Haha, I don’t really know, it just seems easier to remember.

B or death.

So long as my mortal body can pull drops, it will be B. Or you’re fired.

My friend, I am a daily user of tempus and it is amazing.

Late to reply here, but I set this up and it’s pretty great. The space savings is cool, but what I like is the compatibility with various Jellyfin player apps is much better. I had a number of files with over twenty subtitle tracks all labelled “undetermined”. Using subtitles on these episodes on certain (Roku) versions of Jellyfin player was an unpleasant experience. Muxarr cleaned that all up.

Could be.

Speedtest (the ookla one) uses a bunch of traceroute and compares hops to pick a peering point, but they display your public IP on the test page and probably use some icanhzip or other service to know that. It should come as no surprise to you that most north American ISPs pay Ookla to prefer peering points in which they have a heavy presence.

Icanhazip is an older service, I’m surprised cloudflare didn’t just kill it, they built their own when they were standing up 1.1.1.1.

Could also be some other tooling on your lan built before the Claude days.

The back story of icanhazip is OK, but I want to know where you picked it up in your logs… Incoming on edge? Something in your network dialing out?

You’re a programmer, what would you recommend?

Hah! By trade, I’m a sysadmin, my daily is security reviews at the planning and governance level.

I spent a good 6 years working in a Dev shop, and I picked up a lot of habits there, learned a ton about rest APIs, etc.

Setting up a vault for secrets (Hashicorp’s vault is a popular one) might be a bit overkill for your needs in a homelab, but it’s a great way to inject some security into python, bash scripts, which I think is useful, because lots of us start with scripting and move from there.

The basic mechanism is you set up the vault, define pools, etc and then use a token request instead of putting the secret in the script itself. There are tons of examples for each language and mode, but i just use a vault command in the script, throw the output in a variable and that’s pretty much it.

Secrets management in Dev and devops work is really interesting, if you ask me. All the way from the IDE to prod, there are many ways to leak passwords, api tokens, paths no one should know, etc.

Edit: I hope you didn’t take the vault comment as an admonishment, I meant it to be an interesting suggestion.

Edit 2: sometimes I wish I could go back to more technical stuff, that’s pretty much my reason for doing homelab stuff.

Well, it’s not super difficult. I sort of mash my way through getting data by api by just using curl and then clumsily filtering the output.

You’ve already got the mechanism to get the data, I think your solution is fine. My way to do it is just a relic from my time working with a bunch of devs.

I would have just baked an api call to navidrome in a shell script with an interpreter like js and some bash variable manipulation and called it directly from motd.

For security, you may want to look at vault for secrets management so you don’t have to expose plaintext secrets in your script.

I’ve been working solo on this project for the past year

The commit history is three weeks old, so that becomes difficult to believe.

You are trying to de-jargon topics, and that’s fine, but the two following categories do not help, they are localized habits and don’t have any value to non-english or nontechnical people, or both:

• shortenings: a11y for accessibility is not a common contraction, it’s not helpful for anyone to understand the term itself
• names of services: CF for cloudflare is not something worth defining. Names change, and you wouldn’t see this in a professional document. It’s like defining “lol”, the acronym is shorthand in typed communication, not technical jargon.

Side note, DNS stands for domain name system, it has never meant domain name service.

I personally find bots annoying, half the content on the internet is already bots.

Oh, yeah, absolutely. Suricata was created not long after snort, in the days when an ids did the gathering and the correlation.

You’re totally right, the way most people and orgs do it today is to ship ids logs to a siem for the correlation, overall easier to manage. ELK is the go-to for most, not sure about wazuh, I’ve only seen it in the homelab space, but it might work.

There is a distro (not totally open source) called SELKS, which sets up suricata, elastic and some other tooling (kibana) in a commonly-used setup. I deploy it a lot because it saves time with the non-security setup with dB’s and such. Pretty easy to point syslog to it and you can see alerts right away and start tuning.

I’m envious of your position, I learned a lot setting this stuff up.

The mirrored traffic will retain their VLAN tags and Suricata can parse these tags.

I’m not sure how far down this path you’ve gone, but suricata will not automatically correlate primitives into actual alerts from different vlans without transforms, which are cpu-intensive for what they do.

You may want to pull your tap/span/mirror from a point where they converge, like internal side of network egress.

How did you monitor your vlans with suricata? I have enough trouble tuning a couple subnets, never mind tuning for correlation between 3 or 4. This assumes you have different subnets per vlan, of course.

deleted by creator

Agreed. I’ve seen 172 addresses self-assigned before, even though the apipa spec says it should be 169.254.x.x.

Easynews and nzbgeek.

Well worth the 30euro each per year.

I don’t use proxmox anymore, but it certainly needed a proper dashboard for basic metrics.

I’ve been downloading shows for 30 years and all the manual curating and renaming is for the birds.

I think it’s fine for yourself, but as soon as other ppl are relying on you for this, it becomes a full time job.

We’ve seen other companies pull this move by saying “lifetime” only applies to X version.