• 3 Posts
  • 167 Comments
Joined 8 个月前
cake
Cake day: 2025年2月5日

help-circle












  • This is mostly nonsense.

    • Why block outgoing? Its just going to cause issues for most people. If you’re going to do that, do it centrally (hw firewall)
    • Why allow http and NTP incoming, when there is no http / NTP server running.
    • If there is http server running no mention of https://ssl-config.mozilla.org/ and modsecurity
    • If you’re using ufw anyway why not go with applications instead of ports?
    • In a modern distro, the defaults are usually sane (maybe except TCP), most of the stuff in the SSH config is already default.
    • Why change the SSH port of a home server, which most likely is not reachable from the outside anyway?
    • Actually potentially impactful stuff like disabling services you don’t need, such as cups, is not mentioned
    • unattended-upgrades not mentioned
    • SELinux / AppArmor not mentioned
    • LKRG not mentioned https://lkrg.org/
    • Fail2ban not mentioned

    Don’t just copy random config from the internet, as annoying as it is, read the docs.








  • I want to write this in a separate post because I see many questionable suggestions:

    Your scenario does not allow for a simple rsync / ZFS copy. That is because those only work with 1:many. Meaning one “true” copy that gets replicated a couple of times.

    As I understand you have a many:many scenario, where any location can access and upload new data. So if you have two locations that changed the same file that day, what do you do? many:many data storage is a hard problem. Because of this a simple solution unfortunately won’t work. There is a lot of research that has gone into this for hyperscalers such as AWS GCP, Azure etc. They all basically came to the same solution, which is that they use distributed quorum based storage systems with a unified interface. Meaning everyone accesses the “same” interface and under the hood the data gets replicated 3 times. So it turns it back into a 1:many basically, with the advantages of many:many.