Just wanna update: the UDP mux option works! Rather than opening thousands of ports, you’d now only need to open 3 or 4. I’ve got 7881/tcp, 7882-7883/udp, and livekit’s HTTP backend fronted by a reverse proxy, and that’s all for calls in most circumstances.
Redact-on-ban is an in-progress MSC (MSC4293). User tags are nice but I haven’t seen specs for it. They’ll probably just be there to annotate a user, and won’t be involved with the current power level system
Selfhosting both. Continuwuity is more straightforward to set up than ejabberd, mostly because of easier docs, less ports, and less subdomains required. It also comes with most things you need rather than a bunch of toggled-on modules, and I’d say Matrix being HTTP makes it more “conventional” for beginners.
XMPP is significantly more lightweight though, being a message passing protocol rather than state syncing.
For Matrix, what server software are you hosting and what’s your subdomain setup? When logging in, you just enter the domain behind your username (e.g. use example.com if your username is @user:example.com)
Edit: not sure if Snikket supports multiple domains, but its upstream, the Prosody server, does that just fine
If you choose to go with Matrix, I would strongly recommend you to give the Continuwuity server a try. It is quite simple to install, much less resource-intensive than the commonly-used Synapse, and has an active community behind it.
apparently, I need a TURN server to get this working properly
Do note, Matrix recently has a new calling stack called MatrixRTC, and for that you would be setting up LiveKit in place of a TURN server. That also opens many ports by default, but I think there is a “UDP mux” mode that listens all on one port. I’ll be looking into it soon.
The other alternative is XMPP, which is a bit more complex to set up (more ports and subdomains, non-HTTP protocol etc) but is generally more lightweight and fast. ejabberd is my choice, but people tend to like Prosody and Snikket as well. While they use the traditional TURN servers for calls, their clients could use a lot of improvements though…
So yeah, my Continuwuity and the XMPP server sits on a small homelab machine, and with some extra tuning and grit, they work well. LiveKit and TURN sits on a VPS for better network performance. To be honest, I do all of this mainly because I wanna talk to cool people on the internet, so the service has to be federatable.
It’s a cartel in the sense that the CA/Browser forum determines, on their own whim, which CA gets featured or revoked in your browser. And single-handedly impose technical restrictions like shorter cert lifetimes and less features. Stuff like eMudhra being able to compromise everyone shows its quite a vulnerable group of single-point failures as well, but still condoned by almost everyone.
ZeroSSL and Komodo does have free certs if I remember correctly. They’re still bound by the 90 days (soon to be 47) limit though
This seems quite offtopic for this community. If you want to selfhost your own Lemmy server though, people here may help you
Matrix, and I recommend selfhosting Continuwuity as it is lightweight and easy to spin up. Your other option could be XMPP with Snikket or proper Prosody.
Though do you have any particular features you wanna bring over from Facebook Messenger?
Gomuks and Sable
Just Ctrl+F it will bring up search which queries the local gomuks.db
It cannot start in offline mode but it’ll keep itself up when disconnected from your server. Might wanna feature request that one
Pihole would be easy for a RPi 4. I’d also consider AdGuard Home which does the same thing, but has out-of-the-box support for encrypted upstream resolvers. I eventually moved on to Technitium for more advanced use cases (hosting my own domains, native config syncing between nodes), albeit it can use a bit more RAM.
Hi, as someone running their Matrix server on the same ware (using Continuwuity)I have some thoughts:
I’d also like to rehash what the other commenter say in that you’d get much more juice out of a mini PC or some other non-embedded devices. This is for all your software anyhow.
And yes, Continuwuity can run in docker compose. There’s a few example files for it on the site, feel free to check it out and ask in the support room.
I’d prefer Adguard Home. Does the same thing but also supports encrypted DoT/DoQ/DoH upstreams. And the UI looks a bit neater for me
Since nobody mentioned, I recommend https://desec.io/ as the DNS provider. Has a good REST API to update records, also provides a dedyn.io dynamic domain, and runs as a nonprofit. I think ddclient will also support it natively in the next release as well.
The solution of renting a VPS also works but usually incurs some cost. You might also want to look into Cloudflare Tunnels
Hi all, thanks again for the valuable insights, I really appreciate your comments. I realized I’ve overlooked a few topologies, namely that of having granular accounts for different admining purposes/different services (and using different names for them). Also, my IDP (Kanidm) also has a service accounts feature which can be delegated to real human accounts, so I think I should also be looking into that.
It’d be nice to have something like a “second password” for granting temporary privileged access to other apps’ admin commands, but OIDC doesn’t work this way sadly. Lastly I’d also need to consider managing SSH and non-app stuff as well.
Use grants rather than ACLs, they’re the “new” way of doing access control. Host a full-fledged DNS resolver inside your Tailnet (AdGuard Home, Pi-hole etc) to do adblocking and local zones, the MagicDNS custom records are very rudimentary. If you intend to integrate with a third-party UI, doublecheck which Headscale version they support and ask in the Discord, since they usually lag behind a bit. Prioritize peer relays over DERPs for performance.
Hi, I’ve been running something similar with Tailscale. Instead of traefik, you can use any other TCP proxy like nginx or caddy-l4, or even use tailscale serve on the edge VPS as well. Do note that all of your listed services except Zola will make outbound requests, so it could be better to also exit node through the VPS (like the article did), as to avoid exposing your residential IP.
As for the linked personas, you may wanna use one domain instead of two. Matrix homeservers can be resource-heavy for example, so maybe consider @persona1:example.com and @persona2:example.com on a single server instead of having two resource hubs that does essentially the same thing. The same applies to GotoSocial and Lemmy. By the way, I recommend Continuwuity for the Matrix server :)
Static sites don’t actively take up resources, so they can be on separate domains. But again you may wanna save some money, so maybe consider using persona1/persona2.example.com subdomains, or even pubnix-style example.com/~persona(1|2) paths!
As for the Docker management frontend, I have no idea which one’s the best right now 😅 but do make use of Tailscale SSH feature to troubleshoot other parts of your machines as well. And as for updates, I just subscribe to RSS feeds to keep the important software updated. Highly recommend you do that too to check out changelogs yourself.
Thanks for the link to go-sendxmpp. It’s nice to have an xmpp-native way to send notifications
You could do that, but you’ll need to employ some kind of DNS tuning so that:
The terminology for this is “split DNS” or “split horizon”. You can do this by selfhosting two DNS servers - one for the LAN and one for the Tailnet - with different records for the domain. You can selfhost the same DNS server on both the LAN and the Tailnet, and configure some rules so it answers differently based on the querant’s IP. Found this guide for Pi-hole. Technitium also works for this with its Split DNS app, but it’s a steeper learning curve.
Furthermore, if you don’t wanna pay for a domain, just use one of the free dynamic DNS services. https://afraid.org/ is one of them.
Alternatively, why not always connect to the Tailscale address in the first place? Tailscale probably run as an always-on VPN on your client device anyways, and you can reuse the address in the same LAN.