definitely don't expose any management interfaces to the open internet.
personally, i manage my homelab through ssh via the commandline, and key-based ssh auth is secure enough for my threat model (i am considering switching the entrypoint machine to a BSD though, to avoid the kind of bugs distros sometimes introduce).
but a webserver and a few containerized services seem pretty low risk to me, so i do have a few of them exposed via reverse proxy. The more sensitive one behind Authelia via the forward-auth pattern, which i feel like is a really good fit for homelabs.
i'm pretty sure Mox (email server with included webui written in Go) does that - at least the Umlauts in mails i get from Hetzner seem to always stand out.
it also defaults to not loading HTML in emails, which i love. really opened my eyes to how dumb it really is to just accept all kinds of dynamic content in unknown messages. (kinda same as how the modern web relies on remote code execution to work)
quickly skimming the article i couldn't see a specific price for the ipv4 block, but ipv6 is cheap - the article mentions having to pay at least $50 a year + service fees to a "LIR", and you also need a BGP-enabled hosting provider which i imagine will come with similar cost at least (don't quote me on that).
this was my plan, but then i got really into using LSPs and i'm not about to install every LSP on every server i ssh into.
Currently i just use sshfs to mount whatever directory i want to work on locally, nice to have all lsps available and also see my changes reflected on the server instantly.
gave it a shot, i like the concept, even though i suspect it'll cost like $2 a query to really get somewhere.
anyway, my test was to search for FOSS software, explicitly asking for "not big tech" and no ads. the contents of the results were fine, if repetitive - but i was a bit sad to see a lot of youtube and reddit in the results. does the " algorithm" not look at the actual domains?
Ignore the below, it is for a different "FOSS" discord replacement.
i did self-host it for a week to test it out - and honestly i was put off immediately.
What happens when you set it up according to the docs, is that it automatically "registers" for a license - the free license being limited to 5 users, even if you self host. Ridiculous, and just right out the gate shows me that whoever makes this does not have the user's best interest in mind.
the UI is also full of stuff that requires an expensive license, and i did not see an easy way to remove that stuff when self hosting.
Back when i checked out sr.ht, i really liked the idea of git-send-email precisely because it doesn't require making an account for everything. there's a nice tutorial for how to set it up: https://git-send-email.io/#step-1
worked easily enough for me, i could see myself using it for small patches here and there.
I did end up installing forgejo in my homelab after all, but back then it sounded like federation was much closer than it actually was. i did kind of expect that though, federation gets pretty complex quick.
every time i log into forgejo, i do see that juicy "proceed with OpenID" button though, and i've looked into running my own openid provider a few times - sadly not seeing anything that would work for me yet. honestly i can't believe we went from "facebook sign in" to "google sign in" and are now going to "github sign in" without a single open standard that's gotten some adoption.
set this up today, the documentation is useful and the quickstart very helpful, the dns stuff pretty much works exactly as it's supposed to and is just a bunch of copypasting (in my registrar's ui).
specifically for mox there was some things i would have liked to see:
explain how the webmail isn't accessible on the public ip by default - i don't know how many of you want to be in a specific vpn for checking your email, but i sure was surprised i couldn't reach it, but had to activate it in config (and first figure out how to even do that).
mox also doesn't redirect to https by default - imo it should, since it already includes the convenient automated certificate setup (which worked great).
maybe it is intended for a different environment, but since it recommends not running another webserver on the same host, i really don't want to access the webmail from the local server or by http.
i like most of my services being available behind a reverse proxy, there it would make more sense. maybe i'll look into that variant later, but the documentation isn't quite as complete as i'd like.
i spent some time today buying a new domain and setting up mox on a hetzner vm. the IP was on 3 blacklists on first check, after fixing the reverse dns it's on 2, one of which is apparently fake? dkim and dmark seem to be working, sending a mail to protonmail succeeds the checks, and yet it lands in spam - however, i'm confident once the domain is older than "just now" and i've set up DNSSEC (takes 1-3 days for this to start working in my country apparently) things will improve.
worst case i'll have to request a blocklist to unblock me, but i'll see.
personally - gmail is extremely plagued by spam. sure it goes into the spam mailbox most of the time, but enough non-spam email goes there too so you still have to check it. the current plague for me is "your package is awaiting delivery" spam - almost daily.
for being considered spam - i've had like 3 irl things set up on my old self-hosted mail, and these 3 arrived, even though while testing shortly after making the setup i did end up in spam. i don't know if companies have a whitelist of "if a user has this email on his account, don't send to spam" or something, but it hasnt been an issue.
i don't usually email too many individuals, in my social circles emails is not for that and has pretty much died long ago.
Due to the decent success i've had, i've spent some time today setting up mox to potentially replace my other solution - it is a bit of a process, many dns entries to make, and DNSSEC in my country seems to only update once a day so i'll see if i can enable it tomorrow, but so far it's working (but as usual, the first test email lands in spam.) i assume delivery will improve as soon as the domain is a bit older - i imagine most big mail services block email from a domain created the same day the mail is sent.
i'm still patiently waiting for an easy way to point a model at some documentation, and make it actually use that.
My usecase is gdscript for godot games, and all the models i've tried so far use godot 2 stuff that's just not around anymore, even if you tell it to use godot 4 it gives way too much wrong output to be useful.
I wish i could just point it at the latest godot docs and have it give up to date answers. but seeing as that's still not a thing, i guess it's more complicated than i expect.
thank you for this! i was looking for an easy way to generate passwords for this, and while diceware isn't in my distro's repos, turns out the EFF publishes the word list and the method to generate them online, making it super easy to make a small bash script to generate these! here's the link:
as someone who works on 3 different machines regularly and likes to have the same environment on all of them... i would LOVE if applications would stop cluttering my .config with cache data and other bullshit i keep having to exclude from sync.
its actually a big thing i am waiting for - both websites and ai tools to agree on a way to facilitate this.
i'm doing some game development in godot as a hobby, and the current llm's are really bad at it - very often i get code suggestions that use ancient versions of gdscript or the engine. I'd love to have a big enough context window and the tooling needed to go like "look at these godot docs for the current version: (insert link)" and then ask my questions, i think it would fix 99% of these issues. same with other less well-known tools and languages.