It’s not an either-or scenario. Running services in Docker/Podman is great and makes a lot of sense, as you’ve found. But there’s no reason the OS running those Docker containers can’t be a VM on a hypervisor like Proxmox. Then you get the simplicity of Docker, in addition to the isolation and segmentation (network and process) provided by VMs, and snapshot-based incremental backups from PBS. It’s the best of both worlds. You wouldn’t have a VM per service like you ran before, instead you’d have a VM per group of related services with common networking and security requirements. For example, all of your publicly exposed services can run in Docker in their own isolated VM that’s walled off from the rest of your network, while your internal-only services also run in Docker, but on a separate VM on your internal network.

In general, you take the model size in billions of parameters (eg: 397B), divide it by 2 and add a bit for overhead, and that’s how much RAM/VRAM it takes to run it at a “normal” quantization level. For Qwen3.5-397B, that’s about 220 GB. Ideally that would be all VRAM for speed, but you can offload some or all of that to normal RAM on the CPU, you’ll just take a speed hit.

So for something like Qwen3.5-397B, it takes a pretty serious system, especially if you’re trying to do it all in VRAM.

Who cares if it’s exposed to the internet?

1. Encrypting your local traffic is still valuable to protect your systems from any bad actors on your local network (neighbor kid cracks your wifi password, some device on your network decides to start snooping on your local traffic, etc)

2. Many services require HTTPS with a valid cert to function correctly, eg: Bitwarden. Having a real cert for a real domain is much simpler and easier to maintain than setting up your own CA

Why are you having to update your DNS records when you add a new service? Just set up a wildcard A record to send *.myserver.com to the reverse proxy and you never have to touch it again. If your DNS doesn’t let you set wildcard A records, then switch to a better DNS.

I didn’t use to, but I do now. Debian on everything (except the Proxmox servers, but Proxmox is basically Debian too)

I guess it depends on the containers that are being run. I have 175 containers on my systems, and between them I get somewhere around 20 updates a day. It’s simply not possible for me to read through all of those release notes and fully understand the implications of every update before implementing them.

So instead I’ve streamlined my update process to the point that any container with an available update gets a button on an OliveTin page, and clicking that button pulls the update and restarts the container. With that in place I don’t need fully autonomous updates, I can still kick them off manually without much effort, which lets me avoid updating certain “problematic” containers until after I’ve read the release notes while still blindly updating the rest of them. Versions all get logged as well, so if something does go wrong with an update (which does happen from time to time, though it’s fairly rare) I can easily roll back to the previous image and then wait for a fix before updating again.

Unfortunately that approach is simply not feasible unless you have very few containers or you make it your full time job.

self-signed won’t get rid of any warnings, it will just replace “warning this site is insecure” with “warning this site uses a certificate that can’t be validated”, no real improvement. What you need is a cert signed by an actual certificate authority. Two routes for that:

1. Create your own CA. This is free, but a PITA since it means you have to add this CA to every single device you want to be able to access your services. Phones, laptops, desktops, etc.

2. Buy a real domain, and then use it to generate real certs. You have to pay for this option ($10-20/year, so not a lot), but it gets you proper certs that will work on any device. Then you need to set up a reverse proxy (nginx proxy manager was mentioned in another post, that will work), configure it to generate a wildcard cert for your domain using DNS-01 challenge, and then apply that cert to all of your subdomains. Here’s a pretty decent video that walks you through the process: https://m.youtube.com/watch?v=TBGOJA27m_0

Just use client-side encryption, then it doesn’t matter where it goes

the network appliance is now discontinued and self-hosting the network appliance can no longer happen software-only, you have to use their “server os”, which can’t be run in a container.

Of course it can, they just don’t provide a pre-containerized version but other people do. The server software just a regular program that you can install on any Linux OS. I use the linuxserver Docker version, it’s regularly updated and works without issue. It uses about 1.2 GB of RAM, so a little heavy, but nothing crazy.

https://community.ui.com/releases/UniFi-Network-Application-10-0-162/2efd581a-3a55-4c36-80bf-1267dbfc2aee

https://docs.linuxserver.io/images/docker-unifi-network-application/

You can back up ~/.ssh though, and restore it on any system.

BentoPDF is for editing PDFs, Paperless is for organizing PDFs. Think GIMP vs Immich.

Do not split a RAID array across drives in separate USB enclosures.

Doing RAID on USB drives is alright, as long as they’re all in the same enclosure and use a single USB interface. If you split an array between drives with separate USB interfaces, you will face corruption and rebuild issues when one of the controllers has a hiccup or comes up slower/faster than the other, which WILL happen. If you need to run a RAID array on USB-connected drives, use a 2-bay USB-connected DAS. I’ve used the QNAP TR-002 in the past, it works fine, just set it to individual mode.

The better option since we’re just talking about a mirror, is to run on one drive primarily, and occasionally sync your data to the other for a backup.

4-bay DAS with a handful of big HDDs in RAIDZ1. Load it up, then store it in your office at work or at a friend or family member’s house. Retrieve, update, and scrub somewhere between once every few weeks to once every few months, depending on how often your critical data is changing.

Thanks! BentoPDF is fantastic, I never knew something like this existed.

I have a todo list where I keep track of services I might be interested in one day, I read your post a few hours ago and added Bento to my list, thinking I might get around to it in a few days/weeks/months. Then out of nowhere 15 minutes ago I randomly needed to crop and split a PDF and realized I didn’t have anything to do it. I fired Bento up and was done in under a minute.

dealing with incoming spam is just way more work than paying to have it hosted.

The right way to deal with spam is not to use filters in the first place. It’s not like Gmail or Proton or <insert your favorite email provider here>'s spam filters are perfect either, far from it, they still let a ton of shit through. The right way to deal with spam is to use unique aliases for each account that you can shut down if they leak.

In my opinion, Proxmox is worth it for two reasons:

1. Easy high-availability setup and control

2. Proxmox Backup Server

Those two are what drove me to switch from KVM, and I don’t regret it at all. PBS truly is a fantastic piece of software.

Every couple of days. I don’t auto-update, but I’ve streamlined the process to the point that I can just open a single web page and see the number of pending updates for every system on my network, docker containers included, each one with a button. Clicking the button applies the update and reboots if necessary. So it takes about 15 seconds of effort to update everything, which is why I don’t mind doing it so often.

I am more surprised by how popular Proxmox seems to be here, which is really just adding a lot of unnecessary complexity

I switched to Proxmox for one reason: PBS. As far as I know there is no match with plain KVM. Proxmox also makes setting up and maintaining a high-availability setup very easy, which is a nice bonus.

I used to use 2FAS, but recently switched to a self-hosted instance of Ente