If you're worried about that possibility, then you should mitigate against it. I'm not saying everybody should do it... all I'm saying is that rejecting the idea out of hand is not necessary.
I don't feel like I'm risking anything... I feel like I have an understanding of the attack vectors and I've mitigated those to a level that's acceptable to me.
Risk tolerance is something we all have to judge for ourselves.
Yup... HUGE difference between human curated machine learning and generative AI. AI sure is a buzzword these days, which is why it gets used in marketing, but I think doing so is confusing people who don't know enough to distinguish between the different flavors of "AI".
I actually started on a VPS... I moved off because I was pegging the RAM and adding more to my plan was quite expensive. Performance is MUCH better on my home server with plenty of RAM.
The point of the reverse proxy is that it simplifies your firewall configuration... you open one port (443) to one endpoint (your reverse proxy), and that's it. The more complex your firewall configuration, the more likely you are to get something wrong and accidentally expose what you might not want to expose.
I do not use my reverse proxy for access control.
If you're using containerized applications, then the worst-case scenario is somebody gets root permissions inside the container. Under those circumstances, they can destroy that instance of your application and access any data stored within the container. The thing is, they can ALSO do that if you're on a VPS.
If there happens to be a Docker vulnerability that allows file system access to the host AND AT THE SAME TIME an application vulnerability, then you might be in trouble. The confluence of those two events, especially if you keep things updated, is unlikely enough that I have no reservations about hosting public services on my home network.
But that said... we all have our own level of risk tolerance. If it's not right for you, then you shouldn't do it.
edit: just reading up on huntarr and ooooh boy. Vibe coded app that asked you to provide API keys so it could talk to and control other services. No wonder it caused problems. It's probably worth saying out loud: if the container you want to install is used to talk to and control other containers, you need to be EXTRA SURE that it's reputable.
I don't know enough about Apache to say one way or the other, but based on what you described, you SHOULD be able to get rid of the internal proxy. Since both the inner and outer are both NGINX, getting the settings right shouldn't be a problem.
Not sure what your solution was, but I eliminated the reverse proxy from the official compose stack and configured my existing reverse proxy to point directly at the lemmy containers. It works well for me.
I don't get this perspective. A reverse proxy pointing at containerized applications gives you plenty of buffer between the scary internet and your personal files. Don't bind mount your entire host file system to the container, and only open/forward the ports you need.
There are things you have to get right, but there's no reason to discard the idea altogether.
I find myself commenting three questions on any post about a new application somebody developed.
What is your experience in [subject matter of app]?
What is your experience in software development?
What percentage of the code for this app was written by AI? What percent was written by you?
Personally, I wouldn't mind if all new app posts were required to answer these questions for their post. It doesn't discriminate, it just asks them to lay their cards on the table for everyone to see. The community can judge from there.
I'm still on 7.2 myself, and I don't intend to switch to internal boot. However, I keep an eye on the Unraid subreddit, and from what I've seen there internal boot is working well for most people that have switched.
I would maybe review any posts on the Unraid forum before proceeding.
I've got no moral qualms about the way I'm handling things, nor am I judging anybody for the way they handle things. My comment was simply meant to show that not everybody is using Plex for stolen media.
I guess that depends on your definition of "piracy"... is it "breaking the law" or is it "stealing"?
In any case, the point I was making is that some people use Plex with non-stolen media. I mostly see assumptions that it's only used for stolen media, so I wanted to offer a counter-example.
I won't make any claims about other users, but I am using Plex for 100% legally obtained media, mostly by means of ripping physical media that I still have on my shelf.
So, not everybody is using it for pirated content.
This is not an apples to apples comparison because Nextcloud has security built in... it was designed to be published securely on the internet.
That's not to say Nextcloud is perfect and without security concerns, but it's miles ahead of Jellyfin which is Not designed to be published to the web.
I appreciate you putting it this way. There IS a battle happening to be sure.
Unfortunately, it feels like the battle that's being fought is between former Plex users and current (continuing) Plex users. It's frustrating as a continuing Plex user to feel like we are making all of the Jellyfin users angry just by existing. Some of us feel like explaining why our choice is rational, but that is often met with more hostility.
My hope is that we all (as self-hosters) can recognize that we all have different priorities and those priorities will lead to different choices. It's not wrong to leave Plex for something else. It's also not wrong to keep using Plex if it suits your needs.
(to be clear, I'm not at all implying that you were being hostile. This is just a general impression I get from several self-hosting communities when it comes to Plex versus other options)
I think they would be more popular in the US if they worked as quickly here. I have one, but it takes about 4 minutes to heat 2 cups to boiling. It's still worth it to me, but it's not much faster than the stovetop for us.
There's something about the electric service in the UK that allows electric kettles to heat much faster there.
Welcome fellow instance owner!
