My server is only available on my LAN and via a VPN. Is fail2ban applicable? Or is it mainly for public facing servers?

I view podman as a mostly drop in replacement for docker but it doesn’t have a daemon (for better and worse). I wouldn’t recommend using podman for you right now. I’d strongly recommend docker-compose (not docker run).

If you’re ever stuck trying to convert a docker run command to a compose.yml file, composerize.com is helpful.

I have about 20 services on my machine so I’m going to need to open a ton of ports (ssh, SSL, multiple higher number ports since some services require several ports). At that point, what is the point of a firewall if so many ports are open? With so many ports open, it seems like a firewall doesn’t add much security vs the complexity it adds.

I had a similar journey and recommend it. I started with Open Media Vault with docker containers configured via a GUI, then to Debian + docker compose, then to Debian deployed with Ansible + docker compose, and now I’m with NixOS + podman compose. The first jump to Debian was the most intimidating for me learning CLI commands for the first time and not having defaults chosen for me, but it was liberating to finally learn the actual tools and not just learn a GUI abstraction for tools.

I’ve seen some interesting development with Music Assistant but I haven’t personally used it. It’s not sure if it can be commanded using the cast button.

I agree with starting with what you have to get learning, but I wouldn’t run a Minecraft server on this machine. I’d start with everything else and then buy an old office machine to upgrade. It depends on the unit, but they are easy to upgrade basic upgrades like adding RAM, storage, and possibly a low power graphics card. Since most servers are always on, keep an eye on power consumption with a power meter.

I don’t know either. Swiftfin seemed more actively developed based on releases, but now it’s great to have another active option. I haven’t compared them but I am curious if anyone had.

Out of curiosity, why do you use this instead of Swiftfin?

As another solution, you could try Tuta Calendar. It’s not self hosted, but is free for one calendar. You will be able to access their WebUI and they have clients you can download too.

I hadn’t looked too much into Radicale, so thanks for the info. What is their second webUI you mentioned called? If you’re looking for an all in one server, Nextcloud may be your best option. Its a bit heavier though for just contacts and calendar. If you do go down this path, I’ve heard the docker AIO container is easier to maintain.

I briefly looked into the web client, and I don’t think it’s worth trying to self-host. There isn’t a docker image and the latest release on github is from 2020. If you need a web UI, I’d recommend using something else.

If you’d like a web UI too, Radicale may be a better fit and easier to set up. I tried it out briefly using docker compose.

I use the same etesync clients but link them to your own server, called etebase. There are a couple setup examples in the code, but if you’d like, I can share my docker/podman compose stack.

I haven’t set up the web UI to directly access items since I’m fine just using clients to sync and access items, so I haven’t looked into the web UI.

It’s not too hard to self-host too.

I assume it was the pound symbols so I removed them.

The font size? Or the amount of text? The font size is normal for me.

Great job on your journey! It sounds like you’ve made a lot of progress in the last 2 years.

Q1. I highly recommend OpenWRT. It runs on cheap hardware, is open source, and has a lot of options. I don’t have any strong recommendations for hardware, but I’ve seen people recommend the Flint 2 routers and they sometimes go on sale. Regarding remote access to your LAN, 2 common options are setting up a VPN (aka road warrior) for remote access and using Tailscale. If you’re not great at networking, I’d recommend setting up Tailscale. It can run on your router, or another always on computer like your Home Assistant machine. It’s not FOSS, but is easy to set up and I recommend it. You can always swap it out with something FOSS later on your journey. As a side comment, you may want to looking into running PiHole. I think it can run on an OpenWRT router if you’d like. This is a little advanced, but once you get set up and comfortable with your router, I highly recommend looking into VLANs (software setting on some routers like OpenWRT). I have a specific SSID that does not have external internet access. I put any questionable devices on that SSID/VLAN (like cameras, doorbells, IOT) so they are secure but I can still access it locally from my server. I make sure to only buy IOT devices that can work locally without internet.

Q3. For maps navigation, I use Magic Earth (not FOSS). For me, it’s the right balance of privacy and usability. For browsing google maps, you could check out GMaps WV which is basically a PWA (progressive web app) for Google Maps.

A couple questions are about GrapheneOS app strategy. My approach is:

• Main profile has only FOSS and privacy respecting apps enabled. I use a limited number of privacy abusing apps (e.g., Google Camera), but they do not have network permissions. In your case, you might use Nova launcher but block internet access using permissions.
• In my main profile, I install and then immediately disable privacy abusing apps that require network permissions. I then create a new profile for each app (e.g., 1 profile just for Lyft, 1 profile just for Southwest, etc.). I also have Orbot installed and disabled. I “install” these apps by editing the profile and “Install available apps” from my main profile to only install the app (e.g., Southwest) + Orbot (if I want to force it only use the Tor network).
• I like this approach because it makes app updates easy (I only need to update all apps from my main profile). It isolates apps, since apps can see what other apps are installed and there are risks to using “bad” apps in the main profile. It allows me to configure apps to only use Tor. It disables them when not in use since I set the profile to not run in the background. As a side benefit, it makes it more difficult for me use these privacy abusing apps so it incentives me to use FOSS and privacy apps instead.

Q6. Reolink + Frigate is commonly recommended, but I’d be careful before starting that project. Frigate is one of the more difficult items to self-host for new people, especially if you want to make sure the camera is on a restricted VLAN.

Q11. You could also look at lawnchair launcher, but it hasn’t been updated in a while.

Q12. I like the GrapheneOS keyboard, but I use the FUTO Voice Input with it. That is a separate app from the FUTO keyboard. I make sure the network permissions are disabled on the FUTO Voice Input.

I haven’t use any of these, but others could look at:

• Maybe
• DumbBudget
• budgetbee
• OpenBudgeteer

For reference, these are from Selfh.sh

Thanks. That’s helpful. I decided to get an R720 I found on Ebay for $60. I’m not sure if it was a good choice but I’m excited to try it out!

Can you please explain?