Kurzer Hinweis an andere Mastodon-Admins: Diese Registrierungs-Spam-Welle ist noch nicht überstanden.

Bei lsbt.me kamen zunächst massenhaft API-Registrierungen mit Python/aiohttp rein. Auffällig waren Nutzernamen nach dem Muster bp plus 16 Hex-Zeichen und als Antragstext immer Automated protocol deliverability probe. Eine enge Sperre auf diesen User-Agent hat die erste Welle gestoppt.

Heute kamen trotzdem fünf neue Registrierungen mit denselben Nutzernamen und demselben Antragstext. Der Bot gab sich diesmal einfach als Chrome 126 aus. Genau deshalb taugt ein User-Agent nur als kurzfristiger Filter. Er ist ein frei wählbarer Header.

Die Requests laufen über POST /api/v1/accounts. Dieser Endpoint erlaubt Client-Apps, einen neuen lokalen Account direkt in der App anzulegen. Für OAuth-Verbindungen bestehender Accounts braucht ihn keine App. Auch #FediSuite nutzt ihn nicht. Sie registriert sich über /api/v1/apps, holt die Zustimmung über /oauth/authorize und arbeitet danach mit einem User-Token. Die normale Registrierung über die Mastodon-Webseite läuft ebenfalls getrennt über POST /auth.

Ich habe die API-Kontoerstellung auf lsbt.me deshalb komplett abgeschaltet. Webregistrierung, OAuth und bestehende Clients laufen unverändert weiter. Wer einen neuen Account möchte, registriert sich einmal ganz normal wie bisher im Web und kann danach jeden Client nutzen.

Falls ihr diesen optionalen Native-Sign-up-Weg ebenfalls nicht anbieten wollt, könnt ihr in eurem Nginx-Serverblock vor dem allgemeinen location /-Block Folgendes ergänzen. Das Beispiel setzt den in vielen Mastodon-Nginx-Configs vorhandenen @proxy voraus:

location = /api/v1/accounts {
  limit_except GET {
    deny all;
  }
  try_files $uri @proxy;
}

Damit erhält nur POST /api/v1/accounts ein 403. Der lesende GET-Endpoint bleibt erreichbar. Danach wie immer nginx -t und erst bei erfolgreichem Test reloaden.

#Mastodon #Fediverse #MastoAdmin #FediAdmin #FediMod #FediBlock #Moderation #Registration #Spam #Nginx #SelfHosting #SysAdmin #ActivityPub

If you are like me and run your own private, Nextcloud server that isn't exposed to the internet and want to sync podcasts between your phone and computer using gPodder sync, you'll quickly discover that no podcast client will talk to a server with a self-signed certificate. Not because it's technically dangerous, but because the developers have chosen not to support it. A single checkbox would fix it. They've been asked. They won't do it. Why? Skip to the last paragraph.

And yeah, with the amount of work I had to put it - I'm mad. ​​

This pattern repeats across every app, every platform, and the Android operating system itself. The consistent push from podcast apps, Google (Android) and the Linux desktop ecosystem is toward public certificate authorities and away from privately managed infrastructure. The people who suffer is anyone who wants to run their own server without exposing it to the internet.

Adding a certificate to Ubuntu's system trust store is straightforward and works immediately for natively installed applications. Flatpak (increasingly pushed as the Linux desktop standard) is a different problem entirely. Flatpak isolates apps from the host system, and the mechanism that's supposed to bridge host certificates into that sandbox is broken.

For several versions, Android has had a deliberate policy to hamper users to install their own certificates. It's a pain. App developers can opt in to trusting user-installed certificates with a one-line configuration change. Most haven't. AntennaPod hasn't.

None of this is technically insurmountable. But the cumulative friction across every layer... The apps, the OS, the desktop packaging format, the server appliance all pushes in the same direction: Self-hosting with your own certificates is made difficult everywhere, simultaneously, by parties who agree on the plausible-sounding security justification:

"The only safe option is to have a publicly exposed server with a CA-signed certificate". Like that's safer than accessing a server with a manually verified certificate through a closed VPN mesh network.

#selfhosted #selfhosting #self-hosted #self-hosting #antennapod #flatpak #gpodder #nextcloud #nextcloudpi

Quick heads-up for other Mastodon admins: this registration spam wave isn't over yet.

On lsbt.me, we first saw a flood of API registrations using Python/aiohttp. The telltale signs were usernames following the pattern bp plus 16 hex characters, and the sign-up reason was always "Automated protocol deliverability probe". A narrow block on that user agent stopped the first wave.

Today, however, five new registrations came in with the same usernames and the same sign-up reason. This time the bot simply identified itself as Chrome 126. That's exactly why a user agent is only useful as a short-term filter. It's a header the client can set to anything.

