If you just want to stop it from having internet access then a firewall rule set to block from the printer IP, and dest !=LAN would do it.

For IP changes you just need to make that lease static in OpenWRT and it will be fixed to that IP going forward.

Isn’t that generally what external auth providers are designed for?

I imagine it isn’t much of a concern if Immich isn’t exposed to the internet.

I think they’re neat, and can make it easy to get started.

However, when something breaks it can be really difficult to fix, as you have no idea how things are set up under the hood. Often if an app isn’t in the ‘store’ it can be much more difficult to run it as well.

So upsides and downsides, easier to get started, harder to maintain imo.

It’ll stay connected to both laptop and desktop at the same time without issues? Does it auto-reconnect quickly when coming back onto your wifi from mobile data too?

Maybe I need to give it another try…

I use it for sending files between devices occasionally. KDE connect has never been reliable when switching between PCs, it will only stay connected to 1 at a time and I have to often manually connect it to the others which is annoying to do.

Its file browser/send feature also feels a bit half-baked and takes more clicks than it should IMO.

I probably wouldn’t expose it, while I don’t think it’s been a problem in the past, with LLMs being used to find vulnerabilities so much in the past few months it seems prudent to do everything you can reasonably do to secure things.

Tailscale is so easy to use it seems worth the bit of extra hassle.

Yeah if you read my other reply I meant it as it often just fails silently with wine, I’ll open an exe, it’ll do something in the background, and then nothing happens. No errors, no explanation of what went wrong…

It’s more that wine tries but often fails silently for some reason, hopefully this is more user friendly and will actually just tell me “you need .net framework click here to install” and that sort of thing.

This sounds like I can just double click an exe like I do on windows and it’ll work. That never seems to work with wine so it’ll be nice to have something function properly.

It’s pretty good, generally don’t find anything I can’t do on it.

The only annoyance is performance really, it can get some odd lag at times.

I’m re-thinking a few things, mostly moving exposed services onto a VM or two that are on their own VLAN, and don’t contain any important data (it would be my website, gameservers like Minecraft, etc…). I might move to podman as well so nothing has a possibility of running as root, docker can run rootless but that setup seems more confusing to me.

I already use a VPN via Wireguard on my router for access to my private services when out of the house, so my changes are just separating the public from the private as much as possible on the server side of things…

Essentially if someone manages to drop a crypto miner or something on my website that’s fine, I’ll get an alert pretty quickly through Beszel that the server load is high and I can go roll back a backup or whatever. I just want to make sure there’s no access to anything else for them.

I generally stick with the main TLDs. Like com or net.

.com is fairly cheap and won’t be on any blocklists, where some other TLDs can be.

But if you’re in the EU then .eu probably makes sense to use.

There have been a few major ones this year, I’m sure they are fixed at this point though. https://app.opencve.io/cve/?vendor=jellyfin

Plex uses a code signin system where you open the app on your phone or just a browser, and enter the code there.

So there’s no typing/entering anything on the TV at all.

Jellyfin has plenty of issues with public instances too. It’s just the reality of exposing to the public internet, unless it’s something that has a lot of dedicated work going into security it’s going to have problems.

If it breaks I either fix it (often it’s just an issue where the new version needs extra config added), or roll back to a backup and pin the old version temporarily if it really went wrong and I can’t recover otherwise.

Backups run early AM before any auto updates start, and no one is using services and changing data then, so nothing should really ever be lost by rolling back.

It’s easier to setup and use for less technical people, also just more widely known.

I run Jellyfin but logging in is definitely a pain, have to manually enter the URL (including https:// for some crazy reason, why doesn’t it just default to it??) and username and password using a crappy TV remote.

Wildcard SSL does help a lot, since every subdomain isn’t broadcast publicly in the issuer logs.

That’s fair, shutdown service + backup everything is certainly more guaranteed to work properly.

With Immich I’m not too worried about the DB potentially being off since it can rescan the filesystem, but I also backup at 3am when nothing is happening on Immich because I’m asleep!

If you have someone far enough away, with fast/reliable internet, and a safe spot to put it.