Selfhosted

Hi good people... just looking for some feedback ...

I have a couple of Raspberry Pi 3 with audio amp outputs (one has a touchscreen as well).

They're currently running Volumio (v2) which we can control remotely with our phones, but that software is old, insecure, and could really do with an update...

Volumio (v4) doesn't inspire me much, plus, it's good to check out the alternatives.

So, I'm looking at replacing the local-audio playback with perhaps Moode ... or maybe piCorePlayer and perhaps adding Navidrome for remote access??

I'd need to be able to play radio streams too, with a sleep timer / wakeup function, so not sure if that's a deal breaker (it's hard to find these features on their websites)

Any alternatives that others can suggest (rAudio?) or other feedback?

Or am I ahead of the curve and I have found the Best Solution™️?

TIA

Just wanted to share this Youtube video (Invidious link here) that explains how to configure Openwrt VLANs for your Wifi network! I was struggling for hours today trying to configure VLANs on my Openwrt AP when I found an old Reddit thread linking to this guy's channel!

He seems to have a whole series on Openwrt, so if you need a complete beginner guide he sounds great!

• Immich always asks for confirmation when deleting an image on android. How can I disable that behavior?
• why is there no delete button for images/videos that are not yet uploaded? It's annoyng to upload a huge video just to delete it. Why does the UI change dependent on the local/server status?

OS: grapheneos

I've been self hosting a few services on a raspberry pi-based NAS and decided I was ready to up my game. I got on eBay and found myself a decent deal on an old Supermicro dual-cpu board with an EATX form factor. Now I need a case for it.

I could rack mount it, but I'd rather have it be a standalone. I also have several HDDs in a RAID for storage, and would love something that has room for those internally. I was going to get a Darkrock Classico Max, but figured out it won't fit an EATX board without removing the HDD cages.

Do I'm wondering: anyone out there have a recommendation for a good EATX case with ample HDD space? Anyone else got a setup like this you are happy with?

Original post here [redlib link].

Written by deluan

The next release normalizes every ID in the database into a single format. It runs a one-time migration on first start. The PR with this change will be merged this weekend: https://github.com/navidrome/navidrome/pull/5824

If you run develop or auto-update, this lands soon (this weekend) and without warning. Make a backup of navidrome.db now. The migration is one-way, so rolling back (if needed) means restoring that backup.

The short version:

• Takes ~30s to ~1m20s on my 96k-track library (QNAP Celeron). Scales with library size.
• Everyone gets logged out once. Web UI and clients using the Navidrome API need to log in again. Subsonic clients authenticate per request, so they are unaffected.
• Song IDs change, album and artist IDs do not. Clients that cache song IDs (offline downloads, cached playlists) may need a re-sync.
• Cover art gets re-fetched, so the first browse after upgrading is slower.
• Share links keep working.
• Nothing is lost: favorites, ratings, play counts, bookmarks, play queues, scrobble history and Last.fm / ListenBrainz links all survive. No rescan needed.
• One manual fix: .nsp smart playlists using inPlaylist or notInPlaylist keep the old playlist ID on disk and need updating by hand.

Full write-up: https://gist.github.com/deluan/917ebc243c8b486101de857ffae6739b

If you can, please test it with your favourite client once it is merged, and reply here (or on our Discord) if anything looks off.

EDIT: For app/client developers: I'll merge the topSongsByArtistId PR at the same time as this ID migration. This means that you'll be able to detect if a server is migrated by checking the getOpenSubsonicExtensions response and looking for the topSongsByArtistId extension.

After years of breaking things, I think I'm finally at a point where I'm genuinely proud of my setup -so naturally, I have to share it with you all.

This is my single-server do-everything box. The whole point was to kick as many big-tech cloud services out of my life as possible. Photos, passwords, code, chat, even ML -all running in my closet/corner.

The guts:

• Ryzen 7 3800X (8 cores, 16 threads)
• 48GB of RAM (Channel A: 16GB+8GB, Channel B: 16GB+8GB | still dual channel with stock timings and clocks.)
• RTX 3050 8GB (handles GPU-accelerated processing with GPU passthrough to said LXC's)
• A couple of storage pools (Fast-Thin-LVM (Nvme) for stuff that needs speed, TB-Thin (Sata) for the bulk)
• Proxmox 9.2.5, kernel 7.0.14

Nothing crazy by today's standards, but honestly? It handles everything I throw at it without breaking a sweat.

