Good news, a security issue that was blocking the draft for the new DNS-PERSIST-01 challenge mode for TLS certificates has been resolved, meaning the challenge can resume moving forward.

Some background for those who aren't up to date:

• TLS challenges are how self-hosters and many other TLS certificate users prove who they are in order to automate cert renewals.
• The most popular challenge methods are HTTP-01 (which involves having a live web server answering on port 80 somewhere) and DNS-01 (which involves putting a key given by the TLS authority in your DNS zone in a TXT record temporarily).
• All the current challenges are conducted "live" and require active online participation on the part of the domain owner each time a cert is approaching expiration.
• The new DNS-PERSIST-01 challenge would let owners keep a proof in their DNS zone indefinitely (or with self-imposed expirations), eliminating the need for those online sessions.
• DNS-PERSIST-01 was slated to come out in Q2 this year at the latest and all the popular tools (ACME bots, reverse proxies etc.) have been chomping at the bit to implement it.
• Unfortunately there's been a security snag. Trying to do things the way DNS-01 did (record only the server-provided proof in DNS) would open DNS-PERSIST-01 to middleman attacks, because unlike DNS-01 where the proof is only there temporarily for a few seconds or a few minutes at the most, in this case the proof would be long-term.
• Hence issue #64, which has been trying to come up with a way to keep only a partial proof in DNS, and combine it with something issued by the server and something issued by the domain owner to make the whole proof, thus rendering the stuff stored in DNS impossible to use for malicious purposes, yet still sufficient for verifying ownership periodically.

Hopefully now that this hurdle has been passed things will proceed faster and we'll get to use this in the near future.

I'm working on a personal project and I'd like to add a feature where you can deny/allow access based on IP.

I'm not sure that the way I'm thinking about it is good enough.

The user would be able to specify multiple deny and allow ranges as IP[/CIDR] and then I would:

• Go through all the "deny" ranges and if any of them matches reject access.
• Go through all the "allow" ranges and if any of them matches permit access.
• If nothing matches the final decision is taken by a default fallback policy that can be set to allow or deny.

Would this be good enough or are there scenarios that can't be expressed this way?

PS: fwiw I did have a look at how other projects achieve this. Some let you define ranges and combine them with boolean logic in any manner, pseudo-programatically; that's a bit too complex for mine. Some let you draw up a list where order matters and the first matching range "wins"; I'm not sure if that's more capable than my way, and having order matter would complicate things for my code.

Appreciate any help. If you can link me to something that talks about this, that's good too.

Having fought for several days with this, I'd thought it would be worth sharing while it's still fresh in what's left of my mind:

Problem:

• OpenWRT router running latest available version (25.12) and Luci UI.
• IP cam that I want hardwired-only (Ethernet).
• Cam must have no access to internet or rest of LAN.
• Cam must only be accessed directly by the NVR software.
• Software (NVR and reverse proxy) run as docker containers on server PC.
• Any other LAN device (laptop, phone) must be able to access the NVR only via the reverse proxy.

Network topology:

• Cam is plugged physically in lan1 port on router.
• Server is plugged physically in lan3 port on router.
• The problem above basically means we need two tagged VLANs, one for regular LAN devices, and one just for NVR and camera.

Configuring the VLANs in OpenWRT:

Before anything else: try doing the next batch of configs from wireless if possible not Ethernet, in case you mess up and lose wired connectivity to the router.

• Go to Network > Interfaces > Devices and press "Configure" for the bridge that holds your router ports. This will typically be called "br-lan".
• Go to the "Bridge VLAN filtering" tab and check "enable Vlan filtering".
• Press the "Add" button twice to get two VLANs.
• First VLAN: set id=1, check "local", mark lan1=off (not member), lan2=untagged, lan3=tagged (also primary), lan4=untagged. You can use any ID but "1" is traditional for the base LAN network.
• Second VLAN: set id=100, check "local", mark lan1=untagged, lan2=off, lan3=tagged, lan4=off. Again, you can use any ID, but it's traditional to avoid numbers under 10 because they're typically used for core VLANs.
• Case in point, please note that my router has two physical NICs, one for LAN ports 1-4 and one for WAN, so I have a separate br-wan device just for wan. But some routers only have one physical NIC so they only have one bridge that covers both lan1-4 and wan ports. On these routers when you get to the filtering tab you will find two VLANs (1 and 2, typically) already set up. If this is the case add the VLAN 100 and modify VLAN 1 as above and mark wan as off in 100.
• After you press "save" you will notice two new virtual devices called "br-lan.1" and "br-lan.100" type VLAN 802.1q have appeared in the device list.
• Do not apply modifications yet. First go to Network > Interfaces, edit the "lan" interface and switch it from device "br-lan" to device "br-lan.1", otherwise you may lose connectivity to router if you're on Ethernet.
• If you've applied changes early and lose connectivity, don't panic, just wait. In recent OpenWRT versions after 90s without confirmation from the UI the router will automatically rollback the last changes.

