I was having some issues with Invidious the other day, which I resolved. However, I came across this tidbit of info that I'd never seen before when I first deployed it:

Post-install configuration:

Highly recommended

Because of various issues, Invidious must be restarted often, at least once a day, ideally every hour.

https://docs.invidious.io/installation/#windows

Anyone else observing this weird restart schedule?

Recently, I saw icanhazip.com pop up in my pFsense firewall logs. It was immediately blocked but the name piqued my interest, so I did a little digging which revealed an interesting backstory.

It's owned by Cloudflare:

spoiler

spoiler

...but it hasn't always been theirs: icanhazip: How a simple IP address tool survived a deluge of users. Pretty interesting, at least to me as I have never encountered it before.

I have it still blocked as nothing I'm doing seems hampered by blocking icanhazip.com's ip range. Anyone else ever encounter icanhazip.com?

I think I found the source of the icanhazip.com block. From the Github Issues page:

2025-03-27 17:00:02] production.ERROR: Failed to fetch external IP address. [“cURL error 60: SSL: no alternative certificate subject name matches target hostname ‘icanhazip.com’ (see https://curl.haxx.se/libcurl/c/libcurl-errors.html) for https://icanhazip.com/%E2%80%9D]

ETA: Solved

I think I found the source of the icanhazip.com block. From the Github Issues page:

2025-03-27 17:00:02] production.ERROR: Failed to fetch external IP address. [“cURL error 60: SSL: no alternative certificate subject name matches target hostname ‘icanhazip.com’ (see https://curl.haxx.se/libcurl/c/libcurl-errors.html) for https://icanhazip.com/%E2%80%9D]

AI DISCLAIMER: Yes I used AI in addition to a host of website resources to create this. If down voting 'AI anything' makes you feel better, then by all means do so.

PURPOSE:

• To display a 'Song Of The Day' in MOTD whenever I log in via SSH.

WHY:

• First, I wanted to see if I could actually pull it off. I've been tinkering around with basic Python and some bash scripting again, ever since my Weather Data deployment. So learning was a big part of this. Baby steps I'm sure, but progress nonetheless.
• Secondly, I have a pretty large physical collection of music that I have been accumulating for decades and converting out to flac. Sometimes I forget all the cool songs I might miss every once in a while. So, I figured this would be a cool way to remind myself.

POSSIBLE FUTURE UPDATES:

• Perhaps embedding the link to the Song Of The Day in the MOTD. I'm not sure if that is possible at this point.

Among the things I learned is that if your password to Navidrome has special characters such as $, then wrap the password in single quotes:

• NAVIDROME_PASSWORD="your_password"
• NAVIDROME_PASSWORD='$your_pa$$word$'

ETA: Forgot the prerequisites. You must enable these variables in your Docker compose or through Portainer or similar:

• ND_REPORTREALPATH=true
• ND_ENABLESUBSONIC=true

I'm including a pdf for the instructions and script because I can't seem to get Lemmy formatting to bend to my will. The link will take you to Mega.nz. If you are interested but Mega.nz is not allowed on your network, I can upload anywhere you want. Please scan the pdf before opening.

To the best of my knowledge, this will not cause your server to implode or explode. As with any code you find online, thoroughly examine it before deployment on a production server.

NAVIDROME MOTD

If anyone has a better way or other ideas, I'm willing to be schooled.

Have fun!

Progress Report:

So, building on @captcha_incorrect 's n8n script he graciously offered, and pulling data into Grafana, and learning how to python correctly....it's been a journey. However, I am happy to report that I have some weather data now. It's by no means a finished product but I have made some progress.

The extended forecast in the right hand side took me some time to figure out pagination so I could scroll through 5 days in advance. The weather tab at the top left will get a couple more tabs. One for forecast map, if I can figure that out. LOL

So, yes this is selfhosting related. I am working on an n8n flow to pull in weather data so that I can have this data on a dashboard. I can't find any dockerized weather forecasting apps. Most of them connect to a personal weather station, which might be an option in the future. For the time being, this is a little project I'm working on.

Partial JSON snippet:

0	
json	
cod	"200"
message	0
cnt	40
list	
0	
dt	1780693200
main	
temp	29.4
feels_like	29.23
temp_min	29.4
temp_max	29.68
pressure	1019
sea_level	1019
grnd_level	984
humidity	42
temp_kf	-0.28
weather	

I would like to display something like this:

Current temperature: 23.25 °C
Feels like: 24.09 °C
Low / High: 23.25 °C / 23.60 °C
Humidity: 94%
Atmospheric pressure: 1023 hPa (sea level: 1023 hPa, ground level: 988 hPa)
Temperature correction factor (temp_kf): -0.35

Weather: Light rain
Weather code: 500
Short condition: Rain
Icon: 10d

So, this is for you devs or coders out there. I can produce the JSON data. I'm just not sure how to parse it to something meaningful. I'm sure Python will have to be incorporated, but unsure of how to proceed.