The services:

Everything runs in LXC containers. If a service needs Docker, I run Docker inside the LXC - so each service gets its own dedicated container with its own Docker install. A couple of other things (like OpenWrt and DSM) live in VMs instead.

I've got the usual suspects - Immich for photos (goodbye Google Photos), Vaultwarden for passwords, and Matrix Synapse for chat. Networking side is Nginx Proxy Manager, WireGuard, Pi-hole, and OpenWrt routing traffic as well as DDNS-Updater to keep my domain up to date. Also running Gitea for my little coding projects, Kiwix for offline Wikipedia (because why not), Trilium for my scattered notes, homarr as the dashboard and of course lemmy, your reading this on it haha.

On the heavier side, I've got Ollama + Open WebUI running locally with GPU acceleration - the 3050 gets the job done.

Snapotter is in there too - it's an open-source, self-hosted file toolkit with 200+ tools for images, video, audio, PDF, and document processing. I use it so I don't have to rely on sketchy file conversion sites anymore. Convert, compress, OCR, strip metadata - all happens on my own hardware, files never leave my network. The GPU helps with some of the heavier image tasks too.

And yes - I'm running DSM (Arc Loader) in a VM with PCIe passthrough for the NAS. It's a bit overkill, but I wanted proper storage virtualization with direct hardware access.

I also will not lie- the GPU sits idle most of the time, but it's nice to have the acceleration.

Why LXC + Docker instead of just Docker?

I just like having each service in its own isolated container with its own Docker daemon. It makes backups and snapshots stupidly easy in Proxmox - when I inevitably screw something up at 1 AM (and I will), rolling back takes two clicks. Plus, it keeps dependency hell contained.

Dive into the Details

If you're curious about the configs, the philosophy, or just want to see the messy reality behind the setup, head over to organic-server.org. You'll find some more of my ramblings there.

Or, if you have a specific question, I'm always happy to chat here.

edit: I also forgot to mention I have degoog running. oops.

Hello everyone! I'm kinda curious about the services you self-host, and I would love to see what do y'all use!

I'll start, and list the services I self-host:

Thanks for reading, and thanks to anyone who participate!

Crossposted from https://thebrainbin.org/m/linux@lemmy.ml/t/1840283

Which approach do you think is better, and why?

1. FIDO2
2. HMAC-SHA1
3. OpenPGP (alternative guide)

Or do you think there is an even better way to use a hardware security token to unlock drives having LUKS full disk encryption?

Im in the market for a NAS solution. By NAS I don't mean running Jellyfin and some homepage thing for vibes, I mean your old-style "it just provides network attached storage".

I love the Jonsbo cases but I don't want to drop as much coin as building out a NAS based on one of them entails. I'm looking for an older office/home/gaming PC or case that has room for atleatst 4 3.5" HDD’s. Something around ten years old with maybe an i5 7th+ gen CPU. I don't need hardware RAID as I prefer ZFS anyway.

Ideas?

I've been trying to upgrade from 10.10 to 10.11 for a while now, as the Android TV app keeps nagging me, and every attempt ended with impossibly long library scan times.

After some thorough investigation, it appeared that a Home Videos type collection causes unending scan (yet to be solved), but also that Jellyfin does a lot of writes to the config directory (either database or metadata or both). Mine's on spinning media part of a ZFS pool. I tried a few performance tuning options, such as testing the config dir with recordsize (similar to block size) of 4K, 8K, 64K, 128K and library scans fell from 30-40 minutes down to 8-13min with 4K-64K. The ZFS tuning wiki suggest 64K recordsize with LZ4 compression for SQLite workloads such as Jellyfin. That seems to work as well as 4K and 8K but likely is faster when reading thumbnails and such.

Note that upgrading to 12-rc3, which is supposed to speed up library scans did not improve scan times for me. Optimizing config/database write speed did. I cross-checked the culprit by experimenting with moving the config dir to NVMe and RAM. Both of those got the scan times down to 8-9 minutes compared to the optimized spinning media's 12-13.

So if you had upgraded (or about to) to 10.11 your library scans are (about to get) dog slow and your Jellyfin's config dir resides on spinning media, optimize its write performance for SQLite.

Hi everyone,

I am the original author of Searx. I started Hister with a similar motivation: reducing our dependence on external search engines while keeping searches and personal data under our control.

Searx is a metasearch engine that forwards queries to other search providers. Hister takes a different approach. It builds a private full text index from content you choose, then searches that index entirely on your own infrastructure.

