Some networks block Wireguard connections.

Dollars to doughnuts they’re blocking the default Wireguard port. Change your wireguard port to something like 8080 or 8443 and you’ll almost certainly make it through

CF tunnels to access generic apps I want public.

I totally could move everything that’s on CF tunnels over to Wireguard, but I see no need to do it

How would you keep the public apps public if you require a wireguard connection to access them?

Yes.

I use all three for different purposes.

It all depends on what my requirements for self hosting some are.

Tailscale has its use when you are behind CGNAT and don’t want to VPS a Wireguard server somewhere with a static IP, other than that, it has no use in my opinion. I’m fully aware that I get downvotes from people who praise the zero trust principals of Tailscale and all the rest, but they always forget that you can do zero trust since decades with any network equipment (VXLAN) and add Wireguard to the mix.

People just forget that all Tailscale is is a fancy GUI for managing Wireguard. That’s it.

Wireguard lacks a lot of user management features so you need a service like Tailscale to handle that, but everything zerotier does is something you can already do in wireguard, just simplified.

How do you access those services from a public network?

With Wireguard?

disabling password login and use pubkey authentication will be safe enough?

Just make sure you actually disable password login. Simply enabling key doesn’t disable password. So as long as the password is disabled then you’re fine.

This is probably the optimist in me saying this, but I don’t think the data is actually gone.

​

Its probably some misconfiguration that is locking people out of their data. That may not functionally be different but technically it’s majorly different. My guess is there will be some announcement made in a few days that they fixed a permissions error and everyone’s data is back.

There’s more than a decade worth of banking, spending, and investment information in there.

That’s the real reason I would self host something like a budget app. I don’t want a company like Mint to have (and sell) my purchasing and financial history.

“self hosted budget management app”. Can’t you just install this type of app to your phone or pc? What’s the purpose here, will you host it and access it from a browser? Or do you only want to backup its data to your server?

I don’t want some third party having access to all of my transaction history and knowing what I spend and where.

I hope I don’t sound stupid please enlighten me.

Your question isn’t stupid. There is an important decision you need to make on “is the juice worth the squeeze.” While you can selfhost a lot of stuff sometimes there’s better reasons not to. Email is primary example that gets brought up a lot. Sure you CAN self host it, but for a lot of people on this sub it’s not worth the effort required to do so.

Each person has to make that decision for each of the things they choose to self host. Budget apps are no different.

Same. I ran OwnCloud and Nextcloud in parallel for a while until a Nextcloud update nuked it and my wife lost some of her college work.

After that I’ve appreciated the slower more deliberate pace of OwnCloud

Would that be better than just mounting the NFS on the host and assigning that directory as the Immich upload directory?

So your vote is an external library

I do. I monitor it in a lot of ways.

1. IDS at the router
2. Anomoli Detection at the router
3. Host based agents on everything I can
4. L7 Firewalls on everything I can
5. DNS based monitoring for everything

Wireguard and Cloudflare Tunnels make network traffic monitoring difficult because it’s all encrypted traffic.

I don’t even let my friends have unrestricted access to my server because I don’t want the liability that could come with one of them searching for/downloading illegal content.

Sure I would technically fall under safe harbor laws but I don’t want to spend the money on court/lawyer fees to prove that I’m not that one downloading shit.

Cloudflare will host videos at $5 per 1000 minutes and an extra $1 per 1000 minutes watched per month.

https://www.cloudflare.com/products/cloudflare-stream/

That’s the only Cloudflare approved way to do videos and images through the proxy

Google Photos.

I pay $15 a month for unlimited storage.

Photos of my family are of the most important things to me so I’m paying out for guaranteed redundancy.

I still host a local photo storage version but I also backup everything to Google Photos.

Have you tried using a USB drive bay station with proxmox before?

I’m debating getting a 5 bay station, plugging it into my proxmox and passing the USB through to an OMV VM but I’m not sure if that will work.

In short cloudflare is both a DNS server and a reverse proxy. When you add a DNS record in there and mark it as proxy cloudflare will publish the DNS record but will instead give its own IP as the destination.

When a visitor enters your URL instead of getting your IP they will be given Cloudflare’s IP. The visitor will then send their web request to Cloudflare. Cloudflare will then send that request to your actual IP.

That’s the basic version. However, Cloudflare’s position as a proxy gives it the ability to inspect and act on traffic as a WAF, blocking traffic that meetings the IDS/IPS rules.

It all comes down to “what are you trying to do.”

Not everyone runs applications, so docker is not the answer to everything.

But if you only have 8Gb of RAM and are trying to run VMs then I’d advise you to go buy more RAM.

My wife and I each take a lot of random photos and screenshots and things we don’t want to share with each other (and we probably don’t want to be bothered with each other’s random stuff), so we don’t want to just do something like turn on Partner Sharing on Google Photos.

You can specify what gets shared with partner sharing. My wife and I have partner sharing set up so that it automatically shares photos of our kids with each other but not anything else.