To add to this, you might check out some of the free Hugo themes here: https://themes.gohugo.io/tags/portfolio/

since I don’t want to pay for SSL certificates to setup https.

You don’t need to pay for SSL certs anymore, most of the time. You can get them for free from a bunch of different places now. I use Let’s Encrypt. The web server/reverse proxy I use, Caddy is able to automatically get a cert for you, install it, and keep it renewed. The only time you need to pay for a cert is if you are handling financial transactions.

Are there security issues I should address preemptively?

WordPress itself has a generally good reputation for security, though depending on how the current drama goes, that may change. WordPress security problems have almost always stemmed from plugins or poor password hygiene. Remove any plugins you are not actively using, keep the ones you are using updated, and use a good password that you don’t use anywhere else. A password wallet like Bit Warden can generate and store such passwords for you.

Better on the security front would be to evaluate whether you actually need something like WordPress at all. A static site would likely be far more secure. There’s less moving parts that might be vulnerable.

While you could program a static site yourself, it’s more common nowadays to use a static site generator like Hugo to build the site. You set it up once for how you want the site to look and then you write your posts in markdown or whatever your particular generator uses.

I don’t have anything to manage my dynamic IP

Most domain name providers have some sort of setup for dealing with dynamic IP addresses, a program called ddclient is pretty common and is available in most repos.

If I reading your docker ps result correctly, you seem to be forwarding docker port 2283 to host port 3001.

Try http://ip_address:3001 , if that fails try https.

Currently I use Jellyfin and found it simple enough to setup. My personal setup is https on the public internet using Caddy as a reverse proxy to handle the https part, but you can set it up for local network access only using http.

Jellyfin itself is not the greatest music player ever, (UI is more setup for movies and tv) but there are music-centric apps that use it as a backend that are really good, for most platforms. On my phone and tablet, I really like Finamp, and on the desktop I use Sonixd.

I’m also considering just getting a portable, 128GB FLAC player with a minijack connection and moving on with my life without getting involved in networking at all.

I used this setup for the better part of 20 years. Nothing wrong with it, my music collection simply expanded to the point where it simply wasn’t feasible to store all of it on my iPod anymore and from day to day I never really know what I’m going to be in the mood to listen to. Setting up a streaming service made more sense for me.

Tobacco. You?

https://auth0.com/blog/defending-against-password-cracking-understanding-the-math/

The simplest way to do this, is to put the server on a private vpn (I use Tailscale, there are others) and expose ports only to the vpn. Then you share access to the vpn with your friends.

With Tailscale, this is as simple as sending them a share link for the host. They will need to have an account at Tailscale, and have the client running, but they will then be able to access the host with a static ip address.

As a general rule of thumb, nothing should be exposed to the public internet unless you want that service to be public access and then you need to keep it up to date. If a vulnerability doesn’t currently exist for the service, one will sooner rather than later. SSH, especially password only ssh, can be broken into fairly easily. If you must expose ssh to the public internet for whatever reason, you need to be using IP white lists, password protected keys, change the default port, and turn off service advertisements and ping responses. I’m probably missing something. When someone scans your server randomly, they should see nothing. And if they fail login they should be ip blocked.

1. Host family media through Jellyfin, etc. This would include tv, music, and possibly books as well. Many of these will be managed through the Arr apps.
2. Degoogle my phone - I’m beginning by replacing Photos with Immich, but hope to also use Home Assistant, backup other phone data such as messages media, shopping lists, etc. I hope to replace Google storage/backup with Proton Drive.

Seems like a solid plan. I used Nextcloud as a Google Drive/Photos/Calander/Lists replacement, but depending on what you are running as your server it may be a bit too heavy.

I’ve heard that once you get into it, Linux distros like Ubuntu are not very user friendly for self-hosting as a beginner.

Not sure who is saying this. Granted, if your not used to *nix, our ways of doing things can be a bit obtuse from time to time but the Ubuntu based distros are some of the most heavily documented distros available with only Arch being better documented (Don’t use Arch unless you’ve got stock in Bayer. /joking, kinda).

Your current OS choice is maybe not what I would choose, but it is fine. Xubuntu just Ubuntu Server with the XFCE desktop installed. A bit heavy for a server install as a result. One thing I will say is that most server software is setup via the command line and setup via configuration files (These are just regular text files readable by any text editor. I like micro, but anything will work). The desktop environment is just extra weight you don’t really need in this application. Doesn’t hurt anything, just heavy and not really needed.

So is it better on the whole for a beginner to have a popular distro with lots if documentation and step by step guides, or to have a purpose-built OS like TrueNAS that might be more straightforward, but with less support?

Stick with what you have. Ubuntu is a very well supported server distro, and the XFCE desktop doesn’t change that. Things like TrueNAS, UnRAID, and whatever is the flavor of the week tend to cover things up to simplify things. This is fine when they work correctly, the problem comes when things inevitably break. You won’t know where to go looking to fix things. Also TrueNAS is a network storage OS, not really suited for what you are trying to do currently, which seems to be hosting services.

It seems to be working well, but I’ve had a few hiccups trying to update it,

What hiccups were you running into? And were you using the GUI tool or apt on the command line?

I don’t know about Silverblue, but I know you can use NixOS on pretty much any VPS using the tool nixos-infect.

Not sure how it would reduce your attack surface though. That’s not really the problem that they are trying to solve.

I’ve heard mixed things about them, never used them though. Personally I used Digital Ocean for my VPS needs till I had a spare computer available, at which point I moved everything in house.