Hister can automatically index pages through its Firefox and Chrome extensions. It can also watch local directories, import browser history and bookmarks, index individual URLs, and crawl complete documentation sites.

The feature I find most useful is offline previews. Hister stores the readable content and HTML of indexed pages locally. You can open a result in a clean and sanitized preview beside the search results without visiting the original website again.

Some other features:

1. Full text search across web pages, PDFs, docx files, Markdown, OrgMode and text files
2. Phrase searches, field filters, date filters, wildcards, negation, aliases, labels, facets, and result priorities
3. Optional semantic search using an embeddings endpoint you configure
4. Persistent website crawls
5. Imports from browser history, Linkwarden, Karakeep, Shaarli, Wallabag, and Linkding
6. Web, terminal, command line, HTTP API, and MCP interfaces
7. SQLite and PostgreSQL support, plus optional multiple user hosting

Hister cannot replace a global search engine (yet) for subjects you have never encountered because it only searches what you have indexed. My workflow is to search Hister first, then use its shortcut to fall back to traditional search when I need broader web results.

The project is free software under the AGPLv3+ license. It can be installed as a standalone binary or with Docker.

Project: https://github.com/asciimoo/hister

Website and documentation: https://hister.org/

Small read-only demo: https://demo.hister.org/

I'd appreciate feedback, questions, and suggestions as well as joining our growing community.

AI disclosure: AI assisted contributions are not strictly prohibited, but all contributions should be made by humans. More details: https://github.com/asciimoo/hister/blob/master/CONTRIBUTING.md#ai-policy

With v0.63, audio streamer Navidrome finally got full lyrics support. I just wanted to try it out and fell flat on my face because... well, not even the official docs say anything about lyrics. Also, I'm not too familiar with how lyrics are added to songs in general. So my questions are these:

1. How can I add any lyrics to my songs so the web client will display them?
2. What formats would you recommend sticking with? (TTML, ELRC, SRT, YAML, LRC, or even TXT)
3. Is there a way to automate adding lyrics in bulk (instead of tedious manual work)?

12 years and 11 months of powered-on time for this SSD... I should definitely turn it on for another month lol

10 years powered-on time for this HDD. Who says HDDs aren't reliable? 😂

Anyone got better numbers than these?

For $600 the Minisforum MS-R1 gives you 64GB DDR5 ECC, 12 cores, dual 10GbE, a real PCIe 4.0 x8 slot, M.2 NVMe, Pi-compatible 40-pin GPIO, and actual UEFI boot. It runs Debian and Proxmox/KVM.

I've read that the CPU is trash compared to intel/amd in performance and in TDP, but you can't build a mini pc/server on intel/amd right now for thaf price with that amount of RAM.

Even just buying the 64GB ddr5 RAM as sticks will be like over 800$...

In the low budget range you can go with a Pi 5 16GB which is now ~$300. Add PSU, case, NVMe HAT, PCIe HAT and you're at $500+. It's way too expensive for what you get, compared to spending a bit more and going with minisforum.

Yeah you can get old used boxes with that amount of RAM for maybe the same price, but they'll such 200W and electricity is expensive where I live.

My current pine64 soquartz cluster over the past 5 years has been dying node by node and I can't run anything more demanding on it (like game servers or local AI). It cost me about 600$ back then with 5x blade + nvme + soquartz module, a poe switch and a case with fans. Kinda seems like a bad deal now, I'm stuck with all the docker swarm issues and the bad cpu cores and max 8gb ram per node. Oh and it draws 52W. If the minisforum 12W TDP is correct, I will save over 100$ per year on electricity costs alone.

Maybe i'm biased and trying to justify my own purchase ... let me know if I'm wrong about it being good value.

https://github.com/Xyphyn/photon

you should know - photon selfhosted lemmy client is absolutely nice.
You can login from multiple acounts on differnet instances and effortlessly switch between them.
UI is just so much nicer than default lemmy UI.

you can run it in docker, or just use this instance: https://phtn.app/

I don't really know much about M.2 slots and the different capabilities and how the key type corresponds, so I don't want to spend money on something that won't work.

There's an unused slot on the motherboard marked 'M.2 PCIe / SATA1'. I believe it's M-keyed.

Can it be used with an M+B keyed adapter like this one? Or will it physically fit, but the socket itself isn't wired to work with an ethernet adapter? Is there a command I can run to figure out the capabilities of that slot?

