That disk upgrade thing was a mountain out of a molehill. All they are doing is reserving some of their disk health features for synology branded disks because they’re the only ones they can verify meet their standards for their software.

Then explain why one can successfully use and old synology to “mark” drives as “authentic synology” and move them into a newer DSM model to use them. This means the mechanism amounts simply to marking disks and not binning disks or any kind of actual hardware selection. Which in turn means that “certified” Synology disks are nothing more than disks with a Synology signature. And not even in firmware, but on the platter.

And that is the “molehill” everyone is calling Synology out on.

As explained ad nauseum on various yt channels, having a hw compatibility list makes sense for users likely to buy support, like business users. It makes little sense in a home market where users are both more likely to buy 3rd party disks and will not likely invoke official Synology support.

But add on top of it that there is no functional hardware difference between certified and non-certified, and it becomes pretty clear that Synology is to be avoided.

Do not promote these Synology jerks.

Synology’s software is awful. Simply controlling NFS shares is an exercise in insanity, and don’t get me started on ACLs.

Further, synology is a real bastard company currently trying to enshittify hardware (disk) upgrades, among other terrible practices:

https://www.reddit.com/r/synology/comments/1kmx5td/can_we_still_trust_synology_users_catch_quiet/

https://www.tomshardware.com/pc-components/nas/synology-requires-self-branded-drives-for-some-consumer-nas-systems-drops-full-functionality-and-support-for-third-party-hdds

Full disclosure, I myself am running an old ds211j for backups. It’s way out of updates, and there isn’t much of a 3rd party image collection for synology hardware, but it works fine and lives in its own locked down subnet.

Wow, you just gave me flashbacks to my first Linux/unix job in 2008. Tripwire and logwatch reports to review every morning.

deleted by creator

deleted by creator

I mean, you just keep asking different people whether a thing that does X exists. They’ve all said no, but you can use Y plus mods to do it. Doesn’t seem good enough for you.

Now you’ve risen to “VLC cant do that”. I’ve shown you it can, and you not only beak back at me about it being CLI, but downvote me as well. Thanks for that.

streaming not transcoding

Literally the first sentence:

“This functionality allows you to link VLC’s transcoding capability with a segmenter which will in turn create the series of files needed for http live streaming to the iPhone”

You don’t know what you’re talking about, and you don’t understand your own problem.

Regardless of any info you get here, you will still need to problem-solve. Good luck.

Come on, dude. Now you’re just trolling.

https://wiki.videolan.org/Documentation%3AStreaming_HowTo/Streaming_for_the_iPhone

Quit while you’re ahead and just go do some reading.

I believe photoprism does its face recognition in the cloud, which is a dealbreaker for many.

Oof, a lot of vitriol in this thread.

In the end, security is less about tooling and config, and more about understanding the risks and acting accordingly.

I expose jellyfin to the internet, but only to a specific public IP. That reduced my risk considerably.

Raspberry migrated away from x.org a number of months ago. You’ll need to install all the x and x forwarding components.

There are a number of ways to install nextcloud, and docker is only one of those.

Yes, NC isn’t ideal in many ways, but it shouldn’t be as painful as you’re describing to run it.

Paperless-ngx is great, but it is particularly bad at handling PDF documents. Roughly half my documents just won’t import.

https://github.com/paperless-ngx/paperless-ngx/issues/3933

https://www.reddit.com/r/selfhosted/comments/yfjxww/paperlessngx_not_all_pdf_files_can_be_imported/

https://github.com/paperless-ngx/paperless-ngx/issues/2187

Turnkey images are usually built on popsicle sticks and chewing gum; they use old packages, their configs are often really janky and they do not like being updated.

I’m not kidding you, you’d be better off building nextcloud in a generic debian container.

As for the errors, as others have mentioned these are more or less easily fixed one at a time.

There’s a bunch of posts about the iptables-save function of the built-in iptables module not working in many cases, so I figured it was a safer bet to suggest the playbook include an actual command invocation.

In my personal experience, the module doesnt actually save the persistent rule in about half the cases. I haven’t looked into it much, but it seems happen more on systems where systemd iptables-firewall is present. (Not trying to start a flame war)

Generally, you set up a rule + command playbook, where the command invokes the iptables-save command.

I read the old thread and now this one.

As I understand it, you want to create connection between clients on your lan, but you don’t trust your lan, so it’s like having a raspberry pi server and some client both on the coffee shop network and you want them to communicate securely?

Tailscale is what you want. Easy setup, free, and allows exactly this to happen.

I was looking for this. Op seems to be obsessed with “zero trust”, so creating a trusted area for this stuff would be an easy win.

Do you have port 80 to nginx open? Certbot dry run will give you some diagnostics, but that is the most common issue (port 80 being closed).

I also run LE on nginx and afraid DNS.

The effect is similar to sticky ports, but sticky ports is just filtering based on Mac address, which can be spoofed.

802.11x allows traffic from a device only if they also have the correct EAP certificate.

https://en.m.wikipedia.org/wiki/IEEE_802.1X

802.1x are a set of protocols that allow port access to be locked to specific devices, which would preclude your need for multiple subnets. You would likely need a few extra physical ports on your white box router, the unmanaged switch could later become overwhelmed passing traffic in a more complicated setup, and you would still need to keep trusted and untrusted traffic separate at the gateway subnet.

Your use case is exactly why vlans were invented.

However, I suspect from your other answers that you are actually looking for an open source managed switch so your entire networking stack is auditable.

There are a few solutions like opx, but hardware supporting opx is prohibitively expensive and it is almost always cheaper to build a beige box and use Linux or get a 2nd hand supported device and use openwrt.