With used hardware, it very much depends on what the hardware is and what you’re using it for. if you can find something from the last 10 years it’s probably worth it, but I wouldn’t get anything older than that. Power usage is the main concern, as systems have been plenty powerful enough for most applications for sometime. Hardware reliability would be another factor.

When I was looking a couple of months ago, it looked like $200 USD was the sweet spot for used hardware, but at that price point, you could get one of those NUC knockoffs brand new, such as the Beelink N100. It just depends on what you need.

I use AIO as well though I’ve heard the snap version is pretty painless, most of the time.

Personal preference.

Unless something has changed, Caddy isn’t a dns server. It’s a web server and reverse proxy. If you might expose something to the public internet, you will want it behind the reverse proxy.

If you want to access local network services (private vpn counts) via a domain name all you need is a DNS server and for you clients setup to query that dns server. I use PiHole for this. From what I understand Adguard may be similar to PiHole but I’ve never looked a it.

One thing to be wary of, there are no reserved private network domains. Depending on how you set things up your local network dns queries may go out onto the public internet. It’s best to go ahead and register a domain name that you want to use so that you can control it routing if that happens. They can be had cheap as $11 USD each.

I’m running it. It’s good. Tracks fuel mileage, PMs and repairs and can remind you of things either by time or mileage.

Me too! Not much to look at but it’s a great player on iOS. On Linux, I like SonixD.

I use Jellyfin. I think in your use case, each user would be setup have their own library. You can enable or disable library on a per user basis as will as a per client basis.

Downside is that the default web interface isn’t great as a music player. It does the job but it’s not great.
Other hand, multiple music-first clients exist for a lot of different platforms. Odds are good you can find a client that suits how you listen to music.

Edit: said collection when I meant library.

It’s doable. Stick to the 7b models and it should work for the most part, but don’t expect anything remotely approaching what might be called reasonable performance. It’s going to be slow. But it can work.

To get a somewhat usable experience you kinda need an Nvidia graphics card or an AI accelerator.

@tal has already given a really good answer. To add to it, this thread might help you some: https://lemmy.sdf.org/comment/11963996 I was asked what I thought was “better” than a raspberry pi. Came back with an eBay search and a trio of suggestions in the price range of a Pi 4. TLDR is whatever you have currently will probably work fine but if you need to buy hardware, there are plenty of low cost options. And of course, Pi’s also work fine for anything they are capable of, which is most things.

When I started self hosting, Raspberry Pi’s were the cheapest option available. I learned fairly quickly that the SD card was the weakest part of them but not long after the Pi3 came out we were able to boot off of USB drives which solved that issue. I think I had 8 SSDs hanging off of one pi before I finally decided to plop down the money for a tower. I then added a pair of 6 port SATA cards and added even more storage to that system. Eventually I was hosting so many things that I was running out of RAM, So I bought a second used tower, this one with a much newer processor and a lot more RAM. Now I run both with the old system running as a NAS and the new system hosting my other services. I wouldn’t stress about hardware too much. Hardware can grow with you, to a point.

Mini PCs are too small to house internal drives

Most mini PCs I’ve heard of (and quite a few thin clients) use m.2 drives for internal storage. Not difficult to upgrade. I’ve also heard of a few that had ports and internal space for 2.5 inch SSDs.

I don’t know of ANY reason to go with spinning-platters, nowadays.

Price per terabyte is lower on HDDs. For bulk storage they are currently the best path. SSDs are catching up though, and there are cases where a SSD based NAS does make sense. But most folks at home don’t have the network capability to fully utilize their speed. Network becomes the bottleneck.

Given how old the system is, I’m not sure how long it would survive that type of duty. Power up and downs are a lot rougher on components than if they just stay running.

• https://www.intel.com/content/www/us/en/products/sku/27512/intel-pentium-d-processor-820-2m-cache-2-80-ghz-800-mhz-fsb/specifications.html
• https://browser.geekbench.com/processors/intel-pentium-d-820-915-920
• https://www.cpu-world.com/benchmarks/Intel/Pentium_D_820.html
• https://en.wikipedia.org/wiki/Pentium_D
• https://pcper.com/2005/06/intel-pentium-d-820-2-8-ghz-dual-core-review/16/

If you switch the HDD for a pair of SDD (one storage, one swap), it would be somewhat useable. Better to increase the amount of RAM if possible. If I remember correctly, 2-4 GB of RAM was not uncommon at this time period. Although NixOS or a really light Debian install might be able to stay within that amount of RAM. So yea, I think it’s feasible.

Good Idea? Perhaps not so much. That proc has a TDP of 95W. Haven’t found anything on it’s idle power draw, but I’d guess that that system would have a fairly heavy power draw. The slow speed of the processor and low amount of RAM would probably limit the amount of traffic you could put through it. Additionally, the age of the components would probably cause reliability issues.

Generally I like to tell folks to use what they have. Repurposing old hardware is better for the environment and usually the wallet, but this system would probably would not be my first, second or even third choice for any workload. I haven’t found a benchmark comparing the two, but I think a Pi3 would probably run dead even with this system at a far lower power draw. Although the Pi3’s ethernet does run on it’s USB bus (I think), along with it’s storage, so that would slow it down for this workload. If you wanted to run traffic faster, I would probably look into the used micro PC market at the $75-$150 USD price point. This system is old enough to vote. Something merely 10 years old would be considerably faster.