My plan is to use this machine as an OpenWrt router to replace the shitty Linksys one my ISP supplied, but it would obviously need a second ethernet socket. My home wifi is dealt with by a TP-Link mesh network, so I don't need it to have wifi and bluetooth. I could use the slot that the networking card is using, but if I can retain those then that would be ideal for any future flexibility I may need.

I have set up slskd in a lxd container using the binary from github

I am trying to disable logging in while I am on my local network. I have tried setting the authenticate: disabled true flag but its not working

anybody know how to do this?

Hello everyone! 👋✌️

I've try to use Dovecot + Postfix for setting up my own E-Mail server 📬

But I have some troubles here 😅. I can sends messages through my E-Mail address 🙂📨, but I can't receives messages those was be sent from different address 📩❌😅

Please, help me to fix this issue who ones who can help me 🔧😁

The logs from journalctl -xeu postfix

Jul 31 14:02:56 mail.xolat.games postfix/qmgr[1163]: CC268296: from=<>, size=2889, nrcpt=1 (queue active)
Jul 31 14:02:56 mail.xolat.games dovecot[22176]: lda(root)<22176><5eFAMRCrbGqgVgAAuoFhiA>: Warning: Failed to parse address from `From_'-line: Missing domain
Jul 31 14:02:56 mail.xolat.games dovecot[22176]: lda(root)<22176><5eFAMRCrbGqgVgAAuoFhiA>: Error: mkdir(/home/root/Maildir) failed: Permission denied (euid=8(mail) egid=8(mail) missing +w perm: /home, dir owned by 0:0 mode=0755)
Jul 31 14:02:56 mail.xolat.games dovecot[22176]: lda(root)<22176><5eFAMRCrbGqgVgAAuoFhiA>: Error: mkdir(/home/root/Maildir) failed: Permission denied (euid=8(mail) egid=8(mail) missing +w perm: /home, dir owned by 0:0 mode=0755)
Jul 31 14:02:56 mail.xolat.games dovecot[22176]: lda(root)<22176><5eFAMRCrbGqgVgAAuoFhiA>: Error: Mailbox INBOX: Failed to autocreate mailbox: Internal error occurred. Refer to server log for more information. [2026-07-31 14:02:56]
Jul 31 14:02:56 mail.xolat.games dovecot[22176]: lda(root)<22176><5eFAMRCrbGqgVgAAuoFhiA>: Error: sieve: msgid=<20260727174421.CC268296@mail.xolat.games>: failed to store into mailbox 'INBOX': Failed to autocreate mailbox: Internal error occurred. Refer to server log for more information. [2026-07-31 14:02:56]
Jul 31 14:02:56 mail.xolat.games dovecot[22176]: lda(root)<22176><5eFAMRCrbGqgVgAAuoFhiA>: Error: sieve: failed to open logfile (LOGGING TO STDERR): open(/var/lib/dovecot/sieve/default.sieve.log) failed: Permission denied (euid=8(mail) egid=8(mail) missing +w perm: /var/lib/dovecot/sieve, we're not in group 1004(vmail), dir owned by 1004:1004 mode=0775)
Jul 31 14:02:56 mail.xolat.games dovecot[22176]: lda(root)<22176><5eFAMRCrbGqgVgAAuoFhiA>: Error: sieve: Execution of script 'default/default' was aborted due to temporary failure (user logfile /var/lib/dovecot/sieve/default.sieve.log may reveal additional details)
Jul 31 14:02:56 mail.xolat.games postfix/local[22175]: CC268296: to=<root@xolat.games>, orig_to=<postmaster@xolat.games>, relay=local, delay=332315, delays=332315/0.02/0/0.06, dsn=4.3.0, status=deferred (temporary failure. Command output: sieve: info: started log at 2026-07-31 14:02:56 +0000. error: msgid=<20260727174421.CC268296@mail.xolat.games>: failed to store into mailbox 'INBOX': Failed to autocreate mailbox: Internal error occurred. Refer to server log for more information. [2026-07-31 14:02:56]. )

