ablackcatstail

Timeshift is nice to make things easy. I simply use good old-fashioned rsync tied to a cron job.

Unbound is simple to configure. I will send you mine when I get home from work. You could probably easily adapt it.

Yes, it was indeed a really stupid move.

Linux, BSD, and open source in general has saved my life too. It's given my a passion and a love again. Linux and BSD quite literally work better than any antidepressant I've ever had.

I don't have plenty of storage. I will have to upgrade at some point.

I just decided to go ahead and implement split-brain DNS this evening and it works perfectly. What are you using for your internal DNS server? If it is Unbound, the one that I am using, I can share my config with you. After implementing this, the speed of my services when being accessed from my internal network sped up by an order of magnitude. I shoulda done this earlier. 😆

Thank you! I would appreciate the help very much. Please take your time though.

Thank you!

I have not converted my home network to use split-brain yet and that's because I only just recently got Let's Encrypt to work with the DNS-01 challenge which verifies domain ownership via a TXT record. Now that the DNS-01 challenge works perfectly, I can use split-brain DNS to resolve my example.com requests to internal IP addresses. What I am currently doing is as follows and it is inefficient and ugly!

Local request ---> Internet --> VPS Proxy --> WireGuard tunnel --> Local Server --> WireGuard tunnel -> VPS Proxy -> Internet --> Local origin

Now that I have Let's Encrypt working using the DNS-01 challenge, there will be significantly less latency. It should look something like this:

Local request --> Local DNS Server --> Local Server --> Local request
                                         |
                                         --> Local Server --> WireGuard Tunnel --> Internet

I hope this is helpful! This will reduce the amount of locally generated traffic that must transit the VPN tunnel bi-directionally.

Here is a way to get working Mastodon working behind a reverse proxy that exists on a different machine. Basically, the NGINX server running on the Mastodon instance is configured to "lie" to the the streaming and web servers that the connection is happening over. This way you handle the SSL termination at the actual proxy server. So what you do is change the listen line to 80 and comment out all of the SSL related stuff. Then look for the @proxy section of the NGINX daemon running on the mastodon instance and change the X-Forwarded-Proto header to https as shown below.

server {
  #listen 443 ssl http2;
  #listen [::]:443 ssl http2;
  
  listen 80;
  server_name example.com;

  #ssl_protocols TLSv1.2 TLSv1.3;
  #ssl_ciphers HIGH:!MEDIUM:!LOW:!aNULL:!NULL:!SHA;
  #ssl_prefer_server_ciphers on;
  #ssl_session_cache shared:SSL:10m;
  #ssl_session_tickets off;

  # Uncomment these lines once you acquire a certificate:
  #ssl_certificate     /etc/ssl/fullchain.pem;
  #ssl_certificate_key /etc/ssl/private/privkey.pem;

...

location @proxy {
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    #proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Forwarded-Proto https;
    proxy_set_header Proxy "";
    proxy_pass_header Server;

    proxy_pass http://backend;
    proxy_buffering on;
    proxy_redirect off;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $connection_upgrade;

    proxy_cache CACHE;
    proxy_cache_valid 200 7d;
    proxy_cache_valid 410 24h;
    proxy_cache_use_stale error timeout updating http_500 http_502 http_503 http_504;
    add_header X-Cached $upstream_cache_status;

    tcp_nodelay on;
  }

If you have not yet created the reverse proxy server itself, check out NGINX Proxy Manager as it makes things stupidly easy. NGINX Proxy Manager runs in a dockerized container and makes setting up Let's Encrypt certs a breeze. Just be sure that when you define the

I am currently self-hosting my Lemmy instance out of my home and reverse-proxied over a WireGuard tunnel. I suppose I am not in immediate danger. Is it possible to use S3 storage with my current setup?

Maybe see if your local area has any swap meets? In my home town, there are quite a few computer enthusiasts and I've gotten some pretty good deals on stuff from Windows users that will no longer cut the mustard for Windows but do great for Linux and BSD.