That’s a clever approach, thanks for the explanation

Interesting, though what if the receiver fails to scan the codes quicly enough?

Me grabs a cable: “F*ck, it’s a charging only cable!”

Me grabs another cable: “F*ck, it’s USB 2 only!”

Me grabs another cable: “F*ck, the connection is dropping/flakey!”

Second that! It does have issues on Windows, but it’s Windows so what would you expect? And it doesn’t matter to the OP anyway.

How is crashing on an unhandled path in a security context not better?!

However, Vaultwarden only implements the webvault, the client apps are still only supplied by Bitwarden, which they could make incompatible with Vaultwarden at some point.

I’ve also seen some sites use POWBlock, though, don’t know anything about it.

WireGuard is stateless, so running it “on” 24/7 is cheap, set it up once for them and leave it on, ideally they wouldn’t notice a thing.

Proxmox VM snapshots and backups, plus proxsave I assume?

I actually did that. Or well, I was planning to upgrade the Debian version and instead of doing it in place I replaced the drive (kept the old around for a while just in case) and did a clean install. I didn’t make any new backups or moved configs or anything outside what I already had, the system was back to operations faily quickly. The main reason, I have a markdown file describing every configuration and recovery step needed to get a fresh system to a fully working state in case of a disaster, and my test showed that it worked great. It does take a bit of effort to keep it up-to-date, but as shown, really worth it, and it douples as a small wiki for accumulated knowledge. I do wish to play with Ansible at some point if I have the time, but this works for now.

Wouldn’t be surprised if the big guys got first dibs before everyone else

Synology had a critical system and PHP package update yesterday, could it be related 🤔

I mean, unattended upgrades has it’s own config file where you can specify when to schedule a reboot (when needed), which you’d usually do in off-hours like 2 AM your local time, so changing the Systemd unit activation time seems like the wrong fix.

Edit: Nevermind, your issue was that the daemons were being rebooted, not the whole system, if I understood that correctly

• Forgejo for private git repos, coz F GitHub (F as in paying respect obviously… :v)
• Portainer, though don’t use much as of late as I got used to the CLI
• qBittorrent for Linux ISOs. No, really, I use it to download Linux ISOs :v
• WireGuard, several instances, some for accessing specific services, one for accessing GeoIP blocked content when traveling
• Vaultwarden for managing passwords
• Home Assistant for managing a couple of sensors
• Nginx Proxy Manager for managing hosts
• TeamSpeak 6, just playing around with the beta for now
• Apache Subversion for private SVN repos
• A handmade C# service for storing some MQTT data into a database
• peaNUT a NUT dashboard for the UPS
• RustDesk for remote management of desktops

As for the hardware:

• A Raspberry pi 4 running Docker containers
• A Dell Wyse 5070 (16GB) running Proxmox with mainly Alpine Linux VMs

For frequently changing data hourly up to 24, daily up to 7, weekly upto 4, monthly up to 12.

For daily changing data daily up to 7 and etc. as above.

For seldom changing data a backup every 3 days with rotation based on a storage quota, and retention of manually held samples.

Did you read it to the end?

Without root user login, the attacker would have to guess not only the password to the user but also the username (hopefully it’s not something simple like admin), and once you are logged in you can use sudo -i to chage into root, which will require a password, therefore, we also disable password login so if someone does manage to somehow compromise the SSH user, they’d still need the password to become root.

You could spin a publicly exposed WireGuard daemon firewalled to allow peers access to the non-public SSH port only, which would result in double encryption, but would give you the peace of mind that an attacker would have to compromise both at the same time, which is very unlikely. Plus, WireGuard is very cheap to deploy and produces no logs. We use that model in my office to access our server.

Edit: Otherwise, as others mentioned, you’d move the SSH daemon to a random port, disable password login and weaker keys and cyphers, setup Fail2ban, and optionally setup GeoIP blocking (only allow IPs from your region to connect).

Not in the US, at work we pay 6 times the rate I pay at home for 1/6 the speed I get at home, everyone hates our office internet speed 😂, at least it’s static do we can host stuff

Either use a dynamic DNS service, as many others have mentioned and probably easiest, or, assuming you only want yourself to have access to the services, another option is to use something like Tailscale or a WireGuard/FRP instance in a static VPS as the rendezvous point.

I was flat out rejected by my ISP to have a static IP, though I only had it changed once since I started hosting services, so ahatever.