The logs from cat /var/log/mail.log

2026-07-31T14:02:56.763692+00:00 mail postfix/qmgr[1163]: CC268296: from=<>, size=2889, nrcpt=1 (queue active)
2026-07-31T14:02:56.828022+00:00 mail dovecot: lda(root)<22176><5eFAMRCrbGqgVgAAuoFhiA>: Warning: Failed to parse address from `From_'-line: Missing domain
2026-07-31T14:02:56.830219+00:00 mail dovecot: lda(root)<22176><5eFAMRCrbGqgVgAAuoFhiA>: Error: mkdir(/home/root/Maildir) failed: Permission denied (euid=8(mail) egid=8(mail) missing +w perm: /home, dir owned by 0:0 mode=0755)
2026-07-31T14:02:56.830528+00:00 mail dovecot: lda(root)<22176><5eFAMRCrbGqgVgAAuoFhiA>: Error: mkdir(/home/root/Maildir) failed: Permission denied (euid=8(mail) egid=8(mail) missing +w perm: /home, dir owned by 0:0 mode=0755)
2026-07-31T14:02:56.830731+00:00 mail dovecot: lda(root)<22176><5eFAMRCrbGqgVgAAuoFhiA>: Error: Mailbox INBOX: Failed to autocreate mailbox: Internal error occurred. Refer to server log for more information. [2026-07-31 14:02:56]
2026-07-31T14:02:56.832453+00:00 mail dovecot: lda(root)<22176><5eFAMRCrbGqgVgAAuoFhiA>: Error: sieve: msgid=<20260727174421.CC268296@mail.xolat.games>: failed to store into mailbox 'INBOX': Failed to autocreate mailbox: Internal error occurred. Refer to server log for more information. [2026-07-31 14:02:56]
2026-07-31T14:02:56.832584+00:00 mail dovecot: lda(root)<22176><5eFAMRCrbGqgVgAAuoFhiA>: Error: sieve: failed to open logfile (LOGGING TO STDERR): open(/var/lib/dovecot/sieve/default.sieve.log) failed: Permission denied (euid=8(mail) egid=8(mail) missing +w perm: /var/lib/dovecot/sieve, we're not in group 1004(vmail), dir owned by 1004:1004 mode=0775)
2026-07-31T14:02:56.832661+00:00 mail dovecot: lda(root)<22176><5eFAMRCrbGqgVgAAuoFhiA>: Error: sieve: Execution of script 'default/default' was aborted due to temporary failure (user logfile /var/lib/dovecot/sieve/default.sieve.log may reveal additional details)
2026-07-31T14:02:56.843566+00:00 mail postfix/local[22175]: CC268296: to=<root@xolat.games>, orig_to=<postmaster@xolat.games>, relay=local, delay=332315, delays=332315/0.02/0/0.06, dsn=4.3.0, status=deferred (temporary failure. Command output: sieve: info: started log at 2026-07-31 14:02:56 +0000. error: msgid=<20260727174421.CC268296@mail.xolat.games>: failed to store into mailbox 'INBOX': Failed to autocreate mailbox: Internal error occurred. Refer to server log for more information. [2026-07-31 14:02:56]. )
2026-07-31T14:04:25.897233+00:00 mail postfix/submission/smtpd[22193]: connect from unknown[46.101.119.210]
2026-07-31T14:04:32.882147+00:00 mail postfix/submission/smtpd[22193]: SSL_accept error from unknown[46.101.119.210]: lost connection
2026-07-31T14:04:32.888445+00:00 mail postfix/submission/smtpd[22193]: NOQUEUE: lost connection after CONNECT from unknown[46.101.119.210]
2026-07-31T14:04:32.888622+00:00 mail postfix/submission/smtpd[22193]: disconnect from unknown[46.101.119.210] commands=0/0
2026-07-31T14:32:00.045293+00:00 mail dovecot: imap-login: Logged in: user=<hello>, method=PLAIN, rip=95.25.67.217, lip=5.35.81.149, mpid=22438, TLS, session=<uFZlDOlXSPRfGUPZ>
2026-07-31T14:32:01.145793+00:00 mail dovecot: imap-login: Logged in: user=<hello>, method=PLAIN, rip=95.25.67.217, lip=5.35.81.149, mpid=22443, TLS, session=<MuI0DelX4vdfGUPZ>

Postfix config at cat /etc/postfix/main.cf

# Which domain that locally-originated mail appears to come from.
# Debian policy suggests to read this value from /etc/mailname.
#XX needs a review in postinst&config
#myorigin = /etc/mailname
#myorigin = $mydomain
mydomain = xolat.games
myorigin = $mydomain
mail_name = $mydomain

# Text that follows the 220 code in the SMTP server's greeting banner.
# You MUST specify $myhostname at the start due to an RFC requirement.
smtpd_banner = $myhostname ESMTP $mail_name (Debian)

