@DeltaTangoLima@reddrefuge.com
@DeltaTangoLima@reddrefuge.com avatar

DeltaTangoLima

@DeltaTangoLima@reddrefuge.com

Just an Aussie tech guy - home automation, ESP gadgets, networking. Also love my camping and 4WDing.

Be a good motherfucker. Peace.

This profile is from a federated server and may be incomplete. Browse more on the original instance.

DeltaTangoLima,
@DeltaTangoLima@reddrefuge.com avatar

It’s about fitness for purpose, IMO.

I recently migrated most of my homelab to Proxmox running on a pair of x86 boxes. I did it because I was cutting the streaming cord, and wanted to build a beefy Plex capability for myself. I also wanted to virtualise my router/firewall with OPNsense.

Once I mastered Proxmox, and truly came to appreciate both the clean separation of services and the rapid prototyping capability it gave me, I migrated a lot of my homelab over.

But, I still use RasPis for a few purposes: Frigate server, second Pi-hole instance, backup Wireguard server. I even have one dedicated to hosting temperature sensors, reed switches, and webcams for our pet lizard’s enclosure.

Each has their place for me.

DeltaTangoLima,
@DeltaTangoLima@reddrefuge.com avatar

Saved me the effort, thanks. Although, couldn’t you just block the container from talking outside your network? I can’t see why I’d need a memo app (server) to have access to the internet.

DeltaTangoLima,
@DeltaTangoLima@reddrefuge.com avatar

Ah, nice one. Still, a bit annoying that it’s opt out, rather than opt in.

DeltaTangoLima,
@DeltaTangoLima@reddrefuge.com avatar

This is why all my automations are in Node-Red. Reusability.

DeltaTangoLima,
@DeltaTangoLima@reddrefuge.com avatar

Forked, and mirrored to my Foregjo instance

DeltaTangoLima, (edited )
@DeltaTangoLima@reddrefuge.com avatar

I didn’t go nasty, but did do my bit to point out how short sighted this move was:

I just wanted to say that your silly take down notice on the Home Assistant developer, who was enabling greater satisfaction for customers who bought your products, was a perfect example of the Streisand effect in action: en.wikipedia.org/wiki/Streisand_effect

Thanks to you, I (who didn’t own - and now probably never will - any of your products), am not only aware of your silly, unethical, and pointless behaviour, but have now taken steps to preserve the developer’s code for future use.

You could’ve fostered this innovation, and gained yourselves the admiration of global, active and thriving community of like-minded people. And potentially gained more paying customers in the process.

Instead, you have achieved the opposite. Well done.

It won’t make a lick of difference, but hopefully they get the same sentiment enough times that they at least understand what a fuck-up this was, on their part.

Edit: at least I know they got it

DeltaTangoLima,
@DeltaTangoLima@reddrefuge.com avatar

Yeah - they need to hear this a lot. They could absolutely have taken a little time to understand what need the dev was filling here. Ultimately, this could’ve been a free kick for them, had they handled it the right way.

DeltaTangoLima,
@DeltaTangoLima@reddrefuge.com avatar

Forked, and mirrored to my Forgejo server. As someone else pointed out on a different community, this is a great example of the Barbra Streisand effect in action.

People like me, without Haier appliances, are now aware of this fuckwittery, and have actively taken steps to preserve the code, before it gets taken down.

Dickheads.

DeltaTangoLima,
@DeltaTangoLima@reddrefuge.com avatar

“Specifically, the plug-ins are using our services in an unauthorized manner, which is causing significant economic harm to our Company.”

Presumably, they don’t charge customers extra for hOn, so surely the only people using it via HA are the same people that would otherwise have used their (presumably) shitty app that isn’t meeting the customers’ needs in the first place?

Not clear on how this causes them “significant” economic harm. Dick move.

DeltaTangoLima, (edited )
@DeltaTangoLima@reddrefuge.com avatar

Yeah - in an ideal world, the dev would have the means (and legal standing) to challenge this, just to force the fuckers to admit it in court.

Not that it isn’t written into their ToS somewhere - just would love them to admit exactly how that harms them so much, financially speaking. Shine a light on the whole thing.

