I hope this is not against rules 4 and 6, but… I fear it might be?

If you want me to remove the post just tell me (or report it to the mods, of course).

I’m only sharing this because I found it very funny :)

It’s great to see more and more project leaving github!

PS: “Live Demo” on https://www.pdfding.com/ is a dead link

Wow. Do they block VPNs inside your country too?

Anyway, there’s openvpn and there’s nebula (I think nebula doesn’t use wireguard… do double-check), or you look into things built specifically to hide traffic (keyword: “vpn obfuscation”).

No idea if VPN protocols other than wireguard may be blocked too (probably?).
No idea if trying too hard to circumvent government policies may get you added to some list you’d rather not be in.

You’ll need networking basics for anything you do (there are lots of courses on youtube).

After that, you can just follow wherever you curiosity carries you :)

Sure thing!

(also, please do post about it when you eventually decide to switch to linux)

Setting up an OIDC provider isn’t particularly difficult, but you’ll have to run it as a publicly accessible server in order for tailscale to interact with it.

It looks like you can register at netbird.io with email and password.

In your shoes I’d setup that for now, and later look into OIDC or (probably better) into self-hosting nebula (or maybe netbird).

IDK about the current status of x86 with android, but last time I checked it wasn’t good.

Lineage might be your best bet… it supports a few androidtv boxes (most notably the nvidia shield) see https://wiki.lineageos.org/devices/

where SyncThing is overkill

I just have a dedicated shared folder between my phone and desktop and drop oneoff stuff there (it’s also easier to script this way)

For files I use syncthing (also for music/photos/notes/etc… syncing files is IMHO the way to go wherever applicable).

For sending links to my PC (eg. articles linked from podcasts’ notes) I used to rely on firefox sync, but I’m starting to distance myself from Mozilla so I am gonna experiment with wallabang.

For sending small notes to myself (stuff that I want to sort or act upon when I get to my PC), I’m using signal’s “note to self” but I’m investigating alternatives because signal doesn’t mark such messages as unread and so sometimes I forget I’ve sent some.

I’ve blocked the bot because I find it’s more annoying that useful (I’m not complaining - just giving feedback).

That said, IMHO from that list you should remove the entries that:

• are ambiguous (eg: HA has 2 entirely different meanings in your list)
• have become words on their own (eg. DNS, HTTP, etc…): nobody cares what these expand to (think, NASA) and also knowing what these expand to doesn’t help at all (if you tell me that HTTP means “hyper-text markup protocol” will I not have to go read wikipedia anyways to understand what it is?)
• are often not used according to your definition (eg. IP is more often used to refer to an IP address rather than to the protocol) - of course you may want to amend the definitions instead

Also, you should keep the acronym expansion (“RAID” => “Redundant Array of Independent Disks”) from any comment you may want to add (“for mass storage”) and - since you are at it - provide relevant links to wikipedia articles and/or other resources.

PS: since a lot of entries in the list are not even acronyms… maybe you should consider renaming the bot to something related to “abbreviations” or “glossary”?

Synchthing if I want local copies, otherwise I just mount sshfs shares from my nas (using sftpman as a helper)

Getting the router to actually assign an IP address to the server

You would typically want to use static ip addresses for servers (because if you use DHCP the IP is gonna change sooner or later, and it’s gonna be a pain in the butt).

IIRC dnsmasq is configured to assign IPs from .100 upwards (unless you changed that), so you can use any of the IPs up to .99 without issue (you can also assign a DNS name to the IP, of course).

all requests’ IP addresses are set to the router’s IP address (192.168.3.1), so I am unable to use proper rate limiting and especially fail2ban.

Sounds like you are using masquerade and need DNAT instead. No idea how to configure that in openwrt - sorry.

A NAS is just a computer and TrueNAS is just Linux (ok, TrueNAS CORE is Bsd).

You can run zfs on any machine: they recommend loads of RAM for optimal performance, which you don’t need at home (or at work, unless your job is running a data center).

