I have my mug shot up in the psychology department of my university so yes that is why I said what I said.

Thank you for the notification, I may have been a little biased when I looked up the info but there are some concerns on the github page.

Us humans have horrible memories there is a whole discipline called psychology, that studies the thing.

I personally feel that Nextcloud should have stayed focused on one thing, but it tries to do to much and fails.

I am in the process of moving all my photos to ente, it looks good. They have paid plans than there is the self hosted option.

Go search out their github page and a few other places, sorry I wanted this to not be true as well.

I think you replied to the wrong person, I never would or never have used Nextcloud for photos.

I am in the process of moving everything into ente.

Nextcloud was not my first selfhosted thing, I was paying a service provider for it when I started self hosting everything else I was already frustrated with how nextcloud did not play well with my homelab so I thought why the heck am I paying for it. I have never had good luck with Nextcloud.

Thanks for saying that, I have been loving immich on one of my pi 5’s now I am going to need to replace it. I am thinking Ente, just cause it is FOSS with paid tears just like vaultwarden/bitwarden.

I have stopped using Nextcloud because I can never get things tuned right, and I feel it is trying to do more than it should.

I have a 2014 mac mini running Debian (just the CLI although I did use the GUI to set it up just removed the GUI later) and it hosts my Jellyfin and *arr stack. I just installed rEFInd on it and booted it to a USB drive with Debian on it, knowing it worked enough to do that much I ran some tests, every thing excluding the HDD said it was working ok. So I stuck an external drive to it and installed Debian on it. In a few weeks I am hoping to inherate a 2018 Mac mini but as I understand it it will be a little more difficult because of a T2 chip or something, not impossible just not as easy.

Sounds neat but I would be worried about the no shell stuff, I run my things headless for the most part and like SSH and occasionally VNC access.

Thank you for coming my nerves, I have been seeing a lot of things on this some sensationalizing this as a big issue and some saying it was not really a big deal. I broke and went to see what of my homelab that really touched the WAN had php, I removed somethings and decided to risk it for someother things.

If it is for backup I will give you that.

Pihole is runs on pi zero’s I am sure you would not have any problemswith running it on your pi 4’s. I have my primary pihole instance running on a pi 5 with a bunch of other things, my secondary pihole instance is running on another pi 5 that used to run ghost which hosts my webpage.

I would say put pihole on both, also put unbound onto whatever one you decide is your main pihole. If you are going to get pihole and setup Matrix with the Whatsapp bridge may I suggest you get a firewall as well, something that you can flash OpenWRT onto. I have a Flint 2 that I have multiple vLANs setup on for security, but also a VPN so that I can have the benefit of all my services away from home. It is something that I wish I had setup a lot sooner.

Of course you will need a static IP address for this, for me my ISP gives them out for free but I understand that it is expensive elsewhere. I do however hear there are apps that emulate static IP’s for things like wireguard to use.

Don’t be stressing the pi out to much, maybe look into investing in more than 1 pi! I personally have had Jellyfin running on a pi 4, a pi 5, but it is currently running on a 2014 Mac mini (with Debian installed).

I have 3 pi 5’s, one pi 4, and a pi 0 2, an old Mac mini running in my LAN, and a VPS running my simple blog and encrypted backups. Shuffling things around is a thing you do as your homelab and services expand.

This hobby becomes an adventure.

They are just pluged in, with battery saving features turned on.

But why? If it is backup I personally have a VPS that backs up stuff and runs a few services. In a few weeks I am hoping to have a second off site backup as well.

I personally use retired devices around the home, they are put on my IoT vLAN and wam bam thank you man I have a kiosk.

My passwords for OS and all admin dashboards are extremely long, unique, random strings managed by Bitwarden.

If you are paying for Bitwarden, or using their free tier, stop and and start hosting vaultwarden. You can still use the Bitwarden app, with vaultwarden but with all the premium features.

Get a firewall you can either install OpenWRT or opnSense on, when making my decision I went with OpenWRT because opnSense has a webpage that tries to upsell you. vLAN the heck out of your place, and set up a VPN to access your services like vaultwarden out side of your home. On a vLAN that cannot access your WAN or anything else put your IoT things, on a vLAN that cannot access anything else setup crowdsec. On the topic of crowdsec it should be your only device that port 22 is ssh!

For your IoT things set up home assistant, which should be on a different vLAN that can reach out to the WAN and into the IoT vLAN to control stuff. I wish I could say I have completly degoogled and deappled, but I am waiting for a year for my iPhone to stop getting updates and whenever for my iPad to stop getting updates. I should probably replace my homepod minis sooner rather than later with the Naebu things for HA. The only thing I still have a Google account for is youtube but once I get a hand me down Mac mini I will install Debian and get a youtube replacement with sponsor block.

One of the things that finally got me off of cPanel was the host I was using decided to rape me over the coals without letting me have a wildcard email address so I got a business plan that I could have unlimited email addresses so if one got spammy I could just turn it off and if I still used the service I just changed the email, or if I wanted to extend a free trial I could just spin up a new address. So I recently moved to a new host that offers wild card addresses.

Get a whole LAN adblocker, let it be pihole or adguard home, there was recently that spyware ad pixel so expect more of those in the future. Me personally use pihole and have it very finally tuned to block a lot. I tried adguard once but liked pihole better, this was years ago even before I had pihole finaly tuned so don’t ask me why I liked pihole more.

What I have done to harden SSH is:

• set up pubkey authentication and disable password authentication
• disable root login
• not expose my SSH port publicly; it is accessible only from my LAN and through Wireguard

I have done those things as well, but I have also

• changed my port, to some four digit number.
• port forwarded port 22 to its own vLAN that goes to a pi 0 2 that runs crowdsec as a honey pot.
• I am looking for additional things to run on either that pi or vLAN for security.

If it was just for backup backblaze is probably less expensive but my LAN consists mostly of pi’s and hand me down computers. I am slowly moving things around on my LAN so to each their own I guess. I like the idea of having more control over my stuff so having a whole Debian system on the other end feels right for me.

*edit: It also gives me peace of mind knowing that I can encrypt my stuff to my liking. Silly me I forgot to actually look at the encryption tool I used, I just did a search and found age was highly suggested. It is coded in Go, sure it is open source and all that I am just not a fan of the language.