Skip Navigation

InitialsDiceBearhttps://github.com/dicebear/dicebearhttps://creativecommons.org/publicdomain/zero/1.0/„Initials” (https://github.com/dicebear/dicebear) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)S

stratself

@ stratself @lemdro.id

Posts
4
Comments
88
Joined
7 mo. ago

  • Technitium DNS v14 is released with support for clustering

    Jump

  • Off the top of my head:

    • Allows using DoH/DoT/DoQUIC/recursive upstreams without installing extra packages (unbound, cloudflared, etc)
    • Allows acting as a DoH/DoH3/DoT/DoQUIC server alongside normal DNS over UDP and TCP
    • Allows configuring SOCKS/HTTP proxies for forwarders
    • Act as authoritative zone server with DNSSEC signing
    • Allows custom responses via plugins (e.g. conditional responses based on client's IP addresses)
    • Accept PROXY Protocol to forward client IPs from trusted load balancers
    • All the clustering and zone transfers magic
    • DNS64

    It really dives deep into the inner workings of DNS and does pretty much anything Pi-Hole does, with many more security and QoL features. Although the UI may feel a bit dated, I'd recommend it to anyone running their own homelab infrastructure beyond just adblocking

  • Made an alternative to Tailscale + Gluetun

    Jump

  • Material for MkDocs is getting rid of MkDocs. Now: Zensical - A modern static site generator

    Jump

  • Thanks for posting this here. I'm not sure what to think about this, just set up mkdocs-material with huge customizations, including the macros plugin and tons of CSS. So it'd be tedious to eventually migrate to the new "component system" as they say.

    Welp, should've gone with a barebone SSG and configured what I want. Feels like I'm kinda stuck in no man's land now.

  • Migration from Conduwuit to Continuwuity

    Jump

  • Hey, I'm glad you got it working, yeah Continuwuity is still a drop-in replacement right now so all is good. I also did a drop-in a few months back with zero hassle at all. Most env vars and config options weren't changed, but I redid my continuwuity.toml file just to be sure.

    I'd recommend joining the announcement room to keep track of updates, and the community room for support too

  • Self-Host Weekly (31 October 2025)

    Jump

  • I find it odd that a report for the proprietary Github platform takes the newsletter's spotlight, it's not very relevant. I'd much prefer if the writer could expand his thoughts on those new version releases or featured blogposts, especially the ones he finds interested in.

  • Is (Matrix) Element Server Suite overkill for a dozen users?

    Jump

  • If it ain't broke, don't fix it. I think it's better hooking up Element Call to your current setup, and remove Element Web if you can BYO client.

    For a more lightweight alternative, I personally find continuwuity to be reasonably stable for the specs you mentioned. It does admin tasks in an #admins room, use an embedded database, and has no client UI so less containers needed. So continuwuity + EC should be able to run under the constraints you mentioned

    The lightest would still be any XMPP server, though its functionality does differ from Matrix overall

  • How often do you update software on your servers?

    Jump

  • To make it even simpler, apk -U upgrade

  • Assign privileged port to caddy running with rootless podman

    Jump

  • Hi,

    The client IP problem is a longstanding issue in podman's virtual bridge networks.

    As a workaround I'd run HAProxy rootless, using the pasta networking mode as that one allows seeing native client IP. With pasta's -T flag (see docs) I'd forward traffic to another caddy container binding to 127.0.0.1:8080 or something similar.

    This would coincide with your firewalld/HAProxy port-forwarding setup, but it has more rootlessness to it. It's still not perfect and you'd still need to tweak sysctls, but I hope it may be useful

  • Setting up VoIP on my matrix server

    Jump

  • Beyond Pi-Hole

    Jump

  • You should add your DNS forwarder as its own node in Tailscale, and configure the tailnet to resolve DNS through it. That way you'll be able to resolve both MagicDNS node names and your local domains, as well as being blocklist-enabled. Besides, I think you can also define custom A/AAAA records on your Tailscale console, skipping local records on Pi-hole altogether.