You can choose from a number of FOSS NAS-specific operating systems, plus all linux distros (since you post here, I’d assume you either can or aim to administer a home sever?)… why would you go with a proprietary OS?

There are several FOSS operating systems for network equipment too (keyword “NOS”), but as far as I’m aware none that work on small soho/edge switches. OpenWrt runs both my router (mikrotik) and WAPs (tplink), but the two 8-port switches I have at home (also tplink) run their proprietary firmware.

IDK how much I’d trust them with tech stuff (not much, definitely). However I don’t see how encrypted storage may become an attack vector?

I mean, they could clog up the HDDs with crap, but they can already do that via non-encrypted network storage (and in several other ways).

TLDR: Protesting or resisting privately inside your house does not lead to social change and is not the most rational way of protecting yourself if you feel threatened by your government.

Self-hosting is not “resistance”: at most, it’s prepping for nerds, with computers instead of guns.

Self-hosting is not even a rational/efficient way of making a statement. If that’s what you want, it’s far more efficient to follow the established tradition of declaring you are moving to Canada and not following up with actual actions.

Don’t get me wrong: I can relate to the nerdy way of coping with the ugliness around us (I say “us”, but thankfully I don’t live in the US), but - the way I see it - it’s that your society that needs change, and self hosting won’t help with that.

Frankly, the shit you US people are putting up with is unreal.

It has always been (US police forces kill far more people than the overall homicide rate in Europe - read that again and pause a second to think about it this isn’t true - see comments below), and it’s just getting worse.

If you feel threatened you can essentially respond by fighting, fleeing, or cowering.

If you wanna FIGHT (this is what “resistance” is about), try to use whatever power you have and apply your energies to bring actual change. If you don’t feel comfortable acting outdoors, this could include lending your nerd skills to protesters or (nonviolent) resistance groups. Heck, even being a keyboard warrior is more useful to changing society than being a hobbyist sysadmin.

If you wanna FLEE, just leave the country. Honestly, there are better places to live than the US, and (if you have or plan to have any) better places to raise your children.

If you wanna COWER, then be a prepper or a self-hoster or whatever, but be aware that, while misrepresenting your reaction as “resistance” may make you feel more heroic than you are, spreading the misrepresentation can also lead others to cower instead of fighting. Is that what you want?

is there an easier way to do self-signed certs besides spinning up your own certificate authority?

Letsencrypt works fine, just use a “real” domain and DNS challenge.

Your service will need to be on the “real” domain, but it won’t need to be accessible externally and you won’t need a public DNS entry for it (of course your VPS will still need to be able to resolve the backend’s name).

Leverage whatsapp and hang good old posters around the neighborhood?

Intriguing.

What’s the mechanism for dealing with spammers?

In lemmy there’s a clear escalation path that will lead to either the spammer’s instance dealing with the issue or the instance itself being de-federated.

How would that work in a p2p system?

Each user having to individually block every spammer will work as well as it did for email back in the day.

AFAIU bluehost does not support the acme protocol, so you’ll either have to manage your certificate manually or (recommended!) move to a different dns registrar.

If you are wondering which provider you should switch to, basically all the serious ones will work… IDK if this is relevant for nginx, but here’s a list of the supported ones for the client I use https://go-acme.github.io/lego/dns/

If you are unsure and want to experiment before touching your current setup, you could register a new cheap domain (less than 1$, see https://tld-list.com/), use it for your tests, and then not renew it.

Not sure if others already said this (I seem to see mostly comments explaining how to do it, but didn’t read them all), but, while it’s certainly feasible, you may not want to do that.

A router is the cornerstone of your network (if it goes down, so does the network) and if you are a self-hoster you’ll probably fiddle endlessly with your home server, and of course break it from time to time… the two things just don’t go well together.

Personally, I’d recommend getting some second-hand router appliance that can run openwrt and use that (make sure to check the flashing procedure before deciding what to buy - some are easier than others). Or you could get a dedicated x86 machine… probably overkill though.