I’d say start on Ubuntu too. I actually kind of hate it, but it’s was my second or third Linux distro and was stable enough to jump into it, learn stuff then form an opinion about what I want in a distro and move on.

I think a lot of people get hung up on this — for basic use, a lot of distros offer more or less the same things. It’s when you start to drill into the lower level stuff (that you’re probably not now concerned with) that you become pickier with distros.

I think the part you’re missing (and others haven’t addressed) is that you don’t send 100% of your traffic to one endpoint (much like how most use VPNs). You can route different things to different places.

For example, I’m in the US and have two Tailscale exit nodes. Both are located on VPS machines in the US, but one sends traffic down a double-hop VPN back out into the US, the other does the same but to Switzerland. My “default” route is through Switzerland (better privacy laws) but I am forced to route some things through the US exit node due to websites that won’t work outside the US. For my personal devices, traffic routes directly to them via WireGuard tunnels.

In addition, my wife doesn’t care about blocking everything that I do (social media, tracking) but her phone still needs to update sensors in Home Assistant. She can choose not to use the exit nodes but can still communicate with our nodes on Tailscale. She also uses it to print documents at home from her laptop while she’s at work.

Recently I was waiting in a hospital with public (unsafe) WiFi that blocked UDP traffic, but Tailscale does some magic that will relay traffic via TLS. I was able to access services at home with a 20ms latency. The tech is very, very nice to have.

I only have experience trying to run two Tailscale containers on the same machine and hit so many roadblocks that running it containerized just wasn’t worth it.

Containerizing is probably only worth it if you have an explicit need for it.

Yikes, however you may feel about GNOME don’t set the bar so low.

Uh… pretty much everyone is except for end-users. Even then we’ve got Android and other Linux-based phone operating systems, and let’s not forget that Apple devices are UNIX-based (which in my mind is way different than Linux, but c’mon, it’s essentially the same concept in the end with tons of varying compatibility between the two).

“21 Ways Your iPhone is Spying on You” and it’s always dumb stuff like shady apps asking for permissions mouth breathers are stupid enough to allow. Then their website has 14 trillion tracking scripts loaded up; hypocrites.

Yeah, this is pretty stupid. “Oh no! The cops use CarPlay??” and “omg they developed an iOS app, the horror!”

Was this due to DMARC/DKIM, SPF or something else?

As a Ruby developer it concerns me that Webrick is “system software.” We don’t really even use that in production…

To add to this, I’d personally just clone the card immediately to somewhere else then do all the recovery efforts on the clone; if only to avoid burning out the SD card even more during recovery.

Edit: Not sure if that would be better or worse.

If you’re just looking for WireGuard with some good support for hostile networks (and easier configuration) I’d probably just recommend Tailscale.

The problem is I need Unbound to send queries via one network interface (the VPN) while the specific zone needs to be routed through another.

I know what split tunneling is, but I have my routing set up exactly as I’d like.

The issue here is that Unbound seems unable to send queries to one forwarding zone using a specific interface/IP address and sending queries to a second forwarding zone using a completely different interface/IP address.

I’m almost at the point where I want to create a virtual interface that just has rules that say “if going to 192.168.143.1 use /dev/tailscale0” and then have a default route to /dev/wg0.

I’m not a professional but my current Tailscale + VPN setup has been extremely nice for the past year.

Plain HTTP means anyone between you and the server can see those credentials and gain access.

It it using HTTP Basic Auth by chance? It would be so easy to put nginx (or some other reverse proxy with TLS) in front and just pass the authentication headers.

Especially with music, if any of this is plain HTTP (or any other plaintext, non-encrypted protocol) and you live in a lawsuit happy jurisdiction you might end up with piracy letters in the mail.

I’m thinking of building my own and having it use Paperless’ API for invoices, receipts, etc.

I finally gave this a go a few days ago but wasn’t in love with the UI. I’d contribute but it’s written in .NET.

I’ll probably build something myself. One thing I’d like to do is have it integrate with other APIs (like Paperless).

I’d curl from a machine on the same WiFi network as the phones just to confirm that HTTP is working. That way you’re not dependent on browsers that can be more finicky for debugging.

I’ve noticed that but I thought I just didn’t know how to persist it correctly and never bothered to find out how. If what you’re saying is accurate (which I don’t doubt) that sucks.