Hi all,

I'm looking at exposing some self-hosted web-based services externally so that some relatives can access them and would appreciate some advice.

Vikunja is the starting point (mostly to facilitate my spouse and I using it when away from home) but in future I want to set up Immich or similar to replace Google Photos, and that in particular will need to be shared with friends and family (especially so that immediate family can have camera uploads on automatically).

I understand that ideally I'd use SSH, a VPN, or tailscale or similar (although I don't have experience with tailscale), but that's not going to be feasible. Most of the family will not be able to set up those connections themselves (which means I would need to) and several are far enough away that it is impractical for me to provide on-site support or do it myself. Even if I could get a VPN or similar deployed on all their devices, I suspect that they're going to struggle with needing to connect to it just to upload or view photos, then disconnect afterwards to resume using the Internet -- I really need this to "just work" for them.

So this brings me back to safely exposing these services to the outside world. My network architecture complicates this a little, so for context:

• Modem/router has basic firewall and points to a Raspberry Pi for DHCP. I already have No-IP set up with a domain name so that I can SSH into my LAN when away from home.
• RPi runs Pi-hole + dnscrypt, acting as DHCP and DNS server for the network.
• I want to use nginx as a reverse proxy running on this RPi, as I have experience with it and it can add SSL using certbot. The router would be configured to use port forwarding to direct external traffic for ports 80 and 443 to the RPi.
• Vikunja is hosted on a separate Raspberry Pi (with other things like Shiori)
• I have not yet determined where Immich or similar is going to go. I have existing home server that I use for backups and important family stuff, but I really don't want this to be vulnerable to the outside world. If I were to install Immich here, I'd need it to be well-isolated from the rest of the system. The other option is to get a NUC or similar, which is what I am leaning towards as the less stressful option.

So my main questions are:

1. Beyond fail2ban and my router's firewall, what else can I do to protect my network once I open ports 80 and 443?

2. How do I handle fail2ban configuration when the services are on different devices to the nginx proxy? I understand the best place to put fail2ban would be on the Pi running nginx (since it's the access point to the outside world), but that it also needs to read the logs from Vikunja, etc. to be effective.

3. Where would you put Immich in my network architecture?

Any other tips/recommendations for making this easy to use for my less tech-inclined friends and family would be much appreciated as well. Thanks.

The secretary of defense says flu shot mandates are overly broad.

Sorry, this is a bit of a rant...

I had to assemble an IKEA flatpack cabinet today.

I always find this process painful because, to me, the instructions are always lacking (and a lot of other flatpack kits have followed IKEA's trend of picture-only guides). How hard is it to put a name below each component on the parts page (so I know what this weird thing is when it appears on page 22!), or indicate what's the top/front/back/etc.?

Today it would have been really helpful to know which edge was the top and front for the sides of this kit, rather than flipping back-and-forth through the manual to work it out. The irony is that they got so close to realising this was a factor, since the instructions did actually have two procedures (depending on whether your ceiling was high enough to stand the cabinet up after assembly or whether you needed to assemble it in-situ).

Is it just me and does everyone else just find it easy to follow the instructions, or do a lot of other people struggle with them too?

A short video directly comparing images taken from Part One of "The Android Invasion" as presented on the new Season 13 Blu-ray set with the earlier 2012 DVD release.

Australia Post is taking the extraordinary step of immediately suspending many forms of shipping to the United States, as a Trump administration tariff deadline approaches on Friday.

A Trump administration tariff deadline is creating "chaos" for postal networks and retailers globally, as low-value parcels will be slugged with import duties from next week.

I have a bit of an odd issue with my Surface Pro 3, which is running Debian 12.

Occasionally (perhaps 1 in 15 to 20 boots) it fails to detect the keyboard properly (this is a genuine Microsoft keyboard cover that connects via the pins on the edge of the Surface, not one of the generic bluetooth ones you can get now). When that happens, the onscreen keyboard logo appears in the top right corner whilst the grub boot menu is displayed.

When it then tries to boot Debian, it throws some kind of Secure Boot error and displays this error message:

SbatLevel variable initialization failed
Something has gone seriously wrong: SbatLevel UEFI variable setting failed: Invalid Parameter

I then have to force it to power off and then try booting again. Usually it works the next time around.

This one's got me stuck, as I don't know much about the Secure Boot process and I've struggled to find any other references to this error online apart from this question on Reddit (which unfortunately didn't resolve it).

I find it particularly odd that this error only seems to occur when there's an issue with the physical keyboard, despite me being able to use the onscreen keyboard in grub. I can replicate this behaviour by detaching the keyboard and it consistently produces this error.

Apart from trying to address the intermittent keyboard issues, which I am looking into (I may need to buy a new one), I have no idea where to start with the Secure Boot issue. Any suggestions would be much appreciated. Thanks.

Update:

Whilst I don't fully understand why this error was occuring, I did manage to resolve it.

My Debian installation was using the default kernel (6.1.0-35-amd64 and 6.1.0.37-amd64 were installed) and selecting this would consistently cause the SbatLevel error with the keyboard removed.

Installing the Linux Surface project kernel (currently 6.15.1-surface-2) per the instructions allows me to consistently boot without the error with the keyboard detached.

Australia needs to rethink its relationship with the United States.

We've done quite well maintaining a wary, non-trusting trade relationship with China.

We now need a wary, non-trusting security alliance with the US, if that's even possible.

Of all the schisms that cleave contemporary America, few are more stark than the divide between those who consider themselves to be victims of US history and those who fear they will be casualties of its future.

https://www.abc.net.au/news/2024-08-20/sovereign-citizen-australian-taxation-office-tax/104064368

Not Facebook, but still the same sovcit insanity and in this case, how the Australian Tax Office (ATO) is responding.