I think it’s super weird that some people have a r/Lemmy to discuss Lemmy drama and tech support Lemmy questions on Reddit (with very low engagement), some people do a tumblr and some do YouTube videos to gather evidence and expose certain users. That’s just wild.

Yeah sure. We just have to build a spaceship, travel a few thousand lightyears, then accelerate the black hole into the desired direction, probably with an amount if energy that also requires us to build a dyson sphere around the next star. Then wait some ten thousands of years, decelerate it, build the energy harvesting mechanism around it, and boom, enemy obliterated.

I really feel it could be more efficient to just make some antimatter out of pure energy, here on earth, and just mail it to them in a letter bomb.

I mean producing antimatter is ridiculous, too. But so is obtaining a black hole. And I don’t get why you wouldn’t then directly use it as is, or use the energy you wasted on the project directly. But instead harvest a tiny amount of a black hole’s energy to convert specifically that into a weapon… And what kind of application needs “bombs” which are fine to arrive in a few hundred thousands of years or so?

Yeah, and where do you get a black hole that happens to have the appropriate size?

I’m not sure about that. I think OP wants something like ATA secure erase. That would be hdparm and a bunch of options, and not blkdiscard. Unless they specifically know what they’re doing and what options to pick. And what the controller will do in return.

Why not simply use an antimatter bomb? Wouldn’t that have way more explosive power?

Yes, thanks. Just invalidating or trimming the memory doesn’t cut it. OP wants it erased so it needs to be one of the proper erase commands. I think blkdiscard also has flags for that, so I believe you could do it with that command as well, if it’s supported by the device and you append the correct options. (zero, secure) I think other commands are easier to use (if supported).

Maybe have a look at https://nginxproxymanager.com/ as well. I don’t know how difficult it is to install since I never used it, but I heard it has a relatively straight-forward graphical interface.

Configuring good old plain nginx isn’t super complicated. It depends a bit on your specific setup, though. Generally, you’d put config files into /etc/nginx/sites-available/servicexyz (or put it in the default)

server {  
    listen 80;  
    server_name jellyfin.yourdomain.com;  
    return 301 https://$server_name$request_uri;  
}  

server {  
    listen 443 ssl;  
    server_name jellyfin.yourdomain.com;  

    ssl_certificate /etc/ssl/certs/your_ssl_certificate.crt;  
    ssl_certificate_key /etc/ssl/private/your_private_key.key;  
    ssl_protocols TLSv1.2 TLSv1.3;  
    ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384';  
    ssl_prefer_server_ciphers on;  
    ssl_session_cache shared:SSL:10m;  

    location / {  
        proxy_pass http://127.0.0.1:8096/;  
        proxy_http_version 1.1;  
        proxy_set_header Upgrade $http_upgrade;  
        proxy_set_header Connection 'upgrade';  
        proxy_set_header Host $host;  
        proxy_cache_bypass $http_upgrade;  
    }  

    access_log /var/log/nginx/jellyfin.yourdomain_access.log;  
    error_log /var/log/nginx/jellyfin.yourdomain_error.log;  
}  

It’s a bit tricky to search for tutorials these days… I got that from: https://linuxconfig.org/setting-up-nginx-reverse-proxy-server-on-debian-linux

Jellyfin would then take all requests addressed at jellyfin.yourdomain.com and forward that to your Jellyfin which hopefully runs on port 8096. You’d use a similar file like this for each service, just adapt them to the internal port and domain.

You can also have all of this on a single domain (and not sub-domains). That’d be the difference between “jellyfin.yourdomain.com” and “yourdomain.com/jellyfin”. That’s accomplished with one file with a single “server” block in it, but make it several “location” blocks within, like location /jellyfin

Alright, now that I wrote it down, it certainly requires some knowledge. If that’s too much and all the other people here recommend Caddy, maybe have a look at that as well. It seems to be packaged in Debian, too.

Edit: Oh yes, and you probably want to set up Letsencrypt so you connect securely to your services. The reverse proxy would be responsible for encryption.

Edit2: And many projects have descriptions in their documentation. Jellyfin has documentation on some major reverse proxies: https://jellyfin.org/docs/general/post-install/networking/advanced/nginx

You’d install one reverse proxy only and make that forward to the individual services. Popular choices include nginx, Caddy and Traefik. I always try to rely on packages from the repository. They’re maintained by your distribution and tied into your system. You might want to take a different approach if you use containers, though. I mean if you run everything in Docker, you might want to do the reverse proxy in Docker as well.

That one reverse proxy would get port 443 and 80. All services like Jellyfin, Immich… get random higher ports and your reverse proxy internally connects (and forwards) to those random ports. That’s the point of a reverse proxy, to make multiple distinct services available via just one and the same port.

Right. Do your testing. Nothing here is black and white only. And everyone has different requirements, and it’s also hard to get own requirements right.
Plus they even change over time. I’ve used Debian before with all the services configured myself, moved to YunoHost, to Docker containers, to NixOS, partially back to YunoHost over the time… It all depends on what you’re trying to accomplish, how much time you got to spare, what level of customizability you need… It’s all there for a reason. And there isn’t a perfect solution. At least in my opinion.

I think Alpine has a release cycle of 6 months. So it should be a better option if you want software from 6 months ago packaged and available. Debian does something like 2 years(?) so naturally it might have very old versions of software. On the flipside you don’t need to put in a lot of effort for 2 years.

I don’t think there is such a thing as a “standard” when it comes to Linux software. I mean Podman is developed by Red Hat. And Red Hat also does Fedora. But we’re not Apple here with a tight ecosystem. It’s likely going to run on a plethora of other Linux distros as well. And it’s not going to run better or worse just because of the company who made it…

Sure. I think we could construe an argument for both sides here. You’re looking for something stable and rock solid, which doesn’t break your stuff. I’d argue Debian does exactly that. It has long release cycles and doesn’t give you any big Podman update, so you don’t have to deal with a major release update. That’s kind of what you wanted. But at the same time you want the opposite of that, too. That’s just not something Debian can do.

