@tatterdemalion@programming.dev

comments

• Secrets

  • Encrypted secrets file. All repo-managed credentials live in secrets/secrets.yaml, encrypted with SOPS/age.
  • Encrypted OpenTofu state. State and plans are encrypted client-side (PBKDF2 + AES-GCM) with a passphrase from TF_VAR_state_passphrase.

  Network perimeter

  • Default-drop firewall on the router. I use a hand-written nftables ruleset with policy drop on both input and forward. Only lo, lan0 and wg0 are trusted. WAN accepts only established traffic, WireGuard UDP and HTTP/HTTPS.
  • No SSH from the WAN. sshd on the router is not exposed to the internet at all.
  • WireGuard for remote access.
  • Forced DNS. NAT redirects all LAN and VPN port-53 traffic to the router’s AdGuard. AdGuard uses Quad9 over DoT upstream, with blocklists and safe search.
  • Second-level ACL in nginx. Private .home vhosts and Grafana carry allow LAN; allow VPN; deny all;.
  • TLS everywhere. Every public vhost sets forceSSL with recommendedTlsSettings. Certificates come from ACME DNS-01, so issuance needs no inbound port 80. Cloudflare is DNS-only with no proxy, so no third party sees plaintext.

  Host access

  • SSH hardening. Password and keyboard-interactive auth are off, PermitRootLogin = “no”, and logins are key-only.
  • Dedicated deployer system user. It uses a CI-only keypair, separate from the interactive keys. Everything it does through sudo is logged with LOG_INPUT/LOG_OUTPUT to /var/log/sudo-deployer.log.
  on How "secure" is your setup? in c/selfhosted@lemmy.world · 4d ago

• Thanks for sharing. I’m trying it out as a Google Keep replacement.

  on [AIP] NoteTrace v1.0.0 released: First Stable Release, Wear OS App, Offline Everywhere in c/selfhosted@lemmy.world · 4d ago

• Probably best we just let them think they got one over on us.

  on Republican bill would order ISPs, DNS providers, and VPNs to block piracy sites in c/technology@lemmy.world · 5d ago

• New shortest path meta dropped

  arxiv.org/pdf/2504.17033

  on reason enough to fail the interview in c/programmer_humor@programming.dev · 30 Aug 2026

• What about nftables?

  on I can definitely maybe do this! in c/programmer_humor@programming.dev · 27 Aug 2026

• Kent Overstreet

  on He's clear. in c/linuxmemes@lemmy.world · 25 Aug 2026

• There are still various incompatibilities between the two, and it becomes relevant if you need to work with any organization that has standardized on Docker-specific tooling.

  on Every time I use podman in c/linuxmemes@lemmy.world · 25 Aug 2026

• What exactly is your problem with Docker? It’s open source.

  Also closed-source container images exist.

  on Every time I use podman in c/linuxmemes@lemmy.world · 25 Aug 2026

• Why would you want your entire home folder in syncthing?

  on YOLO in c/linuxmemes@lemmy.world · 22 Aug 2026

• I’m not sure I need a lot of compute on my NAS. I guess I might as well get as much as I can before it becomes cost prohibitive. Not planning on running any local LLMs on it though, so a GPU is probably overkill.

  on My home server was a totally justified purchase in c/programmer_humor@programming.dev · 20 Aug 2026

• I’ve been thinking about getting a real NAS machine instead of having my gaming PC always on. This looks pretty slick.

  on My home server was a totally justified purchase in c/programmer_humor@programming.dev · 20 Aug 2026

• Archdioces Linux

  on Divine tech support in c/programmer_humor@programming.dev · 20 Aug 2026