Reannlegge

I have a flint 2 (glinet) as my firewall as well, I had read somewhere that I should install vanilla OpenWRT so I did (I have added stuff to it so I like coming up with different flavours when talking to people like rocky road). I have Caddy running in docker on a pi in my LAN I have a password file of some sort that Caddyfile references at the top. Don’t ask me how I formatted it because I do not remember that part but take my secondary pihole as an example of using a domain that cannot be reached, from outside of my lan.

pihole52.reannlegge.ca {
    @allowed {
        remote_ip 10.0.0.0/8
    }
    handle @allowed {
        redir / /admin{uri}
        reverse_proxy http://10.0.69.52:31415/
    }
    handle {
        respond "Not available from this network" 403
    }
    import easydns_tls
    log {
        output file /var/log/caddy/pihole52.log
        format json
    }
}

While other places on my domain can be reach outside of my vLANs. I have to secure some things up as I found that my SearXNG is open to the WAN.

Edit: looks like search.reannlegge.ca was available on the WAN if you where in Canada but I have changed that to only on my vLANs and VPNs

I got into self hosting because my place flooded and I was waiting on insurance and the repair people to fix give the go a head and then to actually fix my place I do not really go anywhere so I was fine with being blasted with ads when I was out of my home, until I caught myself watching ads to get extra whatever from a mobile game. I had a pi zero 2 (with a PoE hat) that was not being used for anything so I thought why not use it to host wireguard, I had looked at a few options for VPNs but thought wireguard fit my needs the best. It “worked” I do not know if it was just my copper internet speeds or the silicon in the pi zero 2 which slowed everything down but now that I have a dedicated OpenWRT firewall, fibre, and a static IP (well technically 2 I just do not use the second one because the weekend project of spinning up my own SMTP and IMAP server had me at the point where I wanted to pull out my hair), I have wireguard automatically turn the VPN on when I am away from my LAN. So I would only see the adds if I went on someone elses device.

I use easyDNS and they have a wild card option for their email, so I have a formula whenever I am signing up for something my email addresses are always nameofservice_funSaskathchewanwordplusthreerandomnumbers@reannlegge.ca. When I started this I was on hosthero and they use cpannel with no wildcard options you have to go in and create the email address before you use it. When I left hosthero, because they cost to much and are not the friendliest company to deal with I had something approaching 300 unique email addresses after 4 or 5 years because I did just not bother closing them after I continued using the free trial of whatever or just stopped the forwarding to my main email address or whatever email it needed to be sorted into.

Now I just have everything automatically go into junk mail unless it is something I need than I make the effort to log into their easyMAIL web thingy and sort where it should go. I have it set to delete things that are a week old (I think it could be a month?) so if I do not need it I do not need to worry about it and it will just go away on its own other things are sorted into folders and very few things are sent to my inbox.

I was never really a windows user, I grew up on Mac OS (Apple DOS, 7, 9, and X). I am stuck with an iPhone and an iPad because I do not have the money to replace them at the moment but as soon as there are no longer updates for them they are being stripped of most of the data, being put onto my IoT vLAN and being used as HA kiosks. I say so long to things as soon as updates are not being pushed because they become attack vectors. I have had my ID stolen once before, probably not because of out dated things but I want to limit the places bad actors can get to me (just know the process of making sure stuff doesn’t hurt you further is hell).

I have a Mac mini I am thinking of doing some actual work to get Debian installed on but I turned on the Mac just to get my iTunes purchased music off of it and than half assed an attempt to get refit installed and get Debian running, maybe some day I will get it working but that day is not now.

I have 2 instances of pihole running in my LAN, I have wireguard on my firewall to get to those two ad blockers when I am away from home. I am so glad I was able to figure out how to get it back up and running without needing to redo all the work.

I have pihole do a lot more than just block ads; they also block a few different tlds (like .zip), they have different lists for different vLANs, and there are several different regex things I have in it.

They are not on the same pi, sure they are both docker images but they are on different pi’s

Yeah I know it was a very iffy time luckily it was only one night and morning. I broke the protection many times today but I am all wrapped up now.

My Firewall was not putting out last night. So I could not get any pihole action.

So last night my firewall decided to say F you Reann and stopped working for no apparent reason. I called my ISP to see if it was anything on their end but it was a big nope. It was rather late at night and I do not have computers with monitors at my place so I thought I was SOL. I was frustrated that I could not do anything because I had the bright idea of deleting one of my two static IPs out of the router and than reboot it. I thought to calm my frustrations I would play some games on my ipad, and holly poop am I ever not used to all the ads in mobile games. Luckily my youtube ad blocking does not require anything else on my LAN so I put on some videos and went to bed. In the morning I remembered I had a ethernet to USB adapter and a USB A to c adapter so I would be able to fix it that way. Don’t know how many times I needed to fix the firewall because I broke the internet trying to fix my boo boos and a few times the firewall just said F you Reann I am not putting out. But it is now fixed and I can enjoy my moble games and web browsing mostly ad free!