# IP protocols to use: ipv4, ipv6, or all
# (set this explicitly so `post-install upgrade-configuration' wont complain)
inet_protocols = ipv4

# List of "trusted" SMTP clients (maptype:mapname allowed) that have more
# privileges than "strangers".  If mynetworks is not specified (the default),
# mynetworks_style is used to compute its value.
#mynetworks_style = class
#mynetworks_style = subnet
mynetworks_style = host
#
mynetworks = 127.0.0.0/12 [::ffff:127.0.0.0]/104 [::1]/128

# Uncomment the next line to generate "delayed mail" warnings
#delay_warning_time = 4h

# List of domains (maptype:mapname allowed) that this machine considers
# itself the final destination for.
mydestination = $myhostname, xolat.games, mail.xolat.games, localhost.xolat.games, localhost

# Maximum size of a user mailbox
mailbox_size_limit = 0

# Optional external command to use instead of mailbox delivery.  If set,
# you must set up an alias to forward root mail to a real user.
#mailbox_command = /usr/bin/procmail
#mailbox_command = /usr/bin/procmail -a "$EXTENSION"
#mailbox_command = 

# List of alias maps to use to lookup local addresses.
# Per Debian Policy it should be /etc/aliases.
alias_maps = hash:/etc/aliases

# List of alias maps to make indexes on, when running newaliases.
alias_database = hash:/etc/aliases

# Notify (or not) local biff service when new mail arrives.
# Rarely used these days.
biff = no

# Separator between user name and address extension (user+foo@domain)
#recipient_delimiter = +
recipient_delimiter = +

# A host to send "other" mail to
#relayhost = $mydomain
#relayhost = [gateway.example.com]
#relayhost = [ip.add.re.ss]:port
#relayhost = uucphost
relayhost = 

# Where to look for Cyrus SASL configuration files.  Upstream default is unset
# (use compiled-in SASL library default), Debian Policy says it should be
# /etc/postfix/sasl.
cyrus_sasl_config_path = /etc/postfix/sasl

# SMTP server RSA key and certificate in PEM format
smtpd_tls_cert_file = /etc/letsencrypt/live/mail.xolat.games/fullchain.pem
smtpd_tls_key_file = /etc/letsencrypt/live/mail.xolat.games/privkey.pem
smtpd_tls_CAfile = /etc/ssl/certs/ca-certificates.crt
smtpd_tls_auth_only = yes
smtpd_tls_loglevel = 1
# SMTP Server security level: none|may|encrypt
smtpd_tls_security_level = may

smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
smtpd_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1

smtpd_sasl_auth_enable = yes
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth

smtpd_sasl_security_options = noanonymous, noplaintext
smtpd_sasl_tls_security_options = noanonymous
milter_default_action = accept
milter_protocol = 6
smtpd_milters = inet:localhost:8991
non_smtpd_milters = inet:localhost:8991
mailbox_command = /usr/lib/dovecot/deliver

smtpd_forbid_bare_newline = normalize
smtpd_forbid_bare_newline_exclusions = $mynetworks

smtpd_sender_login_maps = pcre:/etc/postfix/login_maps.pcre
smtpd_sender_restrictions = reject_sender_login_mismatch, permit_sasl_authenticated, permit_mynetworks, reject_unknown_reverse_client_hostname, reject_unknown_sender_domain
smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unauth_destination, reject_unknown_recipient_domain
smtpd_relay_restrictions = permit_sasl_authenticated, reject_unauth_destination
smtpd_helo_required = yes
smtpd_helo_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_invalid_helo_hostname, reject_non_fqdn_helo_hostname, reject_unknown_helo_hostname

home_mailbox = Maildir/INBOX

default_privs = mail

header_checks = regexp:/etc/postfix/header_checks

# List of CAs for SMTP Client to trust
# Prefer this over _CApath when smtp is running chrooted
smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt
smtp_tls_loglevel = 1
# SMTP Client TLS security level: none|may|encrypt|...
smtp_tls_security_level = may

smtp_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
smtp_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1

# SMTP Client TLS session cache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
#smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
myhostname = mail.xolat.games
inet_interfaces = all

