As others have said, I’d play with routing/IP forwarding such that being VPN’d to one machine gives you access to everything — basically I would set it up as a “road warrior” VPN (but possibly split tunnel on the client [yes I know, WireGuard doesn’t have servers or clients but you know what I mean]).
Alternately, I think you could do some reverse proxy magic such that everything goes through the WireGuard box — a.lan goes to service A, b.lan to service B, etc., but if you have non-http services this may be a little more cumbersome.
As in you upgraded from a previous Lemmy? More than likely your database is migrating and it can take a while. ~30 minutes or more depending on your server.
Don’t bother with VPN just use Tailscale, and install the client on your other devices (they have clients for every OS).
This creates an encrypted virtual network between your devices. It can even enable access to hardware, like printers (or anything with an IP address) by enabling Subnet Routing.
To provide access to specific resources for other people, you can use the Funnel feature, which provides an entrance into your Tailscale Network for the specified resources, fully encrypted, from anywhere. No Tailscale client required.
And if you have friends who use Tailscale, using the Serve option, you can invite them to connect to your Tailscale network (again, for specified resources) from their Tailscale network.
This right here. As a member of the OpenNIC project, I used to run an open resolver and this required a lot of hands-on maintenance. Basically what happens is someone sends a very small packet requesting the lookup of something which returns a huge amount of data (like DNSSEC records). They can make thousands of these requests in a short period, attempting to flood out the target domain’s DNS servers and effectively take them offline, by using your open server as the attacker.
At the very least, you need to have strict rate-limiting controls on DNS lookups. And since the requests come in through UDP, they can spoof their IP address so you can’t simply block an attacker. When I ran into this issue, I wrote up scripts to monitor for a lot of requests to the same domain name and outright block those until the attack stopped. It wasn’t a great solution, but it did at least make sure my system wasn’t contributing to an attack.
Your best bet is to only respond to DNS requests for your own domain(s). If you really want an open resolver, think about limiting it by creating some sort of sign-up method (for instance, ddns servers use a specific URL to register the changing IP of known users), but still keep the rate-limiting in place.
I’ve had this happen when I had too many USB devices plugged into it. It was having power underrun, and acting unresponsive while trying to compensate. I solved it with a powered USB hub.
Edit: I’ve had pairing it with an off brand power brick cause the same problem, too. Apparently the 3 and later Pi really want better power quality regulation, and some of the cheapo bricks I had lying around - while providing the right Volts and Amps, didn’t control the variation well enough for the modern Pi computer.
That’s the weird part is that I don’t have any USB devices attached. I have Ethernet, power cable, and the fan on the case has pins going to some headers.
The case did come with another power supply so maybe I’ll try that and see if anything changes.
@AverageGoob I have this issue with one of my hosts as well. It appears to be a problem with the micro SD card. Same card, different pi = same problem. I'm currently working around it with a watchdog but will need to replace the card soon.
Are you running your OS from USB or from a micro SD card?
I upgraded to the Pi4 but I use this case. It has a daughter board that lets me use an m.2 SATA SSD over USB. But any USB to SATA adapter should work fine
@a_fancy_kiwi I agree, same here. This is the last pi that's running off an SD card with services that do "significant" disk I/O. I have a few zeros that only really write to the card for OS updates. Their job is to collect data and send it via the network. I haven't had issues with that kind of workload using micro SD cards.
Edit: For Pis with write workloads I'm using basic USB3 SSDs. Didn't have good results with USB sticks though.
@AverageGoob The watchdog saves me from rebooting the host manually, but at the risk of data loss (though not more than a locked up SD card). I configured a custom script that writes to a file, when the card has problems, the watchdog kicks in. To keep the script from stressing the card even more, the script only writes to the file every few minutes.
As you said it's only a workaround. I'll move the stuff on the problematic host to a VM with SSD shortly.
I use technitium but it’s like pihole, designed for a few concurrent users in a local network? Instead you want that anyone in the world can use your DNS?
But you would only attract bad actors, normal users won’t use a random DNS server as it could redirect specific sites to phishing pages
Oh right, that makes sense. I was only thinking of Matter as serving low bandwidth devices but it also runs over WiFi and ethernet so I guess it can do video for security cameras etc. and evidently Casting audio and video also.
What’s wrong with miracast? Almost every device sold these days has some kind of radio, but no way to talk to each other. Releasing a new standard every few years won’t help much.
I don’t know the specifics of Miracast, but my impression was that it is specifically used to cast a video stream from one device to another device. That is sometimes useful, but not what I typically use my Chromecast for.
The most useful feature of my Chromecast is the ability to be logged into Plex/Netflix/HBO/Spotify/YouTube/etc on my (or my guest’s) mobile device, and effectively send a link and a (probably ephemeral) token to the Chromecast so that it can stream directly from the server to the Chromecast without my mobile device spending battery power and bandwidth being a middle-man.
And I assume the difficult part here is down to copyright reasons. Most of those streaming sites already limit the number of devices you can permit to stream content (which sucks, but is besides the point), so my impression is that they need to have some kind of under-the-table agreement with the Chromecast/Roku/Firestick/Apple TV/etc. folks to ensure that the device will correctly validate the credentials, not save any of the content, and properly dispose of everything when it’s done. And I assume Google has similar talks about when a device on the network is allowed to be listed as a casting device to apps.
Isn’t Miracast for sending video data? The thing I like about Chromecast is that the phone or remote app just tells the Chromecast where to load the media directly from, and then only sends playback control commands. That makes it a lot lighter resource wise because you don’t need to proxy the stream through a device like a phone that wants to go to sleep to save battery.
This looks neat, though sounds like only the grayjay/futo app can cast to it, and I doubt any official streaming app would natively adopt it. Assuming it’s not just casting a video feed from your phone, my guess as to how it works is, it just copies the relevant cookies over to the fcast device where it can just pretend to be your phone as far as the server is concerned.
This would be fine if it supports all the apps I use, and I’m the only one ever casting, but I don’t want to force guests to install and configure another middleware app to just to cast stuff. My hope is that Matter will somehow solve these, but I probably shouldn’t get my hopes up.
I should try setting up fcast either way though, see how it goes. Thanks.
selfhosted
Oldest
This magazine is from a federated server and may be incomplete. Browse more on the original instance.