How would ZFS snapshots help in a situation like this, where you have accidentally formatted your drive?

Unless you require the dynamic features of Wordpress, you could have a look at some of the static site generators out there (such as Hugo). Having a static site would reduce the attack surface considerably. Also due to the shenanigans happening with Wordpress at the moment, I would be weary of using it.

About SSL, what others have already mentioned, SSL certs are available for free these days, thanks to letsencrypt.

Why? Even 1080p is more than what is usually needed for such a KVM solution. It is not like this is meant for doing remote work on a computer or anything like that.

It lets you remotely control a server as if you were sitting in front of a screen and keyboard directly attached to it.

Perhaps the hard dependency was a mistake, but not them moving more and more code to their proprietary library. It appears that their intent is to make the client mostly a wrapper around their proprietary library, so they can still claim to have an open source GPLv3 piece of software. What good is that client if you can only use it in conjunction with that proprietary library, even if you can build it without that dependency?

Thanks, I haven’t seen that one before, but I’d really prefer an open source application.

BitWarden already has lots of clients.

Does it? I’d be very much interested to know. I’ve been looking for other clients before, because I didn’t like the sluggishness of the Electron client, but couldn’t find any usable clients at all. There are some projects on Github, none of which seemed to be in a usable state. Perhaps I have been missing something.

This is being blown a bit out of proportion though. All they are saying is the official SDK may have some non-free components going forward. So what? It’s a private company, they can do what they want. Or the community can just fork it and move forward with a free one if they want, but it’s just not going to be in the official BitWarden clients. Hardly news or a big deal.

Nobody said that they can’t do that (although people rightfully questioned that their changes are indeed comatible with the GPLv3). I very much disagree that this isn’t a big deal, though.

How do you store a driver’s license in Bitwarden? Last time I checked they didn’t support file storage. Do you just put it in the cloud storage?

They do support file storage. I’ve been using that for years for storing small files related to certain accounts an such.

I would advice against using SSDs for storage of media and such. Not only because of their higher price, but also because flash memory cells tend to fade over time, causing read speeds to decrease considerably over time. This is particularily the case for mostly read-only workloads. For each read operation the flash memory cell being read loses a bit of its charge. Eventually the margin for the controller to be able to read the data will be so small, that it takes the controller lots of read operations to figure out the correct data. In the worst case this can lead to the SSD controller being unable to read some data alltogether.

No, tmpfs is always located in virtual memory. Have a look at the kernel documentation for more information about tmpfs.

It is. It might end up on disk in swap, if you run low on memory (and have some sort of disk-based swap enabled), but usually it is located in RAM.

Try diasbling the second DHCP server altogether. You only need one, since you have a flat network.

Are you sure there is exactly one DHCP server running?

I’m exclusively running unprivileged LXC containers and haven’t had any issues regarding the firewall, neither with iptables nor nftables.

No, it is not like Docker. You can treat an LXC container pretty much like a VM in most instances, including firewall rules. To answer the question, you can use fail2ban just like you had done in your VM, meaning you can run it inside the LXC container, where fail2ban can change the firewall rules of that container as it sees fit.

You could give bubblewrap a try instead. It is quite similar to systemd-nspawn.

I understood that. My point was rather that in this particular case (a CPU bug that could be fixed via microcode, but AMD chose not to do so for certain CPUs), RISC-V wouldn’t have been of any advantage, because there would be nothing to fix in the first place. Sure, one could introduce microcode for RISC-V and people have argued in favor of doing so for this exact reason, but the architecture was intentionally designed to not require microcode.

As much as I like RISC-V, it is kind of ironic to suggest RISC-V ist the solution to this. At least as it stands, because of RISC-V’s simplicity, most if not all current RISC-V CPUs don’t even run microcode, so there is nothing to update/fix in case of a CPU bug. There’s even a very current example of this problem with that chinese RISC-V cpu that has this “GhostWrite” bug that allows every unpriviliged process to gain root access.

That’s good, I never liked the clunky .home.arpa domain.

What does it offer that nginx doesnt?

Automatic HTTPS, you don’t have to use certbot or something similar to get/renew certificates. Also, its configuration is really simple and straight forward.