If all went well and you're on wireless or one of the untagged Ethernet ports (lan2 or lan4) you should have retained connectivity to the router and wireless devices.

Configuring the NVR network in OpenWRT:

• Go to Network > Interfaces, click "Add new interface".
• Call it "NVR", protocol "static address", device "br-lan.100".
• Next, edit it and set up your desired IPv4 address and netmask.
• You MUST go to "firewall settings" and use the "custom" field to add a new "NVR" zone. alternatively you can go to Network > Fireall, create the NVR zone there, and choose it here.
• Enable DHCP if you want.
• If you do, please note that some routers bind dnsmasq only explicitly to select interfaces. Please check under Network > DHCP > dnsmasq > Devices & Ports and if "non-wildcard" is checked you will have to add "NVR" to the "Listen interfaces" to actually get DHCP services on that network.
• Under Network > Firewall you should have a zone called "NVR". Set input/output/forward to accept/accept/reject.
• Under Network > Firewall > Traffic rules you have to add a new rule, calld it "NVR DHCP", that says that protocol UDP, source zone "NVR", destination "device (input)", destination port 67, action "accept", and under advanced restrict address family to IPv4. Traffic rules have priority over zone configuration so DHCP will work no matter how you fuck up your zone access.
• We will be skipping DNS because we don't want the NVR network to benefit from any. But if we did we'd be doing the same we did for DHCP (got to Network > DNS to enable explicitly on NVR interface, and add a traffic rule for it).

Configuring the camera:

• Plug the camera into port lan1, it should pick up a DHCP address on the network you've defined for interface "NVR".
• In order to be able to access that IP from your regular LAN to configure the camera with your phone you'll have to temporarily add the "NVR" zone to the list of forward zonez of the "lan" zone.
• Would probably be a good idea to either configure the camera to a static IP or give it a static DHCP assignment based on the Ethernet MAC, so you know where to reach it from the NVR software.
• Remember to remove the "NVR" zone from the lan's zone forwards when you're done.

Configuring the server for tagged VLAN connectivity:

• Your server (port lan3) was marked for tagged VLAN connectivity in OpenWRT but it doesn't (yet) actually use tagged connections. We have to fix that or it won't be reachable.
• Feel free to mark lan3 as "untagged" on VLAN 1 to connect to it while you change the settings, but keep in mind that direct console access may be needed if you fuck up.
• My server runs Debian so configuration basically runs down to loading module 8021q (and adding it to /etc/modules just in case, although this should be largely automated), and editing /etc/network/interfaces. Feel free to adjust the example below to your needs:

# this will bring up eth0 but leave it unconfigured, merely as a support carrier for the VLANs 
auto eth0
iface eth0 inet manual

# this will set up VLAN ID 1 and tell it to use DHCP
auto eth0.1
iface eth0.1 inet dhcp

# this will set up VLAN ID 100 with a static address
auto eth0.100
iface eth0.100 inet static
	address 10.234.100.2/24

Configuring docker networks and containers:

• Remember I said the proxy and the NVR are running in docker containers. If you haven't done anything fancy with them before, you were probably using ports: to expose a port for the proxy and one for the NVR on the host's LAN IP, and pointing the proxy to the NVR.
• First, we will want to make an ipvlan or macvlan docker network that will use the eth0.100 interface. Containers that use this network will be placed in the NVR network/zone, and have their communications tagged with VLAN ID 100. Feel free to customize the network range. You can use either ipvlan or macvlan, the latter is not very useful since docker can't do DHCP. Note the use of aux-address to reserve the IP you've assigned the camera, in case there's potential overlap with the range you choose for automatic allocation. It's essential that you use the eth0.100 interface as parent.

