• 0 Posts
  • 187 Comments
Joined 2 years ago
cake
Cake day: January 2nd, 2025

help-circle











  • I have a lot of stuff self-hosted.

    Just no outside access. Well, that’s not quite true, I do have a Tailscale VPN for remote management, but only certain machines are allowed to join, joins require my authorization, and access to the account is via two-factor.

    The big thing with external access is to never permit it directly through your local connection. Do it though a Virtual Private Server (VPS) - let it get hit with access attempts. And then only allow specific traffic from the VPS to a specific service in your network using a VPN of some sort.


  • Really depends where you are.

    I’ve lived/worked all over the US. Since Walmart is everywhere, you get to see how different regions behave, or even different areas of a city.

    I have 2 Walmarts nearby, one is like this, the other isn’t.

    And interestingly, the major grocery store next to the police station (so not the best part of town) is usually pretty good about carts. And I suspect the ones we see left out are because the wheel locks there are notorious for locking for no apparent reason.


  • Two approaches:

    Network isolation/DNS blocking - put the TV on a VLAN and only permit specific ports through to a media server (whatever the TV will support). If you lack VLAN capability, run PiHole as your DNS server (it works best as DNS and DHCP, but that’s just my opinion for things I like, such as proper name resolution for all devices).

    Second option: (your idea with a Pi) disconnect TV from network entirely, then run something like Kodi (or whatever media center you prefer) on an old laptop, mini-PC, whatever, and have that device connect via HDMI. HDMI can passthrough the navigation controls from the TV remote (not guaranteed, but it’s part of the standard). I looked into this a long time ago but the performance wasn’t there yet. Today I’d probably try any distro and run Kodi on it.

    Even my POS Samsung passes through enough of the controls to navigate Kodi on a 2017 laptop, while retaining power, volume, settings, etc for the TV itself.

    My current setup is a Jellyfin server and Jellyfin client on the TV. I run PiHole with a blocklist for all the Samsung BS which has had the side effect of making the TV menus faster as it doesn’t retrieve any “what’s new” info from Samsung. Its actually kind of fun to monitor the FNS log and see the domains the TV hits, click Deny and see what breaks in the TV. On average about 30% of all DNS requests on my network get denied, and nothing of value has been lost. That’s how much crap is being sent all the time.

    Hope that gives you some ideas.




  • I mean it’s a commercial product - if stability issues were a common thing, that would be well known and published.

    It’s a mesh VPN so it generally has the same stability challenges as any other: Hamachi, Nord, Meshnet, Wireguard (which is the underlying protocol that Tailscale uses).

    If the Tailscale client is running on the NAS itself, I’d consider that the first thing to troubleshoot.

    NAS’s generally don’t have much extra processing power, and in my experience apps designed to run on them aren’t the most robust. In this case, the VM/dock client has to consume all TS traffic, perform the encrypt/decrypt, put it back on the net (even if it’s only with the virtual net) over to Borg, which then has to write to the NAS. The NAS hardware has to do all this, with whatever little bit of ram it came with, also while writing all these changes, managing stripes, etc.

    While they advertise these things can run stuff like this, it just seems like an opportunity for performance issues when the processing power design was for a NAS/RAID.

    I have an ancient NAS on my network that could probably run the TS client, I just don’t bother. TS runs on all desktops and servers (for general access), but connectivity to non-TS devices goes through the server running as a TS router. That can be run on any device running TS - it’s just a feature to enable and configure.



  • I can’t imagine not using a proper internal DNS with split anymore.

    I’m a big fan of Pihole (currently running it on a DietPi VM).

    Being able to manage DHCP and DNS in a single place makes for much better control than the crappy DHCP from consumer routers. And almost any real DNS/DHCP server combo is better than those things.

    Just rebuilt my PiHole over the last couple days, and it’s currently blocking 45% of DNS requests with no ill effects on any system - it’s a lot of Android app nonsense and a smart TV.

    I’ve lost the Samsung TV service on the TV, but I never used it anyway, and the TV is so much more responsive now.

    Yea, smart TV… Bad news. It’s next on the list to get a Kodi box on it.