What happens if the NAS dies though? What does recovery look like?
Is it possible to recover the data from the drives without Synology’s OS? If so what is that process and how difficult is it to do correctly?
I know that with ZFS, recovery is independent of vendor OS and/or hardware, so if the hardware dies you can just throw the drives into any COTS system with enough ports, but I’m genuinely unsure if that is the case for Synology or not.
ZFS, btrfs, and other software RAID solutions can use mixed drives w/o much issue as long as you make sure that the capacities match or that you set the array up with the smallest disk size in mind.
Do not use hardware raid controllers. They provide no meaningful performance benefit over software raid and make data recovery much more difficultm(if not impossible) in the event of hardware failure.
RSA4096 has a bit of an edge over ed25519 both in effective key size as well as support by things like YubiKeys and other HSMs that is beneficial for GPG but not really helpful for SSH.
SSH generally best to use ed25519, for GPG RSA4096 is better supported by HSMs and slightly more secure for longer-lived keys like root keys.
https://git.mlaga97.space/mlaga97/persistent-live-docker-flake has a builder for a live disk that will mount /dev/sda as ext4 to /persistent, and then start up dockge and whatever containers are present from the previous boot automagically.
OCI as in Open Container Initiative.
I’ve done something extremely similar with a custom NixOS iso for my docker VMs to make versioning and backups easier (golden image live disk with SSH+Docker+Dockge shared between all VMs + local persistent storage specific to each VM).
You can configure frigate via OCI container with custom config, as well as NFS mounts, SSH server, etc and then have a read-only live disk that boots up, mounts NFS share, and then starts up frigate.
Yeah, I used Chrome up until extremely recently because genuinely no browser Just Works to the extent Chrome does.
Fast, good media codec support, Web API support for hardware access for PWAs, doesn’t lock up w/ a lot of tabs (post-quantum FF is better about this, but not quite there), excellent DevTools, and just generally snappier and more polished than even chromium.
I switched to firefox recently exclusively for better home-manager support, and other than the ability to use home-manager more easily, it’s just a slightly slower and jankier experience at all times whether it’s requiring transcode for Jellyfin, laggy WebGL performance, janky DevTools, or missing WebAPIs.
looking to eventually drop it for Dendrite
Plain old docker compose since it seems to come with by far the fewest surprises and is most widely supported.
Nearly every project of interest has a compose.yml available, which is hardly true for systemd services, nix services, or for podman/kubernetes.
I was using podman-compose briefly, but it is just different enough to break in unclear ways and I kept having to fight with it so I went back to docker docker to eliminate the headache.
“What is your favorite self-hosted application?” had what looks to be about 15 matrix responses.
Would potentially be interesting to see Matrix/XMPP/etc prevalence in future surveys, maybe replacing ‘what activitypub apps’ with a more generic ‘what federated apps do you self-host’
pass-otp
I think shared hosting there is more meant to refer to the older “upload your files in webmin and we’ll shove them in /cgi-bin/ with everybody else’s”-style hosting where multiple users sites are running on a single instance of a webserver versus a VPS giving you a VM with SSH access?
Where the metadata goes I think is important as well.
All Signal metadata necessarily goes through Signal’s servers and is tied to your phone number, but not all Matrix metadata ever gets near the Matrix.org if you are using a different homeserver.
I think both are less than ideal in that regard, and I think Briar (strictly P2P) has a much better model for dealing with this at the expense of generally being a UX disaster.
The server software appears to be available and updated now, which they’ve been spotty about in the past. I’ve updated to remove the closed-source part since that is not correct.
As for phone number: Signal still requires me to enter a phone number to create an account as of about 5 minutes ago.
Signal is centralized, closed-source, not-selfhostable (edit: in any meaningful way) and requires being attached to a phone number. (Edit: server source is available, but self-hosting requires recompiling and distributing a custom app to all of your contacts to actually use it.)
Matrix is decentralized, federated, fully open source with multiple client and server implementations, self-hostable, and does not require being attached to a phone number.
What part were you getting hung up on?
Used Ubuntu for ~15 years, switched to NixOS a couple months ago and haven’t looked back.
I’ve made a habit of clean installing all of the desktops/laptops/servers in my life on the first point release of each LTS (i.e. 22.04.1). That would mean there was time for the dust to settle and for me to tweak my install/customization scripts from the previous LTS.
So since I knew I was gonna have to modify my Ubuntu install scripts to work with 24.04 anyways, I fiigured it was a decent time to try and see if I could get the install scripts converted to a nix config instead, and it ended up working a treat.
If you are dead set on a specifically certificate-backed access control scheme, a VPN with the ability to use the hardware-backed certificate store (such as OpenVPN) is likely easier to set up as it is better supported on mobile devices and doesn’t require application-level support (i.e. everything is protected, not just the apps w/ mTLS support)
https://openvpn.net/faq/how-do-i-use-a-client-certificate-and-private-key-from-the-android-keychain/
I do find rclone to be a bit more comprehensible for that purpose, rsync always makes me feel like I’m in https://xkcd.com/1168/
If zstd is available, it is a lot more efficient and performant over gzip.