DeltaTangoLima, (edited )
@DeltaTangoLima@reddrefuge.com avatar

Looking at the brands they already own, it’s not hard to picture a future where they’ll own a brand I want to buy.

Although, I’m really interested (and haven’t done reading up on hOn yet) - just what level of automation are people looking for on their appliances? I used smart plugs with current measurements, so I can easily get HA to just tell me when my washing machine or dishwasher are finished.

What else are people doing with hOn in HA?

DeltaTangoLima,
@DeltaTangoLima@reddrefuge.com avatar

I reckon it’s probably not that much. There has to be tens of thousands of customers worldwide that are using their shitty app.

Forks and stars on the original repo numbered only in the hundreds.

Cloud services and API gateways usually charge once you get into the millions of requests. Amazon API Gateway doesn’t even charge for having the APIs active - only for the requests that are received and the data transferred out.

I’m finding it very difficult to believe a few hundred HA users even came close to putting a dent in their cloud bill.

Pi-Hole or something else for network ad blocking?

I’ve been aware of pi-hole for a while now, but never bothered with it because I do most web browsing on a laptop where browser extensions like uBlock origin are good enough. However, with multiple streaming services starting to insert adds into my paid subscriptions, I’m looking to upgrade to a network blocker that will...

DeltaTangoLima,
@DeltaTangoLima@reddrefuge.com avatar

Really? I run several Chromecasts, and I block their access to all DNS services except my internal Pi-holes. They work just fine.

DeltaTangoLima,
@DeltaTangoLima@reddrefuge.com avatar

Lol - not my first rodeo. I’m blocking dns.google as well, and I’m 99.999% certain Google won’t have coded Chromecasts to use anyone else’s DNS servers.

DeltaTangoLima,
@DeltaTangoLima@reddrefuge.com avatar

Ah - I only have the Chromecast GTVs. Good to know I don’t need to pay for an upgrade then!

DeltaTangoLima,
@DeltaTangoLima@reddrefuge.com avatar

If you have the means, you could self-host a Piped server? Otherwise, try out piped.video.

DeltaTangoLima,
@DeltaTangoLima@reddrefuge.com avatar

Yeah, I had the same experience with the devs of Pushbullet, after constructively suggesting a few ways they might be able to work with proxy servers, and all I got back was “Proxies are bad, mmmmk?”.

Fucken Peter Pan-level mentality.

DeltaTangoLima, (edited )
@DeltaTangoLima@reddrefuge.com avatar

Nah - don’t make excuses for them. Here in Australia, we call entitled people like this cunts. With a hard ‘c’. Not the nice one, with a soft ‘c’.

DeltaTangoLima,
@DeltaTangoLima@reddrefuge.com avatar

To answer each question:

  • You can run rootless containers but, importantly, you don’t need to run Docker as root. Should the unthinkable happen, and someone “breaks out” of docker jail, they’ll only be running in the context of the user running the docker daemon on the physical host.
  • True but, in my experience, most docker images are open source and have git repos - you can freely download the repo, inspect the build files, and build your own. I do this for some images I feel I want 100% control of, and have my own local Docker repo server to hold them.
  • It’s the opposite - you don’t really need to care about docker networks, unless you have an explicit need to contain a given container’s traffic to it’s own local net, and bind mounts are just maps to physical folders/files on the host system, with the added benefit of mounting read-only where required.

I run containers on top of containers - Proxmox cluster, with a Linux container (CT) for each service. Most of those CTs are simply a Debian image I’ve created, running Docker and a couple of other bits. The services then sit inside Docker (usually) on each CT.

It’s not messy at all. I use Portainer to manage all my Docker services, and Proxmox to manage the hosts themselves.

Why? I like to play.

Proxmox gives me full separation of each service - each one has its own CT. Think of that as me running dozens of Raspberry Pis, without the headache of managing all that hardware. Docker gives me complete portability and recoverability. I can move services around quite easily, and can update/rollback with ease.

Finally, the combination of the two gives me a huge advantage over bare metal for rapid prototyping.

Let’s say there’s a new contender that competes with Immich. I have Immich hosted on a CT, using Docker, and hiding behind Nginx Proxy Manager (also on a CT).