docker network create --driver ipvlan \
--ip-range=10.234.100.97/27 --subnet=10.234.100.0/24 --gateway=10.234.100.1 \
--aux-address 'cam1=10.234.100.10' \
-o parent=eth0.100 nvr-vlan

• We also need a bridge network that will allow the proxy to see the NVR container, because once the NVR container is placed on the NVR network on the VLAN ID 100 it won't be reachable directly by the proxy.

docker network create --driver bridge \
--opt com.docker.network.bridge.name=br-docker-proxy \
--ipv4 --subnet=172.23.1.0/24 --gateway=172.23.1.1 \
proxy-bridge

• Next, in the NVR container compose, join both proxy-bridge and nvr-lan:

services:
  nvr:
    networks:
      nvr-vlan:
      proxy-bridge:
    hostname: nvr
networks:
  nvr-vlan:
    external: true
  proxy-bridge:
    external: true

• Also in the proxy container compose you will want to join the proxy-bridge network.
• Remove the ports: directive from the NVR container, it doesn't serve any purpose now. Containers on ipvlan/macvlan are reachable by their native port assignments on the networks they've joined.
• Please note the hostname: nvr in the NVR compose, that's the name you will have to use in the proxy configuration to reach the NVR. Docker will supply a DNS resolve for this automatically.
• The proxy doesn't need to be on nvr-vlan. I mean you can, but you need to keep the proxy accessible from the main network so it will keep using ports: as usual.

Bibliography:

• https://docs.docker.com/engine/network/drivers/ipvlan/#manually-create-8021q-links
• https://openwrt.org/docs/guide-user/network/vlan/switch_configuration
• https://openwrt.org/docs/guide-user/network/dsa/converting-to-dsa
• https://openwrt.org/docs/guide-user/network/dsa/dsa-mini-tutorial
• https://forum.openwrt.org/t/openwrt-vlan-tagging/208098
• https://computingforgeeks.com/how-to-configure-vlan-interface-on-debian/
• https://wiki.debian.org/NetworkConfiguration#Howto_use_vlan
• https://manpages.debian.org/trixie/ifupdown-ng-compat/interfaces.5.en.html
• https://deepwiki.com/openwrt/firewall4/6.1-zone-configuration
• https://deepwiki.com/openwrt/firewall4/7-rules-and-nat

I'm trying a new CPU in my PC (Ryzen 5500GT) and I'm seeing:

• Sporadic kernel panics during boot.
• Random .ko.zst module files (different one each boot) complaining that ZST decompression failed checksum.
• Random .so's failing to find a symbol and causing programs to crash/fail to start.
• Started a stress-ng sequential session at 5s per stressor and it hung up after a dozen stressors. Couldn't ctrl-c it and also ps didn't work anymore. 😅

Funny thing is, other than that the system runs fine (when it boots, that is).

Switched back to my old CPU (that's the only change in the machine) and all of these things stopped.

That CPU that's doing that is defective, correct? Just double-checking I'm not missing anything else.

I've reset BIOS between CPU swaps and left it at defaults. Could default settings cause a CPU to act like this?

Edit: cooling is good, all temps (chipset, CPU etc.) are in the 30's C in idle, CPU went up to 75C when stressed. Have a tower cooler (Scythe Kotetsu) with a 120mm fan.

I'm also adding some voltage readings I took from sensors while the problematic CPU was installed:

Vcore: 840mV
+3.3V: 3.31V
+12.0V: 12.10V
+5.0V: 5.01V
VSOC: 780mV
VDDP: 900mV
DRAM: 1.21V
3VSB: 3.29V
VBAT: 3.26V

It doesn't seem to be doing anything for me, even on large websites like YouTube or Amazon, it basically just copies the link as-is.

I took some photos at an event and I need to go through them and get rid of the bad ones (eyes closed, things in the shot, out of focus, blurred etc.) I'm not a pro photographer so no idea where to begin with photo apps. I've used RawTherapee and Gimp a bit.

