Of course harassment is never okay, but I'd say when it comes to GNOME, this is not surprising. GNOME developers have been so hostile towards both users and other developers for a long time. I'm not saying every single person associated with the project does this, but it is pretty common (e.g. here and here ). Of course the GNOME devs don't have to accomodate everyone, but it is a common theme with the project to remove features despite user backlash and also to close bugs as WONTFIX often without good explanations as to why, even when there are pull requests for fixing the problem.

I am simply avoiding the project, since there are enough good alternatives.

This explains it, although it is not really Git's fault as that article suggests, but rather the charset conversions to UTF-8 that broke things. With all that fixed it builds fine. I've been using DOSBOX and since all the required build tools are included in the repo, it is easy to build.

Did anyone manage to build this? It seems something is missing, or I am doing something wrong. The build fails due to missing symbols for me. Also, interestingly the assembler complained about one line in a certain file being too long. Fortunately that lines was just a comment, so it was easy to fix that.

Since none of these require a Raspberry Pi to run, I would suggest using a mini PC (with an Intel N100 or similar) instead of a Pi 5. With all the accessories needed for the Pi, a mini PC can actually be cheaper and of course a lot more powerful. Since the Pi 5 is very power-inefficient, a mini PC can even be better in that regard too if that matters to you.

Especially for Jellyfin a PC with an Intel CPU with integrated GPU is awesome, since Jellyfin supports hardware transcoding with that.

I am not sure where this idea comes from, but putting a service behind a reverse-proxy does not increase its security in any way, unless you'd do authentication right at the reverse-proxy.

From a security point of view it is not a good idea to host multiple web applications in sub directories on the same hostname. With such a configuration, every application sees all cookies from all other applications. This also means that you can have collisions of cookie names between applications if the names are not unique.

So if one application would get compromised, it could easily steal all your sessions for all other applications.

Particularly in low-load scenarios there can be quite a big difference when it comes to PSU efficiency. While newer ATX PSUs have become better with regards to efficiency at low load, a Pico PSU can still be quite a bit better. Older ATX PSU often don't even reach 60 % efficiency at 5 % load (which would be a typical load for such a system at idle), sometimes considerably less than that. At the same load a Pico PSU can easily be at 85 % efficiency.
Of course, at higher loads the difference is way smaller.

Compared to other SBCs, Raspberry Pis have been pretty inefficient for a while. A Pi 5 idles at about 3 W, which is pretty terrible for such a board, compared to other similar devices. You can get X86 PCs that idle at 3 W which are way more powerful. Other ARM SBCs use less than half that at idle and similarly less under load.

There are probably multiple reasons for that. The Pi's SoCs have always used rather old process nodes, which are more power hungry than more modern ones used by other single board computers and PCs - 16 nm for the Pi 5 SoC and 28 nm for the Pi 4. Also, with the Pi 5 there is this additional "south bridge" chip which is attached via PCIe. This consumes additional power and for some reason the PCIe link is configured such that it never enters power saving states. I don't know why.

Also, the power supply circuitry on the Pi 5 is far from ideal with its 5 V / 5 A power supply. Such a low voltage at such a high current can easily cause additional losses on the wire. That's mostly relevant under high load though.

There is quite a significant difference. An ssh server - even when running on a non-default port - is easily detectable by scanning for it. With a properly configured Wireguard setup this is not the case. As someone scanning from the outside, it is impossible to tell if there is Wireguard listening or not, since it simply won't send any reply to you if you don't have the correct key. Since it uses UDP it isn't even possible to tell if there is any service running on a given UDP port.

Great photos!

Getting certs from Let's Encrypt should work fine with any provider, even if you can't open any ports, since they do support DNS challenge.

Mine runs a little under 18 W with one 8 port managed switch, a DSL modem, CM4-based router, a tiny Wifi AP, and an Intel Celeron J4105 based mini PC server.

I always found the software updates of AVM - the manufacturer of those "Fritz!Box"es - to be of questionable quality. If you take a look at the source code that they have to release upon request of the GPL'ed source code they use, you'll notice that they use ancient versions of the Linux kernel, Busybox and other tools. By ancient, I mean many years old, unsupported by upstream for years. Also, they only publish those sources manually when someone asks for them, which doesn't bode well for their internal development processes. If they used CI/CD pipelines, they could easily push out updates of those sources with every new release…

I'd choose LUKS over Veracrypt for simplicity. If the drive is solely for backup, depending on the backup tool you use, you might not even need encryption on the file system level. Several backup solutions support data encryption.

Ansible also comes with its own secrets manager ansible-vault, which you can also use to store your secrets in an encrypted file.

Always nice to see solar projects, although I wonder why the author didn't try to lower the Pi's power consumption. This would have been the first thing I would have done when trying to optimize things. 5 W is quite a lot for a Raspberry Pi and there are a couple of things one can do to lower its power consumption.

Sure! Shutting down certain peripherals can reduce power consumption. The biggest difference can usually be achieved by disabling the USB controller - this is also true for the Raspberry Pi 3 (although on the Pi 3 you would also lose access to the Ethernet controller). So if you don't use it, turn it off (and it looks like the author didn't use any of the USB ports, so this would have been an option). Even turning of the HDMI port saves a little bit of power - it makes a difference even if no display is attached. A tiny bit of power can also be saved by turning off the LEDs. I also tried lowering the CPU clock, but that didn't result in a noticable difference in idle power consumption.

At the moment I don't currently have a Pi 4 on hand to experiment with, but I do have a Raspberry Pi 4 Compute Module (CM4) on a very minimalistic carrier board and with that I am able to idle at about 1.3 W.

Disableing the root login gains nothing in regarding security.

This is usually not the reason people recommend disabling root login. Since root is an anonymous account not tied to an actual person, in a corporate setting, you do not really know who used that account if you allow root login. If this is relevant for a personal home network is for you to decide. I would say there is not such a strong argument for it to be made in that setting.

Ich kann dir zu der Nabe keine Tipps geben, aber Einspeichen ist privat absolut machbar und auch nicht besonders schwierig. Es ist hauptsächlich Fleißarbeit. Außer einem Speichenspanner braucht man dazu keine weiteren Werkzeuge. Zentrieren kann man nach Gehör (oder mit einer Smartphone App die die Frequenz messen kann) machen, indem man die Speiche wie eine Saite anschlägt um einen Ton zu erzeugen. So kann man leicht sicherstellen, dass alle Speichen gleichmäßig angezogen sind.

Oh, I didn't want to suggest that there is no value in using a reverse-proxy, there certainly is. Just don't expect it to do anything for you in terms of application security. The application behind it is just as exposed as it would be without a proxy. So if there was a security flaw in that application, the reverse-proxy does not help at all.