Can you verify with wireshark that the traffic is only going through your lan? I’m not hip enough for nginx but I used to have to run apache under gdb all the time to trace random errors from the server. That would be next, if the traffic is really local.

Oh man, what a mess. It is just not worth it if you’re only adding 1 or 2 TB. Also you don’t say what kind of data you want to store on this system. If it’s media files (static once written) that can simplify things.

I’d say don’t mess with external drives at all. Your simplest path is upgrade your 1TB internal SSD to 2TB or 4TB. Those aren’t too expensive, and you get SSD storage. Yes you may as well use LUKS unless you want to get fancier. I have some thoughts about key management but haven’t implemented them in practice, so talk about that would be theoretical.

RAID is for when you have data that changes, like databases where you frequently add rows or do updates, so you are up to date if a drive crashes just after an update. It also lets you keep the system running while you hot swap the crashed drive. If you don’t mind taking your storage offline while you restore from a backup, and you don’t mind having to recreate the most recent data, you don’t need RAID.

I simply keep my static stuff and backups on a Hetzner StorageBox, encrypted with Borg Backup. That eliminates all the hassles of RAID, buying hardware and keeping it at home, etc. I can remote mount it (read only) with sshfs with all cryptography happening on the client side (in practice I don’t do that very often). There’s no need to use an encrypted file system on the server, or for the server to ever see plaintext. Of course StorageBox is not self hosted, but you could do something similar with a bare iron storage server. Anyway I think it’s difficult to beat this for economy until you have tens or maybe 100’s of TB of data.

That’s if you have a regular domain instead of.internal unless I’m mixing something. Topic of thread is .internal as if it were something new. Using a regular domain and public CA has always been possible.

Right, main point of my comment is that .internal is harder to use that it immediately sounds. I don’t even know how to install a new CA root into Android Firefox. Maybe there is a way to do it, but it is pretty limited compared to the desktop version.

Yeah I know about that, I’ve done it. It’s just a PITA to do it even slightly carefully.

Browsers barf at non https now. What are we supposed to do about certificates?

If the problem is intermittent then longer run has better chance of catching it, but 2 hours with no errors is a good sign, with regard to the memory.

Do encrypted backups with Borgbackup or similar. That means the server never sees the plaintext or the decryption keys. The encryption happens on the client. Since it’s public-key encryption (separate keys for encryption and decryption), the client doesn’t need the decryption key either, except when restoring. So your backup can be automated without secret keys.

Try running memtest86 for a few days to test memory. That is fairly easy to do though it involves booting from a flash drive. Web search should find info.

I don’t understand the bonus question, and there are a lot of subtlties to multi-person secure chat. Does the user agent really have to be a web browser instead of, say, an ssh terminal? What do you expect to use instead of web sockets, in a browser?

On different occasions I’ve used irc or nextcloud chat, neither of whichis ideal. Plus ytalk but that is 2-person only. There used to be fairly busy discussion on the moderncrypto.org messaging forum but I think that is quiet now.

/u/positive_intentions@lemmy.ml might be interested too.

Stop the whole VM during snapshots.

Borg backup?

I don’t remember the format codes but they are generally pretty stable across a given host like youtube. The trouble is that not every video has all of the formats. You might have to just find the nearest one and convert with ffmpeg.

Use yt-dlp -F to list the available formats, and pick the one you want. See the “Video Format Options” section of the man page.

This all sounds like too many levels of hair. If you really want to serve from home and have the upstream bandwidth for it, then reverse proxy to a cheap VPS seems like the easiest approach. I lost interest in that ages ago, partly because of crappy home internet. I have played with the idea of colo’ing a server at a data center but in the end, it’s simpler to use VPS and/or rental dedicated servers, so I do that instead. Whether that counts as self hosting is up to you, I guess.

Namesilo has it, porkbun didn’t last time I checked, iirc. Dunno about Cloudflare. GoDaddy has always sucked in so many ways that I never looked into their DNS.

deleted by creator

It can be fine, I’m using a comparable machine, you have to do the math for whether the power bills are worth it. What cpu does it have and how hard do you plan to run it?

Do you want something that also has CDN like Cloudflare? Bunny.net is good, but way more expensive than a cheap VPS if you use a lot of traffic.

Plain text or org mode file.