• 0 Posts
  • 25 Comments
Joined 1 year ago
cake
Cake day: June 14th, 2023

help-circle
  • kinda the same reason people suggest something like linux mint over slackware, gentoo, arch, etc… mint is easy to install and is preconfigured to be an easy to use user desktop environment. you can configure any other option to be have like that, but they tend to be a bit more “DIY”, which is great if you know what you’re doing!

    dedicated NAS OSes will have good software out of the box that make it easy to configure and manage various common disk-related configurations (RAID, SMB, NFS, etc). you can certainly do all this yourself, but it might not have a pretty, unified user interface, or you might have to deal with software that isn’t compatible with some version of a library that’s in your distro of choice… all resolvable things, but they take time to solve: anywhere from installing a package manually to applying a kernel patch and recompiling the kernel to get something to work






  • mastodon can do default instances because they have the account migration process… i totally agree this is a great solution: get people in with sane defaults, and then let people move once they know how it works

    there will be plenty of people that don’t move (or maybe that’s solvable too: analyse your toots and suggest a more niche instance after 2mo?) but i’m not sure that’s a huge problem if your “default instance” is more of a random choice from a list of sane defaults



  • HTTPS is heavy when you’re talking about the extreme low power, bandwidth, and compute devices matter is intending to support

    its also not a broadcast protocol - matter intends to connect many devices to many devices

    those are off the top of my head; i’m sure there are more. HTTP is great, but new/alternate network protocols aren’t inherently bad: especially when you’re operating in a very constrained/niche environment



  • “even”… i think reddit’s follow ups were least likely to succeed because they were the least organic!

    place was special (at first) because it was a bunch of people with no time to plan and prepare… it was humans doing human things with all the limitations and creativity that came with that

    other iterations of place were bots and pre-planned “stake our claim” rather than making something interesting and different… it was kinda all just the same as the last one but with subtle “meme of the moment” tweaks










  • so what you ideally want is people to ONLY be able to access your backend service through caddy, so caddy should be the only one with ports publicly accessible, yes

    caddy running in the same docker network as your services can talk to those services on their original ports; they don’t need to even be mapped to the host! in this case, you have 3 containers: caddy, service 1, service 2… caddy is the only one that needs to have ports forwarded and you can just forward caddy:443 and no need to worry! then caddy can talk directly to services:80 or services:443 (docker containers show up to other docker containers by their container name! so if you run eg: docker run … —name lemmy, then caddy in the same docker network would be able to connect to http://lemmy:80!)

    … but if you forward say service 1 and 2 on :8443 and :9443 (without firewall, and even with it makes me uncomfortable - that’s 1 step away from a subtle security problem), someone could be able to access <yourserver>:8443, right? so they don’t have to go through caddy to get to the backend service… for some services, that can be a big deal in ways that it’s difficult to understand, so it’s best to just not allow it if possible

    an alternative is to make sure your services are firewalled so that nobody from the internet can hit them, but caddy still can… but i like this less, because it’s less explicit what’s happening so it’s easier to forget about