InEnduringGrowStrong@sh.itjust.works

For anything important, use matrix instead of lemmy DMs.

  • 0 Posts
  • 23 Comments
Joined 1 year ago
Cake day: June 22nd, 2023
  • InEnduringGrowStrong@sh.itjust.works@sh.itjust.workstoSelfhosted@lemmy.world•Self hosted Nextcloud IPv6 local and external - I lack some understandingEnglish
    3·
    7 hours ago

    Some subjects you might wanna look into.

    1. NAT hairpin, also called NAT loopback If you’re sending packets to your ISP’s public IP from inside your LAN and it fails, your ISP modem (or whichever device does the NAT, probably doesn’t support NAT hairpin.

    2. Split-horizon DNS That’s when you configure your own DNS for your hosted services, but with a different config on your LAN (which would point towards your services LAN IP) and another config with your public DNS provider (which would point to your public IP)

    3. Carrier NAT This could break your chances of having a reachable service as they likely won’t make a port forwarding rule for you in their stuff.

    4. IPv6 address types Link-local addresses are within fe80::/10 (kinda similar to how 169.254.0.0/24 is used in ipv4). This IP wouldn’t be reachable from the outside.
      Global unicast addresses are all in 2000::/3, this would be reachable from the outside.

    5.IPv6 DNS Make sure to configure both A (ipv4) and AAAA (ipv6) records with the right info. Although if your LAN devices only have ipv4 addresses and you’re doing Split-horizon, you could theoretically omit the AAAA on your LAN

    1. Phone DNS shenanigans.
      Some recent phones ignore the DNS they receive through DHCP and instead use something like Google’s which breaks split-horizon and can confuse troubleshooting. This wasn’t in the SSID settings, but in a global “private DNS” setting.

    As for your problems, it depends.
    There might be a way to make this work without the VPS, but I don’t have all the info.
    That said, a VPS or something like a cloudflare tunnel could come in handy. I usually prefer to host directly but still, that’s an option if port forwarding doesn’t work with your ISP.
    You’d configure the DNS for your services to the VPS IP and configure the VPS to reach your stuff.
    Using the VPS kinda also gets rid of NAT hairpin problems although it is inefficient to go through the VPS from the LAN with the downside of not working when your Internet is down.
    You can still use the VPS and Split-horizon DNS if you wanna have local availability from your LAN when your Internet is down.

    Good luck

  • InEnduringGrowStrong@sh.itjust.works@sh.itjust.workstoProgrammer Humor@lemmy.ml•Those who know
    0·
    3 months ago

    I hear ya.
    I get 1-6 meetings in the same time slot, people don’t care to check so I don’t care to show.
    I decide which meetings are important for actually moving stuff forward and screw the rest.

    There’s only ever one guy who complained to my boss…
    I didn’t show up for a meeting for a Friday 7pm, invite sent at like 4:58pm the same day for some inane and absolutely not urgent subject.
    I saw that invite come in, chuckled, closed my laptop, went home and ignored it.

    Later that night, the guy went nuts and CC’d everyone’s bosses because he had wasted the full hour and obviously no one showed up to his meeting “even though I made sure to check everyone’s calendar and everyone was available and you’re all unprofessional”.

    I don’t do emails notifications on phones as a rule unless you wanna pay my rate 24/7, but I had forgotten to do my time sheet so I was logged in doing that…

    I dabble in a bit of passive aggressiveness in the face of corporate bullshit, so I finished my timesheet and hit propose new time… Sunday 3:21 am…
    “Checked your calendar and it was available. Sorry for the inconvenience.”
    Closed my laptop and fucked off.

    The guy went nuclear over several emails.
    Sent a quick email to my boss “Just a heads-up, I think I angered someone by not attending their 7pm meeting they sent at 4:58pm and proposing an equally ridiculous time”

    Never heard from the guy again and the next week he wasn’t in the company AD anymore.

    Probably went full tilt cookie monster in the coke jar or something.

  • InEnduringGrowStrong@sh.itjust.works@sh.itjust.workstoSelfhosted@lemmy.world•Do you run a private CA? Could you tell me about your certificate setup if you do?English
    2·
    1 year ago

    I run a private CA for client SSL.
    For traditional server SSL I just use let’s encrypt, although I already have the domain (less than $10 a year) for my public facing stuff, and just use a subdomain of that one for my homelab.

    I have a container with openssl for the private CA and generating user certs as well as renewing the let’s encrypt ones. I just use openssl without anything fancy.
    The output folder is only mounted rw in that one container
    I only ever mount the subfolders in read-only in other containers that need those certs.
    All these containers are running on the same server so I don’t even have to copy anything around, the containers don’t even need connectivity between them, it’s just mounted where needed.

  • InEnduringGrowStrong@sh.itjust.works@sh.itjust.workstoSelfhosted@lemmy.world•OwnCloud and NGinx = untrusted domain = sadfaceEnglish
    4·
    1 year ago

    in nginx:

    server {
...
location / {
    ...
    proxy_pass https://redacted.......;
    proxy_pass_request_headers on;
    proxy_pass_header   Set-Cookie;
    proxy_set_header HOST $host;
    proxy_set_header Referer $http_referer;
    proxy_set_header X-Forwarded-Proto $scheme;

    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-Host $server_name;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
...
  }
}

    I think the was a trusted proxy setting in owncloud itself that needed to be set too, or maybe I’m thinking of another service.