?

(3) In digging into this topic, I inevitably stumble across cloudflare. No matter how much I read about it, I can't figure out what cloudflare does, or how this helps me self-host a website :silent:

I'm going to attempt #2, but I just wanted to get some comments on this. Thanks goons.

If you own a domain, #2 is as easy as setting an A record for your IP address to your domain or subdomain. This can be automated via software if your IP address is prone to changing.

Cloudflare is a domain name registrar (among other things), but you also may have heard of their services like Zero Trust, which basically lets you tunnel traffic through Cloudflare without opening any ports. It is more secure in terms of peeps infiltrating an open port in your firewall, but you give Cloudflare the ability to man in the middle all of your tunneled traffic.

  • 1
  • 2
  • 3
  • 4
  • 5
  • Post
  • Reply