I can spin up a Proxmox CT from my own template, use my Ansible playbook to provision Docker and all the other bits, load it in my Portainer management platform, and spin up the latest and greatest Immich competitor, all within mere minutes. Like, literally 10 minutes max.

I have a play with the competitor for a bit. If I don’t like it, I just delete the CT and move on. If I do, I can point my photos… hostname (via Nginx Proxy Manager) to the new service and start using it full-time. Importantly, I can still keep my original Immich CT in place - maybe shutdown, maybe not - just in case I discover something I don’t like about the new kid on the block.

DeltaTangoLima,
@DeltaTangoLima@reddrefuge.com avatar

Yep, all true. I was oversimplifying in my explanation, but you’re right. There’s a lot more to it than what I wrote - I was more relating docker to what we used to do with chroot jails.

Self-hosted or personal email solutions?

I have a unique name, think John Doe, and I’m hoping to create a unique and “professional” looking email account like johndoe@gmail.com or john@doe.com. Since my name is common, all reasonable permutations are taken. I was considering purchasing a domain with something unique, then making personal family email accounts for...

DeltaTangoLima,
@DeltaTangoLima@reddrefuge.com avatar

Yeah, that’s the other thing that shits me. Paying for my wife and I on Workspaces, and we don’t have family sharing rights. We’re literally paying to be treated like second-class citizens!

DeltaTangoLima,
@DeltaTangoLima@reddrefuge.com avatar

At the time of my move I went through my list of apps I bought and tallied the ones up, that I still used. It was less than $50 of repurchases.

Yeah, I know this what I should do too. As someone else said in this comment thread, gotta tear that bandaid off at some point. Just shits me that I should have to. But the freedom after doing it… <chef’s kiss>

DeltaTangoLima,
@DeltaTangoLima@reddrefuge.com avatar

Yeah, still got my ancient free Gmail account going. Will probably revert to that.

Planning on setting up Proxmox and moving most services there. Some questions

I am currently running most of my stuff from an unraid box using spare parts I have. It seems like I am hitting my limit on it and just want to turn it into a NAS. Micro PCs/USFF are what I am planning on moving stuff to (probably a cluster of 2 for now but might expand later.). Just a few quick questions:...

DeltaTangoLima,
@DeltaTangoLima@reddrefuge.com avatar

No worries mate. Sing out if you get stuck - happy to provide more details about my setup if you think it’ll help.

DeltaTangoLima,
@DeltaTangoLima@reddrefuge.com avatar

You still need to do that, but you need the Linux bridge interface to have VLANs defined as well, as the physical switch port that trunks the traffic is going to tag the respective VLANs to/from the Proxmox server and virtual guests.

So, vmbr1 maps to physical interface enp2s0f0. On vmbr1, I have two VLAN interfaces defined - vmbr1.100 (Proxmox guest VLAN) and vmbr1.60 (Phsyical infrastructure VLAN).

My Proxmox server has its own address in vlan60, and my Proxmox guests have addresses (and vlan tag) for vlan100.

The added headfuck (especially at setup) is that I also run an OPNsense VM on Proxmox, and it has its own vlan interfaces defined - essentially virtual interfaces on top of a virtual interface. So, I have:

  • switch trunk port
    • enp2s0f0 (physical)
      • vmbr1 (Linux bridge)
        • vmbr1.60 (Proxmox server interface)
        • vmbr1.100 (Proxmox VLAN interface)
          • virtual guest nic (w/ vlan tag and IP address)
        • vtnet1 (OPNsense “physical” nic, but actually virtual)
          • vtnet1_vlan[xxx] (OPNsense virtual nic per vlan)

All virtual guests default route via OPNsense’s IP address in vlan100, which maps to OPNsense virtual interface vtnet1_vlan100.

Like I said, it’s a headfuck when you first set it up. Interface-ception.

The only unnecessary bit in my setup is that my Proxmox server also has an IP address in vlan100 (via vmbr1.100). I had it there when I originally thought I’d use Proxmox firewalling as well, to effectively create a zero trust network for my Proxmox cluster. But, for me, that would’ve been overkill.

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • localhost
  • All magazines
    •
    Loading…
    Loading the web debug toolbar…
    Attempt #