It’s going to get better, though. With software that had been moving fast (like Podman?) you’re going to experience that. But the major changes are going to slow down while the project matures, and we’ll get Debian Trixie soon (which is already in hard freeze as of now) and that comes with Podman 5.4.2. It’ll be less of an issue in the future. At least with that package.

Question remains: Are you going to handle updates of your containers and base system better than, or worse than Debian… If you don’t handle security updates of the containers in a timely manner for all time to come, you might be off worse. If you keep at it, you’ll experience some benefits. Updates are now in your hands, with both downsides and benefits… You should be fine, though. Most projects do an alright job with their containers published on Docker Hub.

Yeah, I just occasionally like to push against using “Buy European” as a means of becoming nationalist ourselves. And content that could be read that way. I think we’re 100% on the same page.

I don’t think so. I’ve also started small. There are entire operating systems like YunoHost who forgo containers. All the packages in Debian are laid out to work like that. It’s really not an issue by any means.

And I’d say it’s questionable whether the benefits of containers apply to your situation. If you for example have a reverse proxy and do authentication there, all people need to do is break that single container and they’ll be granted access to all other containers behind that as well… If you mess up your database connection, it doesn’t really matter if it runs in a container or a user account / namespace. The “hacker” will gain access to all the data stored there in both cases. I really think a lot of the complexity and places to mess up are a level higher, and not something you’d tackle with your container approach. You still need the background knowledge. And containers help you with other things, less so with this.

I don’t want to talk you out of using containers. They do isolate stuff. And they’re easy to use. There isn’t really a downside. I just think your claim doesn’t hold up, because it’s too general. You just can’t say it that way.

But that’s very hypothetical. I’ve been running servers for more than a decade now and never ever had an unbootable server. Because that’s super unlikely. The services are contained in to several user accounts and they launch on top of the operating system. If they fail, that’s not really any issue for the server booting. In fact the webserver or any service shouldn’t even have permission to mess with the system. It’ll just give you a red line in systemctl and not start the service. And the package managers are very robust. You might end up with some conflicts if you really mess up and do silly things. But with most if them the system will still boot.

So containers are useful and have their benefits. But I think this is a non-issue.

That’s also my experience. There isn’t really any noticeable performance hit, even on modern SSDs. It should be the same amount of data coming from the SSD anyway, since the SSD isn’t even the part doing the cryptography (with LUKS), so it shouldn’t have any effect. And the CPU handles the decryption just fine

Well, in fact it can. That’s “overprovisioning”. The SSD has some amount of reserved space as replacement for bad cells, and maybe to speed things up. So if you overwrite 100% of what you’ve access to on the SSD, you’d still have X amount of data you didn’t catch. But loosely speaking you’re right. If you overwrite the entire SSD and not just files or one partition or something like that, you’d force it to replace most of the content.
I wouldn’t recommend it, though. There is secure erase, blkdiscard and some nvme format commands which do it the right way. And ‘dd’ is just a method that get’s it about right (though not 100%) in one specific case.

I feel your first paragraph is kind of the opposite of what I was trying to convey. I don’t want my own filter-bubble. In fact I really like being connected to American people, people in Asia and Oceania, maybe Africa…

And yes, there are a lot of ideas floating out there. The EU really doesn’t need to start building something from zero. The Fediverse for example is a nice idea.

I’m always a bit unsure about all the re-posting of memes and stuff. I sometimes feel like Lemmy isn’t about genuine connection, but more a place to dump news articles and things someone thinks is funny and they found somewhere else. Sometimes I think we should work on a bit more original content and genuine human conversation/debate. Maybe our own jokes, culture…

SSDs don’t store the data like HDDs, where you’d overwrite the same part on a magnetic platter. The controller on a SSD will instead handle it, do some magic and decide what to do. So if you use dd to replace some part with zeros, it might instead invalidate the old data, allocate new memory to you and not really overwrite anything. That’s why SSDs have separate commands for wiping content.

I’d say google for “ssd secure erase”:

• https://wiki.archlinux.org/title/Solid_state_drive/Memory_cell_clearing
• https://wiki.ubuntuusers.de/SSD/Secure-Erase/ (German language)

I think “digital sovereignty” is a better phrasing than “Europe need […] own […] platform”. It’s not the same. We don’t need nationalism and an own place… What we need is to emancipate ourselves and not be controlled by external big-tech companies. But I really like the internet for spanning across the globe and enabling me to talk to random people on other continents.

And I’d really question that the big-tech US platforms are “better” than the alternatives. Especially for cyber-security. Doesn’t she omit that we do regulation here in Europe, and American companies are free to sell all data and have other standards? While European companies have far higher standards with what they can collect, sell and even leak by accident? I think it’s the other way around. And I don’t think fragmentation per language is a big deal either. I know a lot of people who use Instagram etc and just speak German and no English. That doesn’t seem an issue for them. I think it’d be the same with an European-sponsored platform. They’d just not look at the French memes and that’s it.

I think I’ve been using Linux for something like 20 years now. And Free Software (in general) has given me a lot of useful tools and nice things. Though it felt a lot more like an adventure to me when I was young. It still sometimes does, but I don’t think I spend that much time distro hopping and messing with application software and games these days. And a lot of things got easier. I feel it has always been the best option for me. I know my way around, my computer works most of the times and I’m able to do stuff with it. Occasionally I’ll have a look at other people’s computers and fix their printers or little woes and I’m always glad I don’t use those kinds of operating systems on my machines… 😅