So I had no pihole action on my LAN.

Like seriously how do people hand how many ads are shoved at you when you are using your devices?

I was on DuckDuckGo this morning trying to fix things and wow the ads, really made me miss searXNG.

Luckily I do not get spam, I spin up a new address for everything so I did not get those ads at least.

I have a Flint 2 with a vanilla install of openWRT, that hosts wireguard. I have 2 static IPs, because I thought hey running my own mail and smtp services cannot be that hard (turns out yes it is hard and not worth the time to deal). Any who I have Wireguard running on my firewall and Caddy running on one of my pi’s, it gets TLS from lets encrypt.

I have a couple of domains that Caddy uses to point things out to the world or my LAN/vLANs/VPNs. Very few of the things go out to the whole world, but if I wanted to share say a Jellyfin server with someone I could wip up a VPN that only allows Jellyfin through and points DNS to my piholes. Why do I mention my ad blocker? I mention pihole because that what hosts the A records to my domain names that Caddy can serve up, I do not remember why I set it up like this, I would have to look through my notes but pihole points “service”.domain1or2.xyz to caddy which than points to the right service.

Edit: went and looked A records are hosted on pihole for my LAN/vLANs/VPNs to prevent things needing to go out and come back just to tell devices where on my LAN services are.

I wish I had something better than a pi5 for ollama, and ripping my CD’s when I get those back out of storage.

I started using Navidrom as suggested by someone in the group. I do not have audio books but it has a spot for them. If you want to get all fancy like you can use the MusicBrainz Picard for tagging stuff differently (or something like that I am really feeling the glue and sealant they used to put down the laminate in my place right now) but AudioMuse-AI does something to (again really feeling it).

I use a Flint 2, I think I have something like 5 AP’s On it and it covers my whole home. I have a bunch of vLANs as well for the APs and VPN’s. It came with some custom OpenWRT install but I flashed it with a vanilla version instead. I was using an Apple Airport Extreme prior to getting the Flint 2, but my place flooded and I got board so I took up the hobby of home labbing while I wait on insurance to get things rolling (after a few months the flooring is finally going in tomorrow) my original plan was going to be use the Airport as an extender but I did not need that, but yes APs with the same SSID will work together. My Flint 2 has SMB setup to back up its settings to a pi I have on my LAN.

I decided that living on a hope and a dream of maybe someday seeing if my Mac Mini still worked I can now gleefully say it is working* if I cannot figure out how to update it further oh well I will just continue on with it as is and harden it the same way I do everything else. But right now it is downloading my music library, which I will promptly backup before trying to update it further.

*I need to figure out how to update it to the last OS version it can handle.

You should really have a good hardware firewall before you do that. Change ports, change ports for everything you can nothing I run is on the standard port I make sure of that other than 80 and 443 for unbound I would if I could but I like having access to the internet I should have mentioned that with pihole.

Thanks for letting me know.

On all of my raspberry pi’s excluding my HAOS pi I have Docker; (I am thinking of adding something so I can see all my images visually, funny story I was looking on docker to see everything I have running and I guess I do have a service for this).

2 instances of pihole across 2 of my pi’s; (one primary, which has been migrated to docker and a secondary which is still running bare metal I have docker on that pi but just have not got around to migrating it yet maybe that is a today project) highly recommend you start with a linux distro that is right for you and start with docker and pihole (You could probably stick with windows or MacOS if you want but I highly recommend linux, there are other whole LAN ad blockers, pihole is just the one that works for me. Just to be funny I run them on port 31415!) on a device or two you are not afraid to leave running 24/7 that is why my homelab is spread across different 4 different pi’s and a Flint 2 router.

Maybe on two pi’s I have Nebula-sync; to keep my piholes in sync but I know I have it on one of them.

On my pi 5 with the most RAM I have:

Caddy; this could go on prior to pihole, but it is to give everything easy to remember domain names and to allow some to be open to the world while keeping others to the LAN/VPN

After those four things I would suggest searXNG; to replace whatever search engine you use when you go through and pick which engines it uses to do searches please do not select the Google. With searXNG you do not get all that AI crap I hear people get now, or the paid advertisement links at the top of the results, you also get to weigh which engine you want to use more.

