The only place that I use port 22, is my crowdsec pi. I use some other port than the traditional port for HA. I am slowly moving all my things out of the Apple ecosystem once I do I will setup some other blocking system for outgoing stuff, kinda like pihole but in reverse.
Would highly recommend using an alternative port other than the default one for HA and 22.
Are pi’s or other single board computers options for you? My home lab runs on a handful of pi’s a dying mac mini (I am looking at replacing the thing with a better computer) and a Flint 2, running OpenWRT. I have a Rock 5 or something like that but have never been able to figure it out.
A search engine that relies on the community to do the crawling.
I went the Flint 2 route, I do not currently need wifi 7 but I did flash it with vanilla Openwrt. With the clean vanilla OpenWRT I have added 2 VPNs, I am considering adding a third (one is personal, one is to show off to friends, and the third one will be for my off site back up). I have a poop load of vLANs (IoT stuff, home lab stuff, my personal stuff, guest stuff, child safe vLAN, Personal VPN vLAN, guest VPN vLAN). I have a bunch of wifi APs, (personal, guest, kiddo safe, IoT, and a few because I am an asshole and believe all them waves belongth to me!).
My plan was to host my own email server but this girl loves her hair and did not want to pull it all out, so I just continued on using a third party for that, this is why I got a firewall I controlled because I needed static IP addresses for email but I would recommend getting one if you are adding your own firewall just to by pass everything your ISP is doing, I have fibre but even when I had DSL my ISP had to keep their modem in there, port 1 is just a dumb switch that goes to my firewall.
Originally I had a VPN running on a pi zero 2 (do not do this it is not that great to do it), but now my Flint 2 takes care of it and I do not notice any slow downs when I am away from the LAN. As a Canadian my PM just recently said we are at war with the US, sure it is a trade war not a pew pew boom war but war non the less and as an ex-Apple fan girl I was already slowly moving my stuff away from Apple things and use a pi 4 for HA I have a pi 5 running a bunch of services including pihole, would highly recommend, I have another pi 5 running stuff, and a pi zero 2 running my secondary pihole. I would highly recommend pihole to anyone who is just starting home labbing or been at it for a while, there is some disagreement with people who use other ad blockers but I found pihole first and feel in love with it. You will be so glad to have a VPN with whatever ad blocker you choose (pihole). But getting a static IP is a good idea, sure there are hacks to get things working with things like duckdns.org, your own domain, or whatever else.
You mention hackers and bots, I have crowdsec running on my firewall with things going to all my other devices and a honey pot on my pi zero 2, but my suggestion is if you do not want to set up crowdsec and just rely on the firewall make sure you use strong passwords, I have vaultwarden for those, and change your ssh ports on your devices and while you are at it do not use anything in the 8080 port range.
I use easyDNS and they have a wild card option for their email, so I have a formula whenever I am signing up for something my email addresses are always nameofservice_funSaskathchewanwordplusthreerandomnumbers@reannlegge.ca. When I started this I was on hosthero and they use cpannel with no wildcard options you have to go in and create the email address before you use it. When I left hosthero, because they cost to much and are not the friendliest company to deal with I had something approaching 300 unique email addresses after 4 or 5 years because I did just not bother closing them after I continued using the free trial of whatever or just stopped the forwarding to my main email address or whatever email it needed to be sorted into.
Now I just have everything automatically go into junk mail unless it is something I need than I make the effort to log into their easyMAIL web thingy and sort where it should go. I have it set to delete things that are a week old (I think it could be a month?) so if I do not need it I do not need to worry about it and it will just go away on its own other things are sorted into folders and very few things are sent to my inbox.
I was never really a windows user, I grew up on Mac OS (Apple DOS, 7, 9, and X). I am stuck with an iPhone and an iPad because I do not have the money to replace them at the moment but as soon as there are no longer updates for them they are being stripped of most of the data, being put onto my IoT vLAN and being used as HA kiosks. I say so long to things as soon as updates are not being pushed because they become attack vectors. I have had my ID stolen once before, probably not because of out dated things but I want to limit the places bad actors can get to me (just know the process of making sure stuff doesn’t hurt you further is hell).
I have a Mac mini I am thinking of doing some actual work to get Debian installed on but I turned on the Mac just to get my iTunes purchased music off of it and than half assed an attempt to get refit installed and get Debian running, maybe some day I will get it working but that day is not now.
Yeah I know it was a very iffy time luckily it was only one night and morning. I broke the protection many times today but I am all wrapped up now.
As many have suggested immich is the answer I have tried a few others but immich is the answers.
What do you have against pihole? If it is you want to see ads you can turn off the adblocking and see ads but you can use it for internal dns naming for services with Caddy as I find it more reliable than just Caddy across multiple systems.
Fine tuning is a great thing to keep in mind, just like a bloated pihole lots of false positives and over looked spots.
I did not mean to through shade onto you this webui is a lot better than my ha vibe code.
I am using HA
Edit: after looking at what you posted I thought I would check it out, and it is a lot better than the HA thing I vibe coded into home assistant.
Why, use Redddit if you are in a self hosting community, I understand the community of curious people are there but are you really going to be selling yourself short like that? Than to be using discord as a self hosting community messanger?
Did not know, or care, they were still around.
I use wireguard for all that, it is self hosted and I do not have to have accounts elsewhere, once I have my OpenWRT up and running and my static IPs running to it I will move wireguard there. I have QR codes setup so that I can give people a taste of pihole for a short period of time when I am away from my LAN, of course when they are on my guest wifi they get pihole the whole time.
Just a side note for any 2FA I use vaultwarden.
I use wireguard so I wouldn’t know.
Cool I have different docker-compose.yml files for each service did not even think to put them in one.
Don’t be afraid to try one thing, it may lead to another, and another, to having your LAN changed forever.
I only really started getting deep into self hosting when the orange guy started threatening to make Canada the 51st state. So that is when I found immich, not sure how far I was into Lemmy when I found it but I have no complaints.
I heard that recently reddit decided to shoot themselves in the foot, people needing to pay at minimum $10 000 a month or something like that for bots to do the scrapping or something like that. It is a big Fuck you to mods of the groups and small creators looking for news. Capitalism is a horrible thing, they are not making enough money from advertisments hopefully because people where leaving to Lemmy, I do not know but a girl can dream.
I am curious as to how much the Mods are being paid to offer this stuff, what self respecting selfhoster would want a licenses to anything? Especially those three things, there are FOSS alternatives to all three.
Why would you use paid for Adguard; it is good for some devices and even at that it is not good for the whole device, you can use Adguard Home or my choice Pi-Hole where you are doing a whole LAN ad blocker. You can even set up a VPN or two and use the pihole away from your LAN.
I was unaware of what PhotoPrism was so I went and looked, and thought ok it is like immich but you pay for it?
Why would any self respecting homelabber pay for Emby, all they are doing is trying to get money out of you when Jellyfin is right there mocking the other paid for home lab video streamers like Plex and Emby when their prices go up.