    I'd also recommend Technitium for a new DNS solution, mainly because they're going to add support for clustering soon. This could be highly useful if you want to configure blocklists once and sync them between different Technitium nodes. Should it works out, I'm thinking of installing it alongside every Tailscale exit node, for the benefit of synced blocklists, local domains, and exit-node geolocated IPs for external domains.

  • Deleted Locked

    Jellyseerr and Overseerr merging into one, gonna be called Seerr

    Jump

  • Missed the chance to call it Jelloseerr

    It's Jellover now

  • Using rsync for backups, because it's not shiny and new

    Jump

  • Rsync depends on OpenSSH, but it definitely isn't SFTP. I've tried using it against an SFTPGo instance, and lost some files because it runs its own binary, bypassing SFTPGo's permission checks. Instead, I've opted for rclone with the SFTP backend, which does everything rsync do and is very well compliant.

    In fact, while SFTPGo's main developer published a fix for this bug, he also expressed intention to drop support for the command entirely. I think I'm just commenting to give a heads up for any passerby.

  • Reducing buffering when accessing Jellyfin via Tailscale

    Jump

  • Hi, I think OP wants their sibilings to directly connect to their PC, skipping any relays, even if it's their VPS.

    But if you are comparing setting up your own VPS instead of relaying through Tailscale's DERP, then the answer is... it depends on the distance and whether you can establish VPS->Local VM direct connections.

    I found opening a specified port for Tailscale on the VPS to help with direct connections with CGNAT'd peers. I'm not familiar with Pangolin, but I think the same principle applies as long as at least one address:port combination is agreed between Wireguard peers.

    If I'm being honest though, before doing all this, try asking your ISPs for IPv6 to avoid these cumbersome things together.

  • Reducing buffering when accessing Jellyfin via Tailscale

    Jump

  • If both your Jellyfin server and your siblings are behind residential CGNAT, then high chance your connections are relayed through Tailscale's DERP servers. You can check with tailscale ping-ing your sibilings' nodes.

    If this is the case, you may consider selfhosting your own DERP somewhere close to you, but I'd argue the performance gains are minimal compared to the extra costs. Another solution would be to enable IPv6 for both you and your siblings, skipping NAT traversal. I just hope both ISPs support it and support it properly in $CURRENT_YEAR.

    This is all assuming you can direct play (i.e. not transcoding) your media. If you're transcoding, then it's good to look into hardware acceleration like the other comment mentioned, too

  • Tailscale difficulties

    Jump

  • try adding the sysctls parameters to your docker container too

  • Share single service via WireGuard

    Jump

  • Is there a way for a Wireguard peer to advertise AllowedIPs similar to Tailscale's subnet routings? If that's right, perhaps you can configure your host's address as one of the AllowedIPs on the OpenWRT peer, and skip port forwarding too

  • Removed

    Need some help with networking - tailscale, gluetun etc

    Jump

  • Two separate functions should go into two separate nodes

    1. Run Tailscale binary on host. Connect to Jellyfin server using that node's IP address.

    and

    1. Run Gluetun + another Tailscale instance in containers. Don't use host networking, use bridge or something else. Connect to that node as an exit node

    As an (advanced) alternative to Gluetun + Tailscale I propose tswg (my project)

  • Removed

    How to make a Tailscale-like mesh VPN work without the internet?

    Jump

  • I've vaguely thought about this with Split DNS.

    My concern would be the need to set up some non-Tailnet mechanism to expose it to the internet and keep it secure. Either port forwarding, Pangolin, or even using Funnel... all of which would be better off on a separate device (and maybe a separate VLAN)

    It'd be an interesting idea for sure, perhaps for when I can get myself the separate Headscale-dedicated device. Although now I'd have to learn the "normal" zone-based networking ahah

  • Removed

    How to make a Tailscale-like mesh VPN work without the internet?

    Jump

  • That's a nice thing with Wireguard yea. I'll keep this in mind if ever I can grok Tailscale to do such things