The requests go to POST /api/v1/accounts. This endpoint lets client apps create a new local account directly in the app. No app needs it for OAuth connections to existing accounts. #FediSuite doesn't use it either. It registers itself via /api/v1/apps, obtains consent via /oauth/authorize, and then works with a user token. Regular sign-up through the Mastodon website is also handled separately via POST /auth.

So I've completely disabled API account creation on lsbt.me. Web sign-up, OAuth, and existing clients keep working as before. Anyone who wants a new account just signs up once on the web as usual and can then use any client.

If you'd also rather not offer this optional native sign-up path, you can add the following to your Nginx server block, before the general location / block. The example assumes the @proxy location that many Mastodon Nginx configs already include:

location = /api/v1/accounts {
  limit_except GET {
    deny all;
  }
  try_files $uri @proxy;
}

This returns a 403 only for POST /api/v1/accounts. The read-only GET endpoint remains reachable. As always, run nginx -t afterwards and only reload once the test passes.

#Mastodon #Fediverse #MastoAdmin #FediAdmin #FediMod #FediBlock #Moderation #Registration #Spam #Nginx #SelfHosting #SysAdmin #ActivityPub

So .tk domains are back, but they come with a 9 euro price tag now. - Dunno how long they'll be around but you can probably still get your first/last name if that's what you're into

#tech #technology #nerd #geek #selfhosting

For some odd reason, the last two months have been littered with weird bugs and quirks on my server.

As you or anyone knows who also administrates a home server, you should know this was all entirely my fault, as it would be. Suricata doesn't run very well on a cheap 1core VPS, lol.

Also, a hard lesson was learned: to know my problem before repairing it.

I completely remade my VPS from scratch without knowing all I had to do was turn Suricata off or uninstall it and find some other security solution.

I'm looking back into #crowdsec, which, if somehow misspelled leads to a lot of potentially strange new followers on anyone's account. I believe it locked me out once, but I'm really not sure. It may have been Suricata all along, sooo, I still have the configs for crowdsec I'll see how that goes for my public stuff - like the blog you're reading.

Oh, added Anubis. It's ~150MB of ram and just works, so... why not? I'm sure it isn't stopping every bot ever, but the low hanging fruit is better than nobody.

#selfhosting #homeserver #linux #debian #anubis

He-he, my file/kitchen server project is going well Finally, I assembled all necessary wiring to connect 5V/12V from PSU to the external HDDs, bough SATA<->eSATA cables and assembled the storage for 4 3.5" disks.

And it all even powered up and system tried to boot from a connected single disk (unsuccessfully, because disk still doesn't contain NetBSD )

Next step — somehow buy a 4th HDD (hope, a gas for delivery trucks will exist at that moment, and this is not even the biggest problem), setup RAID 1 for NetBSD's root and cgd+RAID1+FFS (or ZFS) for files.

#NetBSD #selfhosting #homelab

Alt...

Front view of homemade file server. There are ITX case with Intel Atom inside, the plastic gray box for electrical wiring on top of it and two 3D-printed black frames for 4 HDDs with 1 HDD installed and a fan connected. The system is powered up and tge fan is spinning. The power source on the background shows 12V on the display.

Alt...

The back view of homemade server. There are ITX case with 4 eSATA ports and one aviation grade connector for power, the gray box with power wirings, power connectors for HDDs and a frame for 4 HDDs with 1 HDD installed, on the background.

Alt...

The top view of homemade server. The ITX black case on the bottom; gray box with wires and 1HDD in frame for 4 HDDs on the top. Everything connected with standard colored cables from PC PSU, also there is a pink eSATA<->SATA cable on the top right corner of the photo.

Immich 3.2.0 mit verbesserter Suche

Die neue Version der selbstgehosteten Foto- & Videoverwaltung baut essentielle Funktionen weiter aus.

#Linux #Immich #OpenSource #Selfhosting

linuxnews.de/immich-3-2-0-mit-…

GOODBYE BIG TECH.

At the end of August @arbovm and I decided to move away from US Big Tech. Wanting @fluado to be an EU company while running on US infrastructure felt icky…

OUT: Google Cloud, Cloud Run, GitHub, Supabase Cloud, Firebase
IN: Hetzner, Docker Swarm, Forgejo, self-hosted Supabase DB & Auth.

Full article and table of all 17 infra changes: https://yves.vg/blog/leaving-us-big-tech-in-one-week.html

Feedback welcome :)

#digitalsovereignty #degoogle #devops #selfhosting #forgejo #hetzner #EUTech #europe

Has anyone around here installed Funkwhale with Docker?

I'm trying to install Funkwhale with Docker, and so far it's not working, so I'd like to at least compare the "docker-compose.yml" and the ".env" files to check if I can figure out why mine isn't working.

