Is this about the straight werewolves author?

TBH, it sounds like you have nothing to worry about then! Open ports aren’t really an issue in-and-on itself, they are problematic because the software listening on them might be vulnerable, and the (standard-) ports can provide knowledge about the nature pf the application, making it easier to target specific software with an exploit.

Since a bot has no way of finding out what services you are running, they could only attack caddy - which I’d put down as a negligible danger.

My ISP blocks incoming data to common ports unless you get a business account.

Oof, sorry, that sucks. I think you could still go the route I described though: For your domain example.com and example service myservice, listen on port :12345 and drop everything that isn’t requesting myservice.example.com:12345. Then forward the matching requests to your service’s actual port, e.g. 23456, which is closed to the internet.

Edit: and just to clarify, for service otherservice, you do not need to open a second port; stick with the one, but in addition to myservice.example.com:12345, also accept requests for otherservice.example.com:12345, but proxy that to the (again, closed-to-the-internet) port :34567.

The advantage here is that bots cannot guess from your ports what software you are running, and since caddy (or any of the mature reverse proxies) can be expected to be reasonably secure, I would not worry about bots being able to exploit the reverse proxy’s port. Bots also no longer have a direct line of communication to your services. In short, the routine of “let’s scan ports; ah, port x is open indicating use of service y; try automated exploit z” gets prevented.

I am scratching my head here: why open up ports at all? It it just to avoid having to pay for a domain? The usual way to go about this is to only proxy 443 traffic to the intended host/vm/port based on the (sub) domain, and just drop everything else, including requests on 443 that do not match your subdomains.

Granted, there are some services actually requiring open ports, but the majority don’t (and you mention a webserver, where we’re definitely back to: why open anything beyond 443?).

Client side, under advanced:

That’s a setting

ALright, thanks for the recommendation :) And yeah, “weird” and “metal” are good descriptions. Additionally, the backstory we got in S1 was definitely “fire”.

I liked the first 80% of the first season, and stopped watching halfway into S02E01. Is it worth continuing? Do we get any answers? Are they satisfying?

Re: Spain: the headline was bullshit. If you are arrested and then investigated and it turns out you use Graphene, they’ll go “huh, I wonder why. We’ve seen a lot of drug dealers use Graphene. Let’s investigate in that direction as well”.

Noone is being arrested or targeted FOR having GOS.

InfCloud. Works well with Radicale, and does contacts, too.

It’s not pretty, but works very well for the 5/100 times I want to check through a browser instead of Calendar app / Thunderbird.

Yes. Using simple-nixos-mailserver as the foundation.

Really great experience, and have had no deliverability issues.

I hope forgejo’s federation efforts come along. Being able to host projects on my own instance, yet receive contributions without having to allow people to register on my instance, would give me the push to completely abandon Github.

Drop if-let

Over my cold dead body. if-let-else is such a fantastic pattern. Makes everything an order of magnitude more readable. Works so nicely for unwrapping opts/errs.

Piefuckers

I’m just going to leave this here: Wigner’s friend.

In Timelike Infinity, there’s a group following that logic through to its conclusion, committing a bit of terrorism on the galactic scale to make Ultimate Observer-senpai notice them from the end of time and the universe.

Batshit insane, 10/10, one of Baxter’s tamer plotlines.

No problem. If you do decide to give NixOS a try, feel free to ask about anything should things be unclear :)

Yeah… I heard that too, about half a year after I got really into nix.

To be honest, I try to keep away from community drama as much as possible, so I am not entirely up to date here. I think (and I might be wrong, if someone reading this knows better, correct me!) there’s three main points of contention:

• Queer, PoC, and other “minority” users experienced harassment on (semi-)official channels (Github, Discord, Forums): That fucking sucks. I’m queer myself and lucky enough to not have experienced any of that in my time with Nix, but if I had not decided on Nix yet and learned about this before getting invested, it might have given me enough pause to not put any time into this. In all honesty however, that’s sadly a problem with many, many OSS projects.
• Governance and Funding: I do not know much about the governance, afaik there was a bit of drama about the inventor of Nix acting like a (benevolent?) dictator for life, but those issues should have been resolved with a new governance model. The really big, inciting incident of a lot of community drama with Nix through was a bit over a year ago, when the committee in question decided to let Anduril fund a NixCon, against the explicit and loud protests of the community. That sucked. Hard. While obviously all kind of shit companies use all sorts of great OSS projects, inviting Anduril to sponsor your official conference is… not really understandable.
• Conflicts of Interest: the aforementioned inventor of Nix owns a company heavily invested in the nix ecosystem. A bit reminiscent of the way that, say, Google holds Chromium by the balls, though to a much less severe extent. Miraculously, features that are “extremely unstable” in nix (but wanted by the community for a long time) suddenly get released in closed source to enterprise customers… However, the open source project is separate from, and not beholden to the whims of, said company.

My position on all three points is this: They are not great; but a) they do not threaten the ecosystem, which is mature and independent of this drama, and not reliant on one or a couple of central, potentially problematic, people; and b) there are community projects that actively and effectively do distance themselves from all of these points (namely: Lix) and which are drop-in replacements for the core nix language and compiler, meaning if the upstream project actively did something to really piss you of, you could move with very little work to something independent of Nix.

I hope this will not become necessary, because Nix is genuinely magic. Once you get the hang of it, nothing on your computer is particularly difficult anymore. You also get the best-in-class package management (and it’s easy! Once you have configured your own system to your liking, you already know everything you need to package your own software and contribute to nixpkgs!), being “bleeding edge” yet at the same time incredibly stable (seriously, I have switched all of my servers and VMs to Nix and I have not had one single incident once, including after updating machines after forgetting about them for 1.5+ years).

Anyways. Sorry for the wall of text lol.

As someone else has said: NixOS. You said in a comment that you use Arch because of the AUR. Good news, nixpkgs is larger and fresher than the AUR, without needing to tap into any kind of third-party/unofficial repo.

The unstable branch is essentially a rolling release (and very stable despite its name). I am happily gaming on it with Steam. During installation, you can just choose to not install a desktop. (However, due to how nix works, it’s trivial to rip out the entire DE at any point, should you so choose.)

But it is a learning curve for sure. Steep, but not very long.

Was gonna say. Nix matches all of OPs boxes.

This is about as useful as the assholes going “It’s not Pedophilia, it’s Hebephilia!”.