Maybe someone could point me in a direction to tuts, articles, or your own experience. Sorry the JSON data doesn't format correctly. Lemmy formatting doesn't seem to allow that.

ETA: For anyone wandering across this, here is the solution: https://lemmy.world/post/47961985/24201369 thanks to @captcha_incorrect for his generosity and time.

I just recently stumbled on this and I've never heard anyone here that uses it. It looks quite interesting. A dash for your Proxmox server.

The live demo looks jammy: https://demo.proxcenter.io/

The docs look quite comprehensive: https://docs.proxcenter.io/

Github: https://github.com/adminsyspro/proxcenter-ui

Runs in a Docker container. There is an community version and an enterprise version. I think I'm going to bump this up the Projects list to the top.

=> There are 90 zombie processes.

On one of my Homelab servers running Ubuntu Jammy, I always seem to get zombie processes. A quick check with ps -eo pid,ppid,stat,cmd | grep -w Z shows them all . It just bugs me. I shut down the server in the most nicest of ways I know how with sudo shutdown -h now but I always get zombie processes shown on start up.

Am I missing something? Do these show up on your servers? How do you deal with them besides just ignoring them if they are ?

I'm not sure anyone shares the same glee I feel when I view all the blocked IPs scrolling by in my pFsense firewall. Suricata does a lot of heavy lifting for sure.

What's your selfhosting guilty pleasure or pleasures?

I posted this over at https://discuss.tchncs.de/c/navidrome, but I thought I'd post it here, maybe someone has had experience with this.

I've been noticing demo.navidrome.org showing up in my firewall:

pFsense:

abuseipdb.com:

As with anything entering or exiting my network, I am cautious and curious why my instance of Navidrome has the need to contact demo.navidrome.org.

I am running Navidrome as a Docker Instance. I have combed my compose file and can find nothing in that itself that would trigger Navidrome to 'call home'.

Is this for stats, or other? As of right now, I have demo.navidrome.org blocked until I've gathered some information.

BTW, sweet piece of opensource software. I tip my hat to the dev team(s).

From time to time I like to review my network to see where I can tighten up. Review logs, check out the landscape, and make sure there are no gaps. Today, I have some downtime, so I figured it'd be a good for it. Since I am not a certified IT professional, this is what I have cobbled together reading, and seeing what others have done. I'd like to bounce this off you guys who are more experienced than I and get your impressions. If you have any recommendations, I'm always down to be schooled.

So if you'd like to participate in my audit, I have a home network as follows:

• Modem receiving IP from ISP. Modem to router. Router to stand alone pfsense firewall. Router has a 54 character complex password for WiFi. There are no guest provisions for WiFi.
• Pfsense firewall with pfblockerng & suricata running on both lan and wan, both with a full array of rules/feeds updated daily. pfsense has tailscale as an overlay vpn. Server traffic and PC traffic have their own VLAN provided by pfsense. My approach is to deny all until something complains and address that on a case by case basis. Additionally ntopng is utilized for traffic analysis. IPv6 is disabled.
• Server running Tailscale as an overlay VPN, UFW deny all posture, and fail2ban with an aggressive posture. Server has been hardened against Lynis spec where applicable. Not all recommendations apply to my server. Server is utilizing host deny/host allow and SSH keys.
• Server is utilizing containers for services.
• Server is using Cloudflare tunnel/zero trust.
• Server and pfsense communicate via Tailscale encrypted tunnel. PC/Phone/mobile device can communicate with pfsense via Tailscale.
• Server services are accessed via https.
• PC connected to pfsense firewall with same rules as server. PC is using a VPN with Cloudflare 1.1.1.1/1.0.0.1 for DNS queries. Firefox is using 1.1.1.1/1.0.0.1. Settings for Firefox are the strictest for Enhanced Tracking Protection, and DOH. HTTPS-Only mode enabled. PC is also running a soft firewall.
• All other devices such as phones, laptops, and tablets run a VPN with Cloudflare 1.1.1.1/1.0.0.1 for DNS queries.
• IoT devices are isolated. Phones are isolated. Smart TVs are isolated.

How secure would you say this network is and give any recommendations to further harden the network besides keeping up with current updates, monitoring and auditing logs.

Thanks

https://www.youtube.com/watch?v=Dc433VhZwvY

Every morning, I do a multiple DNS Leak test just as a precaution. Today, I did the leak test and all my IPs were different. They were the same IP block, just different. This made me suspicious and I set about trying to track the problem down. Turns out, there was a misconfiguration in the VPS. Worked yesterday, different today. I guess it was ghosts or gremlins in the machinery.

I got to thinking, for you guys who download a lot of Linux ISOs, might be a good idea to check daily. Even though you are setting behind a VPN, it's still worth the minute it takes to fire off multiple DNS Leak checks just for a sanity check.