What app will let me quickly browse the photos and handle (delete/tag) photo formats together (both the RAW and the JPG)?

I wanted to run my VPN/Tailscale setup past you, see if anybody has suggestions on how I could do things better.

• Setup: home LAN (10.0.0.0/24), router+DNS on 10.0.0.1, server running docker containers on 10.0.0.2.
• LAN DNS points *.local.dom.tld to the server, public DNS points *.dom.tld to my dynamic public IP.
• Containers run in bridge mode with host, expose ports on host IPs via "ports:" mapping.
• NPM with LE certs also in container, exposes 10.0.0.2:443, forwards to various other services.

Goals for Tailscale:

• Accessing HTTP services via NPM from my phone when away from home.
• Exposing select UDP and TCP non-HTTP services such as syncthing (:22000) or deluge RCP admin (:58846) to other tailnet devices or to phone on the go.

Goals in general:

• Some containers need to expose ports on the LAN.
• Some containers need to expose ports via Tailscale.
• Some containers need to broadcast on the LAN (DLNA stuff) – but I don't want them broadcasting to Tailscale.
• Generally speaking I'd like to explicitly control what's exposed from each container on either LAN or Tailscale.
• I'd like to avoid hacking images with Dockerfile. I can make my own images to do stuff, just don't want to keep up with hacking other images.

How I progresed with Tailscale:

1. First tried running it directly on the host. Good: tailnet IP (let's call it 100.64.0.2) available on the host's default network stack. Containers can use "ports:" to map to 100.64.0.2 (tailscale) and/or 10.0.0.2 (LAN). Bad: tailscale would mess with /etc/resolv.conf on host. Also bad: tailscale0 on host picked up stuff that binds to 0.0.0.0.
2. Moved tailscale to a container running on the host network stack (network_mode: host). Made it leave /etc/resolv.conf alone. tailscale0 on host stack still picks up everything on 0.0.0.0.

This is kinda where I'm stuck. I can make the tailscale container bridged which would put the tailscale0 interface inside the container. It wouldn't pick up 0.0.0.0 from host but how would I publish ports to it?

• The tailscale recommended way of doing it is by putting other containers in the tailscale's container network stack (network_mode: container:tailscale). This would prevent said containers from using "ports:" to map to host anymore. Also, everything they publish locally would end up on tailscale0 whether I like it or not.
• Tailscale has an env var TS_DEST_IP that can mirror another IP. I could allocate an IP on host eth0 like 10.1.1.1, mirror that from the tailscale container, and target it from other containers explicitly with "ports:" when I want to publish a port to tailscale. Downside: 10.1.1.1 would be in the host's network stack so still picks up 0.0.0.0.
• I could bridge the tailscale container with other containers on a private subnet, say 192.168.1.0/24 and use tailscale serve to forward specific ports to other containers over that subnet. Unfortunately serve is fairly limited; it can't do UDP and technically it refuses to forward TCP either to non-localhost (but you can dump the serve config to JSON, and hack that config, and use it with TS_SERVE_CONFIG= 🤮).
• I could bridge tailscale with other containers and create a special container with a fixed IP on that subnet, mirror the IP from tailscale, and use iptables on that container to forward specific ports to other containers. This would actually solve everything I want except...
• If I ever want to use another VPN which doesn't have the mirror feature. I don't know how I'd deal with that.

I'm posting this in selfhosted because Gandi increasing prices actually helped me a lot with being more serious about selfhosting, made me look into things like DNS and reverse proxies and VPN and docker and also ended up saving me money by re-evaluating my service needs.

For background, Gandi.net is a large and old (25 years) domain registrar and hosting provider in the EU, who after two successive rounds of being acquired by investment funds have hiked up prices across the board for all their services.

In July 2023 when they announced the changes for November I was using their services for pretty much everything because I manage domains for friends and family. That means a wide selection of domains registered with them (both TLDs and European ccTLDs), LAMP hosting, and was taking advantage of their free email hosting for multiple domains.

For the record I don't hold the price hike against them, it was just unsustainable for us. Their email prices (~5€/mailbox/mo) are in line with market prices and so are hosting prices. Their domain prices are however exaggerated (€25-30/yr is their lower price now). I also think they could've been smarter about email, they could've offered lower prices if you keep domains registered with them. [These prices include the VAT for my country btw. They will appear lower in USD.]