Postfix config at cat /etc/postfix/master.cf

# Postfix master process configuration file.  For details on the format
# of the file, see the master(5) manual page (command: "man 5 master" or
# on-line: https://www.postfix.org/master.5.html).
#
# Do not forget to execute "postfix reload" after editing this file.
#
# ==========================================================================
# service type  private unpriv  chroot  wakeup  maxproc command + args
#               (yes)   (yes)   (no)    (never) (100)
# ==========================================================================
#smtp	unix	-	-	n	-	-	smtp
smtp      inet  n       -       y       -       -       smtpd
#smtp      inet  n       -       y       -       1       postscreen
#smtpd     pass  -       -       y       -       -       smtpd
#dnsblog   unix  -       -       y       -       0       dnsblog
#tlsproxy  unix  -       -       y       -       0       tlsproxy
# Choose one: enable submission for loopback clients only, or for any client.
#127.0.0.1:submission inet n -   y       -       -       smtpd
   -o content_filter=spamassasin
submission inet n       -       y       -       -       smtpd
   -o syslog_name=postfix/submission
#  -o smtpd_forbid_unauth_pipelining=no
   -o smtpd_tls_security_level=encrypt
   -o smtpd_sasl_auth_enable=yes
   -o smtpd_tls_auth_only=yes
   -o smtpd_client_restrictions=permit_sasl_authenticated,reject
   -o smtpd_sender_restrictions=reject_sender_login_mismatch
   -o smtpd_sender_login_maps=pcre:/etc/postfix/login_maps.pcre
   -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject_unauth_destination
#  -o local_header_rewrite_clients=static:all
#  -o smtpd_hide_client_session=yes
#  -o smtpd_reject_unlisted_recipient=no
#     Instead of specifying complex smtpd_<xxx>_restrictions here,
#     specify "smtpd_<xxx>_restrictions=$mua_<xxx>_restrictions"
#     here, and specify mua_<xxx>_restrictions in main.cf (where
#     "<xxx>" is "client", "helo", "sender", "relay", or "recipient").
#  -o smtpd_client_restrictions=
#  -o smtpd_helo_restrictions=
#  -o smtpd_sender_restrictions=
#  -o smtpd_relay_restrictions=
#  -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject
#  -o milter_macro_daemon_name=ORIGINATING
# Choose one: enable submissions for loopback clients only, or for any client.
#127.0.0.1:submissions inet n  -       y       -       -       smtpd
#submissions     inet  n       -       y       -       -       smtpd
#  -o syslog_name=postfix/submissions
#  -o smtpd_forbid_unauth_pipelining=no
   -o smtpd_tls_wrappermode=yes
#  -o smtpd_sasl_auth_enable=yes
#  -o local_header_rewrite_clients=static:all
#  -o smtpd_hide_client_session=yes
#  -o smtpd_reject_unlisted_recipient=no
#     Instead of specifying complex smtpd_<xxx>_restrictions here,
#     specify "smtpd_<xxx>_restrictions=$mua_<xxx>_restrictions"
#     here, and specify mua_<xxx>_restrictions in main.cf (where
#     "<xxx>" is "client", "helo", "sender", "relay", or "recipient").
#  -o smtpd_client_restrictions=
#  -o smtpd_helo_restrictions=
#  -o smtpd_sender_restrictions=
#  -o smtpd_relay_restrictions=
#  -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject
#  -o milter_macro_daemon_name=ORIGINATING
smtps	inet	n	-	y	-	-	smtpd
   -o syslog_name=postfix/smtps
   -o smtpd_tls_wrappermode=yes
   -o smtpd_sasl_auth_enable=yes
spamassasin	unix	-	n	n	-	-	pipe
	user=debian-spamd argv=/usr/bin/spamc -f -e /usr/sbin/sendmail -oi -f ${sender} ${recipient}	
#628       inet  n       -       y       -       -       qmqpd
pickup    unix  n       -       y       60      1       pickup
cleanup   unix  n       -       y       -       0       cleanup
qmgr      unix  n       -       n       300     1       qmgr
#qmgr     unix  n       -       n       300     1       oqmgr
tlsmgr    unix  -       -       y       1000?   1       tlsmgr
rewrite   unix  -       -       y       -       -       trivial-rewrite
bounce    unix  -       -       y       -       0       bounce
defer     unix  -       -       y       -       0       bounce
trace     unix  -       -       y       -       0       bounce
verify    unix  -       -       y       -       1       verify
flush     unix  n       -       y       1000?   0       flush
proxymap  unix  -       -       n       -       -       proxymap
proxywrite unix -       -       n       -       1       proxymap
smtp      unix  -       -       y       -       -       smtp
relay     unix  -       -       y       -       -       smtp
        -o syslog_name=${multi_instance_name?{$multi_instance_name}:{postfix}}/$service_name
#       -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
showq     unix  n       -       y       -       -       showq
error     unix  -       -       y       -       -       error
retry     unix  -       -       y       -       -       error
discard   unix  -       -       y       -       -       discard
local     unix  -       n       n       -       -       local
virtual   unix  -       n       n       -       -       virtual
lmtp      unix  -       -       y       -       -       lmtp
anvil     unix  -       -       y       -       1       anvil
scache    unix  -       -       y       -       1       scache
postlog   unix-dgram n  -       n       -       1       postlogd

