Post B6IE9uCeM89YKGlXQe by Quz@tech.lgbt
(DIR) More posts by Quz@tech.lgbt
(DIR) Post #B4BlhvHegkgQIsBXDE by Quz@tech.lgbt
0 likes, 0 repeats
After trying to relocate Home onto a different Device for later easier Reinstalls (which seemingly worked), now my Arch No longer recognizes that said drive is even physically connected. According to various sources the issue might be connected to the Bootloader. Funny thing, I cannot access any Bootloader. Like the Device Boots, but the Pi-Bootloader never shows up. As I cannot find any solution online, I guess we will try to do a clean reinstall?
(DIR) Post #B4BlhvlQu2VDnE7Jcu by Quz@tech.lgbt
0 likes, 0 repeats
A somewhat clean reinstall later I now managed to set up WiFi and SSH.(Please dont tell anyone that so far SSH is completely unsecured and only works locally)WiFi did give me some trouble and there is still an error message I couldnt resolve yet (or find online) and my router constantly tries to connect to my Server for some so far unknown reason, but thats tomorrow Nikas Problem.
(DIR) Post #B4Blhvzc3JqSVCkdjE by Quz@tech.lgbt
1 likes, 0 repeats
Today I didnt get much done. I only fixed some errors and made my SSH slightly safer and more convenient.- Static Local IP Address- removing Password Login in exchange for Key Based Login- change the port SSH runs on- Login Shortcut, so I dont have to remember the IP AddressNext Up is the First Major Boss (cause I still need to figure out how to do it): Making SSH work from Outside my Home Network...
(DIR) Post #B4Troj82NNqZCbanqq by Quz@tech.lgbt
1 likes, 0 repeats
It only took me a workweek, a lot of trial and error and some help (thanks again @fugi) to make my Device Remote Accessible.The issue was less the process, but more my own self imposed restriction of using as few external services as possible and the fact that my server is behind CGNAT (So no IPv4 Adress from the Outside).My solution was to create a Tunnel over Wireguard, directly connected via IPv6 to my server. I also set up DDNS with a Domain, but technically that would not be necessary, but might be useful later.
(DIR) Post #B4ZzXtnRQQtzwlCnD6 by Quz@tech.lgbt
1 likes, 0 repeats
Using Arch as a Server might not have been the best idea. Arch rolling release model kind of expects you to manually administer updates and doesnt really seem to differentiate between Security and Other Updates.So I either make sure I dont forget to regularly update my server (Ahahahahaha) or I built a job, that will probably at some point brick my system or (which is the most complicated, but probably most sustainable solution), build myself a reminder system.
(DIR) Post #B6IE9tecOevmciqMNs by Quz@tech.lgbt
0 likes, 0 repeats
So. I could not access my Server remotely, despite it temporarily working. I was really confused, cause I didnt change anything settings wise. Technically true, but I did enable something again. UFW.I installed it as my Firewall, but the Forwarding of the VPN Interface has been done via IP Tables. I did not realise that both are firewalls and UFW overwrites IP Tables (which I would have known if I had checked Iptables setting). So my VPN Interface isnt actually getting forwarded anywhere, so can never be found or seen for connection.Whoops
(DIR) Post #B6IE9txlFUF9a5neDo by Quz@tech.lgbt
0 likes, 0 repeats
After trying it over IPv6, which often doesnt work, when you remote device doesnt get an Address, I finally found a working solution.I got myself a VPS and use it as a Headscale (Selfhoste Tailscale) Server Node. With that I get through CGNAT (as the Homelab is in Tailscale the Device establishing the connection), its still mostly under my control, as the Headscale Server actually only initialises the Connection, the Rest is a Wireguard Tunnel between the Individual Nodes as far as I know...)Apart from Docker it wasnt actually that difficult to set up, and now I have a reasonably modular, vaguely safe way to Remote Access my Homelab (still need to do a lot of Server Hardening tho and see if it works in the locations I had in the past issues).
(DIR) Post #B6IE9uCeM89YKGlXQe by Quz@tech.lgbt
1 likes, 0 repeats
I have my first proper service up (A Seafile) and running and despite having to fight for several days, I managed to actually fix all the initial issues. It works on my own Caddy Reverse Proxy instead of the one they use, which initially seemed impossible and it also doesnt expose ports anymore.
(DIR) Post #B6IE9wvOEl84lbiIRU by Quz@tech.lgbt
1 likes, 0 repeats
Setting this Homelab up was a mess, but I am genuinly quite proud of the result.My only not self controlled Tool I use for my homelab is the VPS on which I run headscale (needed a Public IP) for my own Tailnet. Everything else is Open Source and Self Hosted. All my Services (so far only 1 admittetly), are dockerized and are only accessible via Reverse Proxy to Minimise Port Exposure. Was this way to much effort and I could have used Cloudflare, yes, but I dont care, this is my security, I want to screw it up myself.
(DIR) Post #B6KWOvGMssdnRqjdg0 by Quz@tech.lgbt
1 likes, 0 repeats
So today I went from 1 Service to 4, with two more already in work.So far I have set up Vikunja (a Task Manager), Mealie (Recepie Management), Seafile (Data Storage) and Hedgedoc (Notetaking). I am still planning for Radicale (a Calendar Server) and Syncthing (mainly to Synchronise Obsidian)Next step after that will probably to add TLS back in, simply so my browser stops annoying me (its already encrypted, due to being only accessible via Tailnet)
(DIR) Post #B6NwBNTUNTypAnxCs4 by Quz@tech.lgbt
1 likes, 0 repeats
So, all my for now desired Services are Up and Running, now I need to make this construction actually safe (ish)I do have a baseline of Safety due to it only being accessible via Tailnet and the Server only Opening Ports towards the Tailnet, but I feel I should do a bit more.Next up is TLS. That one mainly cause the constant reminders of of "This is just HTTP, so very unsafe" are annoying.Just need to figure out if I want to keep it fully internal, with a self Signed Certificate or try to essentially misuse a Public Certificate for solely internal use.
(DIR) Post #B6NwQkO7T6wOa7lsJM by fugi@amazonawaws.com
0 likes, 0 repeats
@Quz I have done both, and I find getting a (wildcard) cert from letsencrypt via DNS challenge (works without being reachable from outside) to be nicer. It's not even misusing it, imo
(DIR) Post #B6OOrAz80ArlJfTLTU by Quz@tech.lgbt
1 likes, 0 repeats
@fugi Thank you for the ideaWell, it took me quite a bit, but thats mostly because my setup is a bit non standard (read: stupidly overcomplicated)The Upside is, now my Services are actually provided on their proper address: "nikaserv.you"
(DIR) Post #B6OOso89wd6R0vTU4e by fugi@amazonawaws.com
0 likes, 0 repeats
@Quz yay! :3