I run easy-rsa on a linux box. Just manually generate CSR’s and sign them via SSH.
And simply trust the CA cert in windows, linux and whatever extra places (normally firefox cert store).
Post the crl.pem to /var/www/html/ and let NGINX use that.
For most things public like plex or whatever i just use letsencrypt. Easy-rsa is really just for internal stuff like my NAS, VPN etc.
The ARR tools are basically a search engine website you host. The interact with a few other tools you have to have access to/pay for. Namely an indexing service and a (for some) a download service. They can use torrents, so you dont HAVE to pay for downloading, but using something like newsgroups is really nice and add reliability and security.
THe “ARR’s” basically then are just a fancy UI and scheduler and just search the indexing service, download the files you want, re-assemble them and copy them to the location you want (often a file share that your media player like Plex or Jellyfin will use).
You can set them to continually look for something too. So for Sonarr, it will auto-download new episodes as soon as they appear in the index. Or if you see a commercial for something upcoming, you can add it and monitor it and as soon as it starts showing up in the indexes it will download.
All the aarrrs. Saturates my isp bandwidth, have no issues with finding stuff, no takedown or piracy warnings…
I have 3.
Dakboard above the fridge shows calendar and shared photo album. It also runs bluetooth and serves as a relay for Homeassitant and a few kitchen devices (ie: igrill mini probe for meat).
pikvm for a desktop
pikvm+ kvm for lab rack esxi servers.
the latter two also run tailscale and allow me to SSH proxy if needed as a back VPN/remote access utility.
There is also a 4th. It runs NUT/UPS tools for their network gear and a mail relay for alerting and also tailscale so I can proxy if necessary.
Since its tailscale etc. Only key based auth is allowed on these boxes.
Ah. That makes sense.
Interestingly the game is downloading for me. I have had it in my library for some time now.
Is it saying its been pulled for new sales only?
Are you hosting it on personal hardware?
Not currently, though I am considering it. Right now I host mine on a VPS in linode. Though i need to downgrade it, I built it with the expectationg of allowing joins, but recently decided just to keep it private.
Can you just choose any free name for the domain if it’s on your own hardware or do you need to rent one regardless?
This wouldnt work. You not only need to have a routable/real domain name, but the server likely needs access to the internet to allow fro federation, specifically ingress traffic, to work.
Do you keep it active all the time or turn it off for the night/other periods of time where you know you won’t use it?
Mine runs 24/7. Even if i hosted it at home it would be 24/7. Only issue is
I already use port 80/443 at home. So i would need to reconfigure NGINX to use a proxy, which could also break federation. I could do that, in fact I am pretty sure the ansible config uses NGINX proxy commands, just that I would have to customize it and Im lazy. I already have stuff on VPS systems in linode (blog, teamspeak etc) so its no biggy to have another one.
My internet at home can be flaky. For example I currently dont have power at home and while I normally run on UPS for a time, and can cut to generator when I am home, my network just went into auto-shutdown.
Excatly why I never opened my instance. With it just being me, i can control what is on it and what is synced. There was too much risk with CP/CSAM type stuff. Heck I didnt even want to risk my linode account (aka they shut my other VPS systems down) due to TOS from shenanigans.
That said, I can still contribute just fine with my own instance and dont have to be involved in these drama defederation actions.
I would encourage anyone that is willing to criticize an instance maintainer for their decisions on risk to just roll out the lemmy-ansible setup and go your own way. If you troll or act in bad faith, you will get defederated. If you act like a reasonable person, no one will even notice. And that way you are in control of uptime, patch cadence, backups etc.
Can help with all of them. But check out opnsense.
My distaste for systemd has been replaced by my distaste for netplan.
Copy them to the box. Sign them. Copy the cert file off the box back to the requester.