Hi all,

I am running proxmox on a mini PC with a handful of services in my stack. I also run NPM in an LXC to reach my services through my domain name (service.domain.tld).

For my Arr related stuff, I use Usenet, and everything runs through a VPN.

I have three services which are public. Jellyfin, Seer and BookOrbit (for syncing Kobos).

Currently I have no security besides the built in login managers from the services, but I am considering setting up Authentik. I know I’m asking for trouble with my current set up.

I have elderly and extremely tech averse family members who live in two countries other than me, so tech support can be a challenge.

A lot of people suggest running a VPN, but it would be difficult for my family and I don’t know how to make it work syncing our Kobos with BookOrbit.

I’ve also seen some posts about tunneling to a VPS somewhere and users can connect to the VPS without a VPN.

I feel this question has been asked several times, and I tried searching here and on the internet in general, but my knowledge is not good enough to use the right terms and to get something that is idiot proof.

Any suggestions on best practices or links to guides you recommend would be much appreciated. Also, what EU based affordable VPS would you recommend?

  • MonkderVierte@lemmy.zipEnglish
    6·
    10 hours ago

    So the public services are purely for private use, to sync your mobile devices? You can install Wireguard on Android, send them over there. Though for e-reader, since they are Kobos (basically Android), you can trick it to install the app. Or even another launcher/book reader.

    • neo2478@sh.itjust.worksOPEnglish
      3·
      8 hours ago

      Kobo uses its own OS, not Android unfortunately. But I just found a tailscale plugin for it, so will try that

      • MonkderVierte@lemmy.zipEnglish
        1·
        6 hours ago

        Yeah, not “Android” like Amazons’ is not Android; all based on AOSP but not certified for Play Store. Or is it depending on the device in Kobo, do they use something else too? The ones i know (Leaf, Note) have the not-Android ROM.

        • PerogiBoi@lemmy.caEnglish
          3·
          5 hours ago

          Kobo runs a light linux software called NickelOS on an esp32 board. No android at all. No ability to instal apks. Its not even AOSP.

          One can install a custom OS over top called KOreader which expands its usability and offers tons of community led plugins.

          • surewhynotlem@lemmy.worldEnglish
            2·
            4 hours ago

            I hate our kobos. The app is shit. Total waste of money.

            But this gives me hope. I’m going to play with this.

            • PerogiBoi@lemmy.caEnglish
              1·
              34 minutes ago

              I love my kobo precisely because there’s a huge community behind KOreader. Lots of YouTube tutorials, lots of flexibility. My kobo kept dying at like 50% battery and I just assumed it was a bad battery. Turns out NickelOS was trying to cache a book infinitely in the background so the battery calibration was wildly off because it never properly achieved a sleep state when powered down.

              I left it sitting for a year and a half. Charged it for a full day to balance the cells, copy pasted the files needed for KOreader, changed a config file so that NickelOS would not cache items in hidden folders, and then threw all my epubs onto a hidden folder called “. books” and boom.

              New life in my kobo. I use it daily now. Battery is accurate to 20% (then it sorta doesnt turn back on but whatever). Fair warning though because KOreader is so expansive that its a rabbit hole. UI takes getting used to but the customizability is huge and it runs more efficiently without bloat and you can even use LocalSend to wirelessly push epubs from any device that can run LocalSend to the Kobo so you never have to plug it in again.

              I sync book progress from my Xteink X4 pro to my Kobo Clara HD using KOSync and have my own little KOSync instance running on my homelab (but you can just use the public instances if you want).

    • Appoxo@lemmy.dbzer0.comEnglish
      2·
      8 hours ago

      Issue:
      Most clients we instruct on homeoffice usage with vpns are already unable to remember the workflow: VPN -> (wait until green for connected) -> open work app -> Do work -> close work app -> disconnect vpn.

      Now you also may not want to tunnel all traffic (if you don’t have a VPS with symmetric Gbit and unlimited traffic) so you’d need to set up split-tunneling and/or limit the apps allowed for the tunnel (works in android).

      Honestly? It would be easier to set up a S2S split-tunnel VPN with wireguard on the relatives router.

      • unique_hemp@discuss.tchncs.deEnglish
        4·
        8 hours ago

        You can just specify AllowedIPs in the wireguard client config to route only traffic to your services through the VPN, works great.

        • Appoxo@lemmy.dbzer0.comEnglish
          2·
          8 hours ago

          Yes. Split-tunneling…
          But if you are really hardcore about restrictions and would need to update the profiles it will be a pita…
          Scheduling stuff is annoying ;-;