What I did:

Domains: looked into alternative registrars with decent prices, support for all the ccTLDs I needed, DNSSEC, enforced whois privacy, and representative services (some ccTLDs require a local contact). Went with INWX.com (Germany) and Netim.com (France). Saved about €70/yr. Could have saved more for .org/.net/.com domains with an American registrar but didn't want to spread too thin.

DNS: learned to use a dedicated DNS service, especially now that I was using multiple registrars since I didn't want to manage DNS in multiple places. Wanted something with support for DNSSEC and API. Went with deSEC.io (Germany) as main service and Bunny.net (Slovenia) as backup. deSEC is free, more on Bunny pricing below. Learned a lot about DNS in the process.

Email: having multiple low-volume mailboxes forced me to look into volume-based providers who charge for storage and emails sent/received not mailboxes. I've found Migadu (Swiss with servers in France at OVH), MXRoute (self-hosted in Texas) and PurelyMail (don't know). Fair warning, they're all 1-2 man operations. But their prices are amazing because you pay a flat fee per year and can have any number of domains and mailboxes instead of monthly fees for one mailbox at one domain. Saved €130/yr. Learned a lot about MX records and SPF/DKIM/DMARC.

Hosting: had a revelation that none of the webpages I was hosting actually needed live dynamic services (like PHP and MySQL). Those that were using a CMS like WordPress or PHP photo galleries could be self-hosted in docker containers because only one person was using each, and the static output hosted on a CDN. Enter Bunny.net, who also offer CDN and static storage services. For Europe and North America it costs 1 cent per GB with a $1 minimum/mo, so basically $12/yr since all websites are low traffic personal websites. Saved another €130/yr. Learned a lot about Docker, reverse proxies and self-hosting in general.

Keep in mind that I already had a decent PC for self-hosting, but at €330 saved per year I could've afforded buying a decent machine and some storage either way.

I think separating registrars, DNS, email and hosting was a good decision because it allows a lot of flexibility should any of them have any issues, price hikes etc.

It does complicate things if I should kick the bucket – compared to having everything in one place – which is something I'll have to consider. I've put together written details for now.

Any comments or questions are welcome. If there are others that have gone through similar migrations I'd be curious what you chose.

I'm thinking of putting all my email archive (55k messages, about 6 GB) on a private IMAP server but I'm wondering how to access it remotely when needed.

Obviously I'd need a webmail client but is there any that can deal with that amount of data and also be able to search through To, From, Subject and body efficiently?

I can also set up a standalone search engine of some sort (the messages are stored one per file in regular folders) but then how do I view the message once I locate it?

I can also expose the IMAP server itself and see if I can find a mobile app that fits the bill but I'd rather not do that. A webmail client would be much easier to reverse proxy and protect.

I've repurposed a 32 GB M.2 SATA SSD as a bootable "USB stick" and I'm putting useful tools on it. So far I've got memtest, seatools, gparted live, system rescue, clonezilla, and a live install iso of the distro installed on my PC. What other great bootable tools am I sleeping on?

I use multiple workspaces and I open text files all the time.

Once upon a time Mousepad used to behave sanely and would open them in a new tab if there was already an instance on the current workspace, or open a new window (on the current workspace) if there wasn't.

They broke that at some point. Now it's anybody's guess where the file will open. Maybe it opens in a tab in an existing window on this workspace. Maybe in a tab in a window on a random workspace. Maybe a new window on this workspace even though there's one open. I've given up trying to figure it out.

As a last resort I can use wmctrl to figure out how to open the files and can script a sane launcher myself – provided that the editor has --tab and --window options AND lets you specify the window instance. Mousepad has the former but not the latter.

So, do you know any editor that can do it by itself or has those options so I can do it myself? TIA

Hi, I'm trying to find the subtitles for Harmy's "Despecialized" Star Wars remakes and I was wondering if anybody has any ideas. The original website for Project Threepio points at a blog that seems abandoned and an old private tracker (MySpleen) that never opens to public anymore. Even just the English subs would be great (the original pack contained extensive language coverage in DVD format so I was given to understand it was quite large). TIA for any hints.