If you're worried about that possibility, then you should mitigate against it. I'm not saying everybody should do it... all I'm saying is that rejecting the idea out of hand is not necessary.
I don't feel like I'm risking anything... I feel like I have an understanding of the attack vectors and I've mitigated those to a level that's acceptable to me.
Risk tolerance is something we all have to judge for ourselves.
Yup... HUGE difference between human curated machine learning and generative AI. AI sure is a buzzword these days, which is why it gets used in marketing, but I think doing so is confusing people who don't know enough to distinguish between the different flavors of "AI".
I actually started on a VPS... I moved off because I was pegging the RAM and adding more to my plan was quite expensive. Performance is MUCH better on my home server with plenty of RAM.
The point of the reverse proxy is that it simplifies your firewall configuration... you open one port (443) to one endpoint (your reverse proxy), and that's it. The more complex your firewall configuration, the more likely you are to get something wrong and accidentally expose what you might not want to expose.
I do not use my reverse proxy for access control.
If you're using containerized applications, then the worst-case scenario is somebody gets root permissions inside the container. Under those circumstances, they can destroy that instance of your application and access any data stored within the container. The thing is, they can ALSO do that if you're on a VPS.
If there happens to be a Docker vulnerability that allows file system access to the host AND AT THE SAME TIME an application vulnerability, then you might be in trouble. The confluence of those two events, especially if you keep things updated, is unlikely enough that I have no reservations about hosting public services on my home network.
But that said... we all have our own level of risk tolerance. If it's not right for you, then you shouldn't do it.
edit: just reading up on huntarr and ooooh boy. Vibe coded app that asked you to provide API keys so it could talk to and control other services. No wonder it caused problems. It's probably worth saying out loud: if the container you want to install is used to talk to and control other containers, you need to be EXTRA SURE that it's reputable.
I don't know enough about Apache to say one way or the other, but based on what you described, you SHOULD be able to get rid of the internal proxy. Since both the inner and outer are both NGINX, getting the settings right shouldn't be a problem.
But, on the other hand, if it works it works!
Not sure what your solution was, but I eliminated the reverse proxy from the official compose stack and configured my existing reverse proxy to point directly at the lemmy containers. It works well for me.
I don't get this perspective. A reverse proxy pointing at containerized applications gives you plenty of buffer between the scary internet and your personal files. Don't bind mount your entire host file system to the container, and only open/forward the ports you need.
There are things you have to get right, but there's no reason to discard the idea altogether.
I find myself commenting three questions on any post about a new application somebody developed.
Personally, I wouldn't mind if all new app posts were required to answer these questions for their post. It doesn't discriminate, it just asks them to lay their cards on the table for everyone to see. The community can judge from there.
I'm still on 7.2 myself, and I don't intend to switch to internal boot. However, I keep an eye on the Unraid subreddit, and from what I've seen there internal boot is working well for most people that have switched. I would maybe review any posts on the Unraid forum before proceeding.
I've got no moral qualms about the way I'm handling things, nor am I judging anybody for the way they handle things. My comment was simply meant to show that not everybody is using Plex for stolen media.
I guess that depends on your definition of "piracy"... is it "breaking the law" or is it "stealing"?
In any case, the point I was making is that some people use Plex with non-stolen media. I mostly see assumptions that it's only used for stolen media, so I wanted to offer a counter-example.
Not sure if you're implying that I torrent my media... but just to be clear I don't torrent.
I won't make any claims about other users, but I am using Plex for 100% legally obtained media, mostly by means of ripping physical media that I still have on my shelf. So, not everybody is using it for pirated content.
This is not an apples to apples comparison because Nextcloud has security built in... it was designed to be published securely on the internet.
That's not to say Nextcloud is perfect and without security concerns, but it's miles ahead of Jellyfin which is Not designed to be published to the web.
Gotcha... Yes, Plexamp does this as well:
Can you explain rolling cache? I'm pretty sure plexamp does this, but maybe I'm misunderstanding what you're referring to.
I appreciate you putting it this way. There IS a battle happening to be sure.
Unfortunately, it feels like the battle that's being fought is between former Plex users and current (continuing) Plex users. It's frustrating as a continuing Plex user to feel like we are making all of the Jellyfin users angry just by existing. Some of us feel like explaining why our choice is rational, but that is often met with more hostility.
My hope is that we all (as self-hosters) can recognize that we all have different priorities and those priorities will lead to different choices. It's not wrong to leave Plex for something else. It's also not wrong to keep using Plex if it suits your needs.
(to be clear, I'm not at all implying that you were being hostile. This is just a general impression I get from several self-hosting communities when it comes to Plex versus other options)
I think they would be more popular in the US if they worked as quickly here. I have one, but it takes about 4 minutes to heat 2 cups to boiling. It's still worth it to me, but it's not much faster than the stovetop for us. There's something about the electric service in the UK that allows electric kettles to heat much faster there.