No offense taken. With AI-generated texts becoming ever more pervasive, you’re right to be suspicious. 👍 I get that the bullet-point-ish style of my OP gives people ChatGPT vibes. 🤖

I could give you a run-down of ten tell-tale signs of AI writing style if you like. 🔎

Early voters are reporting some hijinks when selecting their choice so be VERY CAREFUL about confirming who you are voting for.

Like so?

I know of these famed Nvidia driver problems, but they’re

a) not exclusive to Ubuntu; Nvidia is the party fucking up here, so they’re rumoured to be unstable throughout all distros and
b) I’ve been running Debian-/Ubuntu-based Linux distros w/ Nvidia’s proprietary drivers for about 10 years now, and I haven’t come across a single issue with it in all that time.

So. Well. That’s anecdotal evidence against anecdotal evidence, I guess.

I’m not an LLM and I don’t use any for writing my postings, if that’s what you’re getting at. ;)

If you want a good first Linux experience, stick with anything Ubuntu-/Debian-based; they are

• stable workhorses, i.e. they don’t break on you as easily as rolling release distros like CachyOS.
• wildly popular, i.e. you’ll find plenty of resources to help you get started (although, to be fair, the Arch wiki is also ridiculously detailed).

Whatever you do, steer clear of immutable distros like Bazzite for now. As cool as the concept is (I run Bazzite on my gaming machine) - as soon as you do something “non-standard” (and modding your Minecraft .jar with Optifine already qualifies as such), you’ll have to fiddle with the terminal and distrobox containers, both of which will be alien concepts for you at the start and may be top much to make it a good first impression.

Feel free to elaborate. ;) I don’t mind ditching folders. The question is: how do I get at said metadata with the least amount of manual effort, how do I make sure that it’s accurate (sifting through thousands of files is not fun), and how is the metadata stored - particularly so that does not lock me into one application that can only understand its own metadata scheme, and once it dies or I want to switch to a different one, I lose all the work I’ve put into curating my collection. That’s why I was considering folders as an option: they are a software-agnostic way of organising my library.

That sounds reasonable. So you’re essentially throwing everything into one folder and let software do the rest? May I ask what software you’re using, and how it stores your tags? Does it use metadata files or a database?

Lemmy put it like this: free courses in self-defence are cool and all. But do they really have to be organised by the town’s serial sex offender?

I’ve got your exact setup:

• running immich (and other services with valuable data) at home (on OMV!)
• backup server at family member’s house
• regular backups from here to there through Wireguard tunnel with Borgbackup

AMA!

I don’t want a compromised device on the family member’s network to compromise mine

If with “mine” you mean the pi Zero, I wouldn’t worry too much about that. Just configure the pi’s firewall to drop all traffic from the LAN (they have no business with this device anyway), except any incoming traffic from the router on the Wireguard port.

Ah! I use virt-manager + qemu on desktop Linux, mainly to try things and and contain dodgy software (Windows). I didn’t know it was commonly used on headless servers. Thanks for pointing that out!

and one day apps that destroy these things!

Call me old-school, but I prefer doing this manually. Literally.

equilibrium with Christian Bale which is basically just fahrenheit 451

That’s an odd way of spelling “poorly-crafted ripoff with pointless gun-fu action scenes crammed into it”, but OK.

Thanks for your detailed reply and expertise! I really appreciate it!

First question you have to ask yourself is so what?

You’re right to call out my lack of threat modeling. I am aware that the “cost” of what I’m planning here likely outweighs the actual risks. That’s a deliberate choice though: one of my objectives in homelabbing is to “learn how the big guys do it”, i.e. learning and implementing, bit by bit, networking and security best practices.

That said,

• all of my drives are (LUKS) encrypted (although this will only help against evil maid attacks physically stealing my disks, since data is only encrypted at rest, not while the server is in operation)
• I do have some CPU monitoring in place
• I have applied the principle of least privilege (as far as I can see at least)
• I have set up an off-site backup server running (although I need to improve automation and deduplication; I’ll probably go with Borg here)

Thank you also for pointing me towards OWASP Docker cheat sheet! I didn’t know this resource yet, although I seem to have found others that said the same thing. I already have in place:

• no docker socket exposed to services
• user set for every service that didn’t give me a headache doing that (some assume root and won’t accept setting a user)
• username remapping is active
• all containers have their caps dropped and selectively only put those back in which they need
• I expose almost no container ports, and only those necessary; instead, communication with the containers is handled on my reverse proxy’s network (i.e. via the internal docker network)
• privilege escalation is disabled

I have played around with rootless docker (again, stubborn containers assuming root prevented me from going all-in) and considered Podman, although just putting containers in a VM looks like a more frictionless route to me.

All things considered, your advice seems to be:

1. to first consider whether I actually need all this security. I really don’t, yet I want to learn how to set it up anyway.
2. to first explore and all other hardening avenues. I have, to a certain degree, and beyond that run into brick walls.

If I might exhaust a little more of your time, I’d be curious how you judge the next step I’ve suggested: splitting duties between separate servers, thus segmenting public from private physically, or going the virtual route (again, by splitting into a public and a private VM and separate them through strict software firewalling).

Thanks for your input. It is correct that a lot of ISPs/consumer grade hardware is poorly maintained. Mine is a rare exception, however: I’m running an AVM FritzBox, which are somewhat famous for still receiving updates even after 10+ years on the market. They have only recently pushed a security update my way, so I’m good enough on that front - for now.

I shall consider a firewall in the future though.

I hope part of your hardening SSH is changing the port number!

I used to do that, but then realised that doing so will do very little. Scanning all possible ports is a matter of seconds, and SSH (unlike Wireguard) will signal to a potential attacker that it’s listening on port X instead of just remaining silent. In other words: in my eyes, it’s security by obscurity and will have very little effect.

What I have done to harden SSH is:

• set up pubkey authentication and disable password authentication
• disable root login
• not expose my SSH port publicly; it is accessible only from my LAN and through Wireguard

I have also tried out IP whitelisting (which may harden my setup against attacks from the LAN), but found it may be overkill for now. I might turn it back on just for shits and giggles.

This sounds a lot like my second option, except yours is a little more custom-made. What do you use to set up and run your VMs?

I wouldn’t stress to much. Your risk level is probably very low.

I’m not, no worries! :) You are correct to say that what I’m trying to do is likely above my threat model. Yet, I’m also in this for the learning experience, which includes picking up best practices and networking/security concepts that go a little bit above what I actually need.

Also…

Moving laterally requires a human (or agent these days)

you’re bringing up the emerging threat of agentic attacks that allows for automating lateral movement. While infiltrating some rando’s network probably doesn’t warrant burning through several thousands of expensive tokens now, odds are this cost will decrease over time, thus increasing the likelihood of opportunistic automated attacks. If and when that happens, I’d like to be prepared.

I’ve done my research on that, and apparently LXCs share the host kernel, meaning: if the LXC is compromised, so is the host system. So if I go with Proxmox, I’ll probably swallow the (somewhat) larger overhead of running a full VM.

Your post sounds like you’re honestly surprised. I wonder why though. Facebook/Meta has played a major role in a genocide, was involved in several election manipulation operations and had more scandals involving privacy violation, abuse of data and lying to lawmakers’ faces than I could possibly link to.

What’s missing from this report is more detail on how exactly this attack went down. Did the attackers compromise supermarket networks and manipulate the fridges through lateral movement within the network; or were the fridges accessible from the open internet? If the latter is the case (and there’s a non-zero likelihood they were): why the fuck?