Yea I haven’t tried Pangolin myself - looks a bit bloated for my tastes, but I have tried rinetd across Tailscale and it worked brilliantly (very simple conf file), and I’ve done reverse ssh before (using autossh) which was a bit fiddly. frp does look promising though, just as a VPS<->home bridge.
I mean, anything with a web server can have vulnerabilities. Just look at the LastPass breach where hackers got in through an employee’s exposed Plex library.
This video addresses many of the concerns of hosting stuff in public, and details a way (and some tools) to do it relatively securely. (There’s always a risk there’ll be a zero-day vulnerability in a web application like Jellyfin, but you can mitigate against them if you use the right strategies/tools, and you’re vigilant enough.)
Since you’re on cgnat, you can set up Pangolin on a VPS, or Tailscale–>rinetd–>Tailscale tunnel, also on a VPS. (Apparently frp is another similar solution, with p2p proxying.)
MURDERER!
FXP
Oh wow, there’s a name I ain’t heard in a while.
Have 3x such WD Reds 3TBs with average ~100K hours power on each, 34.77 years total.
Spent most of that time in a HP Microserver N54L Windows 2012 R2 server with DrivePool, Scanner and SnapRAID. Now they’re in a custom build Proxmox in RAIDZ1. Have no intention of retiring them. :)
Device Model: WDC WD30EFRX-68AX9N0
ID# ATTRIBUTE_NAME FLAG VALUE WORST THRESH TYPE UPDATED WHEN_FAILED RAW_VALUE
1 Raw_Read_Error_Rate 0x002f 200 200 051 Pre-fail Always - 0
3 Spin_Up_Time 0x0027 179 178 021 Pre-fail Always - 6033
4 Start_Stop_Count 0x0032 098 098 000 Old_age Always - 2163
5 Reallocated_Sector_Ct 0x0033 200 200 140 Pre-fail Always - 0
7 Seek_Error_Rate 0x002e 200 200 000 Old_age Always - 0
9 Power_On_Hours 0x0032 001 001 000 Old_age Always - 110229
10 Spin_Retry_Count 0x0032 100 100 000 Old_age Always - 0
11 Calibration_Retry_Count 0x0032 100 100 000 Old_age Always - 0
12 Power_Cycle_Count 0x0032 100 100 000 Old_age Always - 123
192 Power-Off_Retract_Count 0x0032 200 200 000 Old_age Always - 35
193 Load_Cycle_Count 0x0032 200 200 000 Old_age Always - 2127
194 Temperature_Celsius 0x0022 115 088 000 Old_age Always - 35
196 Reallocated_Event_Count 0x0032 200 200 000 Old_age Always - 0
197 Current_Pending_Sector 0x0032 200 200 000 Old_age Always - 0
198 Offline_Uncorrectable 0x0030 100 253 000 Old_age Offline - 0
199 UDMA_CRC_Error_Count 0x0032 200 200 000 Old_age Always - 0
200 Multi_Zone_Error_Rate 0x0008 200 200 000 Old_age Offline - 0
BiglyBT (aka Vuze previously Azureus) has a decentralised chat feature akin to IRC. It’s not very active but it’s technically very interesting and still working. Rooms can be based on per-torrent, language, region, general purpose and even custom.
It’s a crying shame more people didn’t adopt AceStream. It functioned exceptionally well, when the streaming sites put up links (hashes basically) instead of just http5 web streams. The fact it wasn’t open source probably didn’t help, but it did have a modified VLC client and was truly P2P.
TERF island or the 4th Reich
I get wanting to boycott Israelis due to what their government is doing, but you do realise blocking (the good-ish) half of America is gonna seriously hamper your ability to complete torrents? And if you think the UK is full of TERFs, you probably need to verify your news sources and statistical acumen. You shouldn’t always tar with the same brush…
Aside from this, on a technical merit this is gonna have absolutely zero effect - because in a torrent, you’re part of a mesh - those bits will instantly funnel through peers one way or another, and you’ll never convince enough of the swarm to have an impact. Presumably, the ‘content’ you’re torrenting aligns with your personal ethics anyway, and you’re not spreading hate. So why bother?
Complete and utter waste of time.
WTF! How did it hit target already? Hope there wasn’t any bot farming involved…
Otherwise, pleasantly surprised!
announced
What announcement? There’s been a new Personal Plus plan around for several months already - introduced without much fanfare, and simply brings the user count from 3 to 6 for a fixed small fee. Presumably this is due to feedback from personal users wanting to contribute something other than nothing.
Where do you see the free Personal plan has changed at all?
custom domain
From what I gather, this refers to the email address you sign up with.
If you use something like a non-gmail email address when signing up, it starts you off on the business plan with a trial (which you can instantly change to free). (Note: they’re gonna change this auto-detection thing with shared domains soon due to a security hole.)
I believe you can still use a custom domain (instead of the randomised *.ts.net provided one) with DNS lookups in your tailnet, on the personal (free) plan.
More than just a traditional VPN. @Galapagon@sh.itjust.works was concerned about security and it being always-on. Tailscale is an overlay network that links devices directly, deals with authentication, punching holes through NAT.
You’re limiting yourself somewhat if you’re not able to plug in multiple drives at the same time. Otherwise, I might suggest mergerfs for basic JBOD. You won’t be able to use a single ZFS to avoid bit rot - only detect it. SnapRAID - ideal for offline setups - would be the next step up if you could dedicate one of your drives to parity.
In your position, I’d do Duplicacy backups split/spanned over multiple backup drives (however you connect them).
It has a pretty cool Erasure Coding feature that protects individual chunks from bit rot and possibly even bad sectors, plus the whole database-less architecture makes it very robust. De-duplication, high levels of compress, and encryption. Plus you can keep historic snapshots, so you can avoid the risk of accidentally sync’ing ransomware over the top.
Edit: the CLI is free for personal use, and is source-available. Written in Go and extremely performant.
my dad and I both have hypervisors. Any suggestions on how to share backups without a vpn?
Just use Tailscale on the devices instead of VPN. Secure and no faffing around with port forwarding.
Multiple backups may be kept.
Nice work, but if I may suggest - it lacks hardlink support, so’s quite wasteful in terms of disk space - the number of ‘tags’ (snapshots) will be extremely limited.
At least two robust solutions that use rsync+hardlinks already exist: rsnapshot.org and dirvish.org (both written in perl). There’s definitely room for backup tools that produce plain copies, instead of packed chunk data like restic and Duplicacy, and a python or even bash-based tool might be nice, so keep at it.
However, I liken backup software to encryption - extreme care must be taken when rolling and using your own. Whatever tool you use, test test test the backups. :)
Still using Private Internet Access (PIA).
Honestly, dunno why they’ve fallen out of fashion due to the FUD about being owned by an unsavoury parent company, but the most important matter to me is if they keep logs, which they don’t. One of the few VPN companies tested on this, in court, and in a recent audit. Plus still extremely cheap (if you go for 3yr+3mo).
Port forwarding works with with this docker NAS stack. Doesn’t use gluetun, but there’s a specialised docker-wireguard-pia container as part of the stack, with a script that handles port changes. Been flawless.
They opened it to the internet - that’s the big difference (and the topic at hand). Security is a multi-layered thing, but if your weakest point is a gaping hole, the rest doesn’t mean much. To my point - assuming Jellyfin ain’t gonna have vulnerabilities even when you’re fully up-to-date, is foolhardy.