He’s got to golf at some point.

Yea that’s the whole trusting trust thing. You can theoretically set up hour browser to only trust your private CA and not trust any of the publicly trusted CAs. Depends on your threat model I suppose.

Because a private CA allows you to create a certificate and nobody else has the ability to create certificates unless you give them the keys or a signing CA. With Let’s Encrypt, you are trusting every major certificate authority to not create a cert on your domain; coupled with DNS poisoning means you would end up on a legit-looking but counterfeit website of yours.

You’ll have to explain that one to me.

1. Never host anything that is externally accessible
2. If you have to, put it behind a VPN (OVPN, Wireguard, IPSec, Tailscale, etc.)
3. Certificate based authentication is preferred for VPN tunnels
4. Always TLS encrypt your actual endpoints. Private CAs are most secure but a pain in the ass. Let’s Encrypt is very simple to set up in most cases.

Just my 2 cents.

It’s akin to virtually starting with a block of marble and removing every part (pixel) that isn’t the resulting image. Crazy how it works.

I have been burned by WD Red on SMR drives, so I will just say Fuck You WD. That is all.

Services the only supported sqlite databases struggled (Jellyfin). Anything that worked with postgresql worked like a charm. So trick on the sqlite ones is a local PV then do a task to copy to NFS periodically.

My setup was a central NAS hosting an NFS server then each Pi mounted PVs from the NFS CSI driver over the network and I only used local storage to boot the OS.

I manually manage the media files but I do assign the categories, I just mount it on Jellyfin as read only so it can’t make any changes and it stores the metadata and album art on the Jellyfin system partition.

Raspberry Pi 4 4GB handled it just fine for me the last couple years.

Figure out why my new 10GbE NIC won’t read in my repurposed gaming rig (now server), get all my storage migrated over to Ceph, transition my services over to Proxmox hosted Talos k8s stack from my RPi-hosted k3s stack.

A relatively newish SBC can run Jellyfin and even do some light transcoding (single stream full HD or 2-3 streams SD).

I love Jellyfin (kind of love/hate haha), but I would never trust it to manage my media files themselves.

Definitely check out k3s. I ran a 7 node arm64 cluster for a couple years and it served me well. I’ve since graduated to proxmox/ceph and all that, wish me luck 😅

Check out ansible for ways to automate this stuff. Highly recommended!

Honestly, what you’re trying to do is a great use case for docker already. I suggest learning more about how to use docker, take backups, restore from backups, etc. E.g., I have a NFSv4 share that I store all of my containerized services’ config and data files in. Any time I need to restore a precious version, it’s as easy as restoring the previous version files and starting the previous version container.

They keep moving the bar every time we find middle ground. What do you expect?

Guess that makes two of us. More like .11 + .33 doesn’t = .5

I read it as “A third of a third plus a third is a half.” Which makes sense to me. What an I missing?