I would suggest having an nginx as a reverse proxy (I prefer avoiding a container as it’s easier to manage) and the have your services in whatever medium you prefer.
I’m lucky enough to be in a company where Windows is banned by the CEO. Granted, there are 4 (I believe) exceptions, but the vast majority of employees have an Ubuntu workstation and everyone has a macbook. A bit of a shame this macbook thing, really. A 2 grand thin client to ssh into my desktop when working remotely :D
Yes, very. This is not specific to Firefox, but anything running as root gets access to everything. Only one thing has to go wrong for the whole system to get busted.
usually logged into KDE Plasma as root.
Please don’t do this! DEs are not tested to be run as root! Millions of lines of code are expected to not have access to anything they shouldn’t have and as such might be built to fail quietly if accessing something they shouldn’t in the first place. Same thing applies to Firefox, really.
Is there anything else I should keep in mind for fstab if I want to, say, not keep track of my Downloads folder when snapshotting?
Just create a separate subvolume for it. Snapshots do not work recursively, so it will be left alone.
Mount options also only take effect on the first mount of the device. Since it looks like you only have 1 btrfs device - only / needs the options, really.
Debian world - apt sucks. For something with a sole purpose of resolving a dependency tree, it’s surprisingly bad at that.
Redhat world - everything is soooo old. I can see why business people like it, buy I rarely, if ever, agree with business people.
Opensuse world - I’ve only tried it once, probably 15 years ago. Didn’t really know my way around computers all that much at the time, but it didn’t click and I’ve left it. Later on I found out about their selling out to Microsoft and never bothered touching it again.
Arch - it was my daily for a year or two. Big fan. It still runs my email. At some point the size of packages started to annoy me, though. Still has the best wiki. I’ve never really bothered with the spinoffs, as the model of Arch makes them useless and more problematic to deal with.
I’ve got the Gentoo bug now. For the first time I genuinely feel ~/. A lean, mean system of machines :)
It’s not wrong, as such, but simply not right. Since you’re using btrfs, having a separate partition for home makes little sense. I, personally, also prefer using a swapfile to a swap partition, but that’s potato/potato.
Yes, it can be done. Not to the point of deleting your key (that makes no sense - you need the key), but ssh-agent is what you want. Add it to your shell config and it will only ask to be unlocked once per however often you define.
I have this function defined and called:
<span style="color:#323232;">function ssh-agent-setup() {
</span><span style="color:#323232;"> # SSH agent
</span><span style="color:#323232;"> pid_file="$HOME/.ssh/ssh-agent.pid"
</span><span style="color:#323232;"> SSH_AUTH_SOCK="$HOME/.ssh/ssh-agent.sock"
</span><span style="color:#323232;"> if [ -z "$SSH_AGENT_PID" ]
</span><span style="color:#323232;"> then
</span><span style="color:#323232;"> # no PID exported, try to get it from pidfile
</span><span style="color:#323232;"> SSH_AGENT_PID=$(cat "$pid_file")
</span><span style="color:#323232;"> fi
</span><span style="color:#323232;">
</span><span style="color:#323232;"> if ! kill -0 "$SSH_AGENT_PID" &> /dev/null
</span><span style="color:#323232;"> then
</span><span style="color:#323232;"> # the agent is not running, start it
</span><span style="color:#323232;"> rm "$SSH_AUTH_SOCK" &> /dev/null
</span><span style="color:#323232;"> >&2 echo "Starting SSH agent, since it's not running; this can take a moment"
</span><span style="color:#323232;"> eval "$(ssh-agent -s -a "$SSH_AUTH_SOCK")"
</span><span style="color:#323232;"> echo "$SSH_AGENT_PID" > "$pid_file"
</span><span style="color:#323232;">
</span><span style="color:#323232;"> >&2 echo "Started ssh-agent with '$SSH_AUTH_SOCK'"
</span><span style="color:#323232;"> fi
</span><span style="color:#323232;"> export SSH_AGENT_PID
</span><span style="color:#323232;"> export SSH_AUTH_SOCK
</span><span style="color:#323232;">}
</span><span style="color:#323232;">
</span><span style="color:#323232;">ssh-agent-setup
</span>
This way it stores the unlocked key in memory until the end of the session.
I didn’t add it to any lists, but to the network interface itself. You know the output of ip a? The one pihole listens on (wg0 in my case, because wireguard) has something like, say, 10.0.0.1, but also8.8.8.8. So when a DNS packet is spit out by chromecast to go to 8.8.8.8 UDP port 53 - my pihole happily answers that request. You could also do a separate unbound instance on a new virtual interface with a quad8 ip and just forward everything to pihole, if you fancy.
I solved that by adding an 8.8.8.8 ip to my pihole interface. Because of how TCP/IP works, this has the fewest hops and is, therefore, the one to be used. I’m blocking all outbound DNS traffic for good measure.