This is basically the error that comes up, when I try to run the database migrations:

"+ exec funkwhale-manage migrate
Traceback (most recent call last):
File "/venv/lib/python3.14/site-packages/django/db/backends/base/base.py", line 279, in ensure_connection
self.connect()
~~~~~~~~~~~~^^
File "/venv/lib/python3.14/site-packages/django/utils/asyncio.py", line 26, in inner
return func(*args, **kwargs)
File "/venv/lib/python3.14/site-packages/django/db/backends/base/base.py", line 256, in connect
self.connection = self.get_new_connection(conn_params)
~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^"

I'm using this tutorial:

https://docs.funkwhale.audio/stable/administrator/installation/docker.html

#Funkwhale #fediverse #selfhosting #help #docker

Moin! Wer hat Erfahrung mit #Meshtastic? Ich überlege, ins Mesh-Untergrundnetz abzutauchen, unabhängig von Handymast und Provider 😂 Klingt nach Prepper-Hobby, ist aber eigentlich nur konsequent zu Ende gedachtes #FOSS. Nein, mach ich natürlich nicht...

#offgrid #lora #selfhosting #schicksalsjahreeineskaisers

please boost.

i am ready to start providing email addresses to the community.

you may have 1GB mail box storage capacity free of charge.

the system-wide code of conduct is at:

https://solarpunk.au/

if you are interested in a non-free account, please click here:

https://ko-fi.com/comradevidak/tiers

the lowest membership tiers:

- $1.25 per month (2GB storage capacity)
- $15 per year (2GB storage capacity)

#selfhosting #server #email #permacomputing #solarpunk

Bitwarden and KeePassXC aren’t exact matches to 1Password, but they might be close enough. [I’ve heard of them, but I haven’t added them to my Linux distro.]

Both password systems are #FOSS. This is a significant difference relative to #1Password.

#Bitwarden is said to be more convenient than #KeePassXC. It supports cloud syncing, mobile apps, and other ease of use features. KeePassXC is said to offer more fine-grained control, but syncing is manual.

Both systems can be set up on a #selfhosting system, but that is entirely optional.

https://openalternative.co/compare/bitwarden/vs/keepassxc

#askfedi and I’ll check my dedi.

My #gotosocial instance has peered with almost 6k instances 👀 #selfhosting #homelab

Syncthing is encrypted peer-to-peer free open software for sharing files and synchronising folders between several different computers no matter where they are in the world. More info on the website:

🌱 https://syncthing.net

If you're moderately techy you can install via @yunohost at https://apps.yunohost.org/app/syncthing

If you're very techy the full manual documentation is at https://docs.syncthing.net

#SelfHosting #FOSS #Syncing #Encryption #FileSharing

Yesterday I accidentally nuked my music library in #plex after messing around with Linux permissions. I couldn't restore from a backup since I was also making other changes and recording a show on the DVR...

I fixed the error, but now I have to recreate all my playlists 🤦

#selfhosting #fail

Trying to figure out and track SSD health across my servers. Writing down a wear-out value for each drive for now to see the change, because different drives are reporting this value differently. So 95% may mean it is almost dead, or it is almost brand new.

Also, #Samsung NVMe wears out crazily fast.

#SSD #DriveHealth #Storage #HomeLab #SelfHosted #SelfHosting #SelfHost.

Alt...

A table listing SSD drives with two columns labeled August 27 and September 14. Each drive has a wear-out value written in each dated column.

A quick remark: we noticed professional companies are not allowed private repositories on Codeberg, but that's necessary for us to operate currently.

For now we pulled our repos and are considering self-hosting forgejo. Will unfortunately take some time, we also need to clean up some repos from internal data before we can make them public.

We're working on it!

#codeberg #forgejo #selfhosting #pwr2

🐧 Le mystère du jour : une vidéo qui refuse de jouer... mais seulement dans UN navigateur. Coupable improbable : Chrome ✅, Firefox ✅, mobile ✅... Vivaldi ❌ 🕵️

Spoiler : ce n'était ni Mastodon, ni PeerTube, ni NPM. Le vrai coupable ? Des codecs propriétaires Flatpak qui ont fait des siennes après une mise à jour. 🎬💥

Enquête complète (avec fausses pistes et vrai bug CORS trouvé en chemin) 👉 https://wiki.blablalinux.be/fr/video-illisible-vivaldi-mastodon-peertube

#SelfHosting #Mastodon #PeerTube #Linux #Homelab #FOSS

I really dislike Discord but all the people I know use it.

I feel like I have to in order to stay in touch with people I care about but the more I use it and with how often it breaks on #Linux I am pretty much fed up with it.

Any #selfhosting people out there want to tell me what they use?

Should I try to install a #Jitsimeet server on my #nas or what?

Looking for anyone who has successfully installed Proxmox on an HP ProLiant DL380 G6 with a Smart Array P411 controller. I have tried Proxmox 