I’ve been looking into crowdsec for ages now and still haven’t gotten around to even a test deployment. One of these days, lol, and I’ll get around to it.

Oooooh. That’s smart. I mostly host apps, but in theory, I should be able to dynamically modify the response body and tack on some HTML for a hidden button and do that.

I used to disallow everything in robots.txt but the worst crawlers just ignored it. Now my robots.txt says all are welcome and every bot gets shunted to the tarpit 😈

I’ve got bot detection setup in Nginx on my VPS which used to return 444 (Nginx for "close the connection and waste no more resources processing it), but I recently started piping that traffic to Nepenthes to return gibberish data for them to train on.

I documented a rough guide in the comment here. Of relevance to you are the two .conf files at the bottom. In the deny-disallowed.conf, change the line for return 301 ... to return 444

I also utilize firewall and fail2ban in the VPS to block bad actors, overly-aggressive scrapers, password brute forces, etc and the link between the VPS and my homelab equipment never sees that traffic.

In the case of a DDoS, I’ve done the following:

• Enable aggressive rate limits in Nginx (it may be slow for everyone but it’s still up)
• Just stop either Wireguard or Nginx on the VPS until the storm blows over. (Crude but useful to avoid any bandwidth overages if you’re charged for inbound traffic).

Granted, I’m not running anything mission-critical, just some services for friends and family, so I can deal with a little downtime.

I used to use HAProxy but switched to Nginx so I could add the modsecurity module and run WAF services. I still use HAProxy for some things, though.

I have never used it, so take this with a grain of salt, but last I read, with the free tier, you could not secure traffic between yourself and Cloudflare with your own certs which implies they can decrypt and read that traffic. What, if anything, they do with that capability I do not know. I just do not trust my hosted assets to be secured with certs/keys I do not control.

There are other things CF can do (bot detection, DDoS protection, etc), but if you just want to avoid exposing your home IP, a cheap VPS running Nginx can work the same way as a CF tunnel. Setup Wireguard on the VPS and have your backend servers in Nginx connect to your home assets via that. If the VPS is the “server” side of the WG tunnel, you don’t have to open any local ports in your router at all. I’ve been doing that, originally with OpenVPN, since before CF tunnels were ever offered as a service.

Edit: You don’t even need WG, really. If you setup a persistent SSH tunnel and forward / bind a port to your VPS, you can tunnel the traffic over that.

Weird. Other than how it used to choke when there were conflicts (and all uploads stopped until that was fixed) I haven’t had any issues like that. Guess I’m just lucky.

I’ve had pretty good experience with Nextcloud’s instant upload. The only time I’ve had it shit the bed was ages ago when it would occasionally get stuck on a conflict, but that hasn’t happened in a long time. Pretty much all of my image folders (camera/DCIM, Screenshots, Downloads) get synced. The only annoying thing was when apps would suddenly change where they download to and I’d have to reconfigure yet another sync folder, but I can’t really fault NC for that.

Mine is set to upload and keep a local copy and only do a one way sync (phone to NC). Not sure if that causes less issues than a 2 way sync or deleting the local copy after upload?

Me right now:

Kim Jong-un looking like he’s about to ask you to come visit his island for the weekend and perhaps pen a wee testimonial. Wonder if he also has a jet standing by at Choteau?

What are the chances this opens some eyes / forces development of empathy? (I asked rhetorically)

Can confirm, but depending on the VPS, your traffic may only be metered in one direction. Mine only meters egress, not ingress, so it’s not too bad if I want to use my media server.

All of mine use bind mounts so I can just tar-gz the whole deploy folder for backups and migrations. For volumes that connect to remote shares (SMB, NFS, etc) I use named volumes and let Docker take care of their lifecycle.

If named docker volumes would let me specify the local filesystem location, I’d use them. As-is, I rarely do.

It’s not even a news site. It’s just self-promoting blogspam.

This is just a regular act/bill/law. Only the federal budget is controlled (exclusively) by the House.

You take it to the closest Hegémon Center to have it healed up? Revive + potion will work in a pinch

(I’ll see myself out).

…the Will County Gazette is an imposter site, lacks transparency, and publishes false information. As a result, we rate them right-center, biased, and Questionable.

https://mediabiasfactcheck.com/will-county-gazette-bias/

Then you really should list all of the secondary functions you plan to add to it, make sure they understand what those are, and agree to each of them: full disclosure.

If you do something on it that could get them in trouble, it’s their ass on the line, not yours.

Are you friends okay with you doing that? I would not be, especially if my so-called friend didn’t disclose the secondary operations of the device that’s in my home, on my internet connection, under my name.

deleted by creator

Who knows? No one else is reporting that. I also don’t give established low-cred, highly sensationalized, highly-biased sources the time of day. Mondoweiss is Fox News’s counterpart on the other end of the spectrum – i.e. it’s Fox News for lefties. Just as bad, just different flavor.