If I will need to put here some Dovecot's configs - let me know from which file in /etc/dovecot/conf.d/ directory 📂, okay? 😁

Thanks in advance! 😉

I selfhost several public-facing sites, including my personal blog. I'll be needing to relocate my servers soon, though, and I wanted something more "proper" to display in their place while the servers are offline.

I won't repeat the whole post here (see link), but I ultimately set up a CF worker that I can enable with the flip of a switch whenever my server will be down.

It's a temporary, hosted solution to a common self-hosting problem, so I think it still fits here... but no hard feelings if mods decide otherwise.

I have 27 containers running with rancher on windows. Long story short, I'm tired of the resource use and stress on my machine by running the VM. My data folders are split up by duty (admin, utility, media, virtualization) each duty has its own folder, containing the services' folder with data/config directories and one compose.yaml file for those services. All the compose files are connected to a master compose file in the parent directory that starts all of them. My compose files have references to the media hdds that are defined with an .env file next to the master compose.

I need to clone my docker setup to a Debian install I've been working on on its own ssd. I've been screwing with Linux unsuccessfully for almost 20 years, so my cli is weak. I'm looking for a tool that will clone my volumes and containers.

What do you use?

Hello everyone! Daniel here, and I’m back with a new Linkwarden release across web and mobile.

For those who are wondering, Linkwarden is an open-source collaborative bookmarking tool that keeps permanent snapshot of the content of the links you save, so you can still access them even if the original content is no longer available. Linkwarden is available as a Cloud offering, or you can get the source code on GitHub and self-host it on your own server with no strings attached. If you find it useful, consider starring the repo so others can discover it too!

So let’s get into it.

What's new in mobile:

• Support for self-signed certificates and custom request headers: Android now accepts self-signed certificates, and you can add custom request headers to the app's requests. This makes the app usable with instances behind a reverse proxy or auth layer like Authelia or Cloudflare Access.
• Re-preserve link formats: You can now re-generate a link's preserved formats (screenshot, PDF, readable view) from the mobile app, useful if the original preservation failed or the page has changed since.
• Change link's banner: You can now set a custom banner image for a link when editing it.
• Access more account options in Settings: Settings now has a "More Account Settings" option that opens your full account settings inside the app, using your existing session.

(Android is out, iOS is still in review and it should be out later today.)

What's new in web:

• Refreshed, more modern design: The top navbar is removed and its functionality moved into the sidebar, plus a number of smaller UX fixes. 
• New search modal with recent search history: Press ⌘K (or Ctrl+K) anywhere to open a search modal. It also keeps your recent searches stored locally in the browser. 
• New "System" theme option: The theme can now follow your OS light/dark preference instead of being set manually. 
• PNG support for link banners: Link banners now accept PNG uploads in addition to JPEG.

There’s more…

As always, there's a long tail of smaller improvements across the web and the mobile app.

Full Changelog: https://github.com/linkwarden/linkwarden/compare/v2.15.1...v2.16.0

Thanks!

Thanks to everyone using Linkwarden, reporting bugs, suggesting improvements, contributing to the project, responsibly disclosing security issues, and supporting its development. Your contributions genuinely shape every release. 💙

If you'd like to try Linkwarden without dealing with server setup and maintenance, our Cloud offering is the easiest way to get started.

Hope you enjoy the latest updates!

Since the last release "Mort", dokuwiki supports markdown natively in addition to the old syntax. This can be activated in the settings (incl. a combination of both).

I think this is a great step for dokuwiki. Markdown is the modern syntax for simple text based documents. This allows people to write dokuwiki pages without learning the old syntax (assuming most people already know markdown). Also a possible migration to or from dokuwiki gets way easier. But it also comes at a cost. There is a mode where dokuwiki allows both syntax in the same document. this leads do documents that are neither complete markdown nor complete dokuwiki and thus completely locked into dokuwiki.