@ptz - eviltoast

Admiral Patrick

I’m surprisingly level-headed for being a walking knot of anxiety.

Ask me anything.

Special skills include: Knowing all the “na na na nah nah nah na” parts of the Three’s Company theme.

I also develop Tesseract UI for Lemmy/Sublinks

Avatar by @SatyrSack@feddit.org

  • 814 Posts
  • 6.16K Comments
Joined 3 years ago
cake
Cake day: June 6th, 2023

help-circle



  • That would be cool. I didn’t dive too deep into it, but the server project for it seems like you can configure the menus any way you want since they’re just HTML. You’d probably have to do server-side rendering or otherwise put all the HA API logic in the backend, but that could work!

    I loooove that WeatherStar 4000 emulator and run a copy at home. It seems like it relies on Javascript so sadly may not play well with those old set top boxes. But if you get it working, please share.


















  • I’ve got bot detection setup in Nginx on my VPS which used to return 444 (Nginx for "close the connection and waste no more resources processing it), but I recently started piping that traffic to Nepenthes to return gibberish data for them to train on.

    I documented a rough guide in the comment here. Of relevance to you are the two .conf files at the bottom. In the deny-disallowed.conf, change the line for return 301 ... to return 444

    I also utilize firewall and fail2ban in the VPS to block bad actors, overly-aggressive scrapers, password brute forces, etc and the link between the VPS and my homelab equipment never sees that traffic.

    In the case of a DDoS, I’ve done the following:

    • Enable aggressive rate limits in Nginx (it may be slow for everyone but it’s still up)
    • Just stop either Wireguard or Nginx on the VPS until the storm blows over. (Crude but useful to avoid any bandwidth overages if you’re charged for inbound traffic).

    Granted, I’m not running anything mission-critical, just some services for friends and family, so I can deal with a little downtime.



  • I have never used it, so take this with a grain of salt, but last I read, with the free tier, you could not secure traffic between yourself and Cloudflare with your own certs which implies they can decrypt and read that traffic. What, if anything, they do with that capability I do not know. I just do not trust my hosted assets to be secured with certs/keys I do not control.

    There are other things CF can do (bot detection, DDoS protection, etc), but if you just want to avoid exposing your home IP, a cheap VPS running Nginx can work the same way as a CF tunnel. Setup Wireguard on the VPS and have your backend servers in Nginx connect to your home assets via that. If the VPS is the “server” side of the WG tunnel, you don’t have to open any local ports in your router at all. I’ve been doing that, originally with OpenVPN, since before CF tunnels were ever offered as a service.

    Edit: You don’t even need WG, really. If you setup a persistent SSH tunnel and forward / bind a port to your VPS, you can tunnel the traffic over that.