Vaultwarden; with that I can use all of bitwarden’s services for free

Immich, because I am not paying a third party to store just my photos

Nextcloud, but I am getting off of that, it does all of the file sharing that I need with my devices that cannot use rsync calendars and contacts but it tries to do to much.

Down detector; to tell me if there are problems with my devices (sends me emails if one of my devices goes off line).

Paperless; to keep important documents in a easier place to find.

On another pi 5 I have:

The arr stack, I should really get jellyseeerr working!

Transmission, the bittorrent client it is running CLI with a web interface. I have it setup to download a copy of the raspberry pi OS every time there is a new release and to host it until the next new release, everything else I have a ratio of 3.

Jellyfin; (I will fight you if you think plex or emby are better), if I wanted to share my media with people I could create another VPN exit that only allows people to Jellyfin.

I guess I have Navidrone; for music streaming? I should probably remove that because I have Jellyfin that I plan on using.

Cowrie, is the honey pot sitting on port 22.

On another pi 5 I have

Ghost; for my blog/web design service, I am considering exploring more options as it is more geared towards people wanting to get money.

I guess I have matomo; to monitor my self hosted blog, did not know that.

On a pi 4 I have

HAOS; I have so many things running in HAOS, but the one service I am most proud of is my reminders. The reminders just started as a reminder for me to take my medication because the app I had purchased decided that the fact that I had purchased it was not good enough and they wanted to charge me a subscription, so I setup Home Assistant to remind me and that quickly became reminders to do other things as well all on my apple watch.

I have a retired ipad running a HA kiosk in my kitchen; it tells me things like what lights are on, how many times I have had bots try to penetrate me, speedtest, transmission stats, and my ecobee settings. I am thinking of setting up an old phone to run as a separate kiosk in my bedroom as a clock/weather screen on my bedside table and I am hoping to get a hand me down old ipad to act as another kiosk in my living room, more to watch for docker containers needing updates, maybe the also the weather and bandwidth monitor.

OpenWRT on a Flint 2 because the firewall my ISP’s firewall/modem like most ISP’s is a joke so I have it set to pass through to my own with 2 static IP’s one of them was originally going to be for mail but I quickly discovered how silly of an idea that was.

Wireguard; I think it is on my firewall, on one of the IPs I was going to host mail on the other but I came so close to ripping out my hair trying to do that so I got a hosted service through easydns it has a wildcard function so I can still get unlimited free trials to whatever instead of going into hosthero’s cpannel and spinning up a new address)

Crowdsec so I get to watch how many bots try to penetrate me in a day, week, month, or ever. It is in the 100’s a day, before I knew I could/should change my SSH port I had port 22 open to the WAN, this was long ago but still it was a bad idea. 22 is now open as a honey pot.

I have Crowdsec-bouncer that stops known bad actors from trying to get in.

I am sure I have other services on my firewall but I cannot tell what is an actual openwrt service and what is something I have added, but it is a vanilla install with all kinds of things added extra. .

Don’t know if you would count CUPS or scanjs as self hosted but those are run for my printer/scanner on a pi.

I have an old mac mini I am thinking of plugging in so that I can download all my music and add it to Jellyfin, than I am debating on if I want to install debian on part of the drive and keep MacOS on part of the drive so that I can actually use the bluray drive I have as far as I know there are no bluray drivers for linux because the big movie producers are scared of piracy, not like they are trying to rape us consumers over the hot coals.

I was going to come in and say pihole, hands down as it got me into home labbing. But then I got reading some of the responses and my thoughts changed to Home Assistant because I can automate so much. An app that I had purchased to help me stay on top of my medications decided to go subscription so I was able to use HA to set up reminders to take my drugs go off on my watch which I would turn into reminders to do so much more. Than I thought Docker, because it is so much easier to install things with docker. Than I thought OpenWRT because I now have a real firewall that I can do so much more with than my ISPs dinky little thing. I was almost ready to reply when I read your question over again and I saw you mention the *arr stack and Jellyfin, which got me thinking how much I love that. Which reminded me of someone saying immich. I have to go for some blood letting today so I keep my blood req in paperless. I self host nextcloud and that is one thing I am looking at finding alternatives to but all that being said picking one is like picking a favourite family member, sure some you may like more than others but you are never going to tell which one.

Huh if I ever get around to it I will look up guided access to lock it to my HA kiosk. Hell I will forget by the time I hit submit I need to stretch my legs and see about it now.

Came here to say this I have an old iPad sitting in my kitchen with HA in kiosk mode. Uninstalled as much as I could and it just sits there with a clock if I press the screen I can see fun stats like speedtest, crowdsec, pihole, or the forcast for the next few days or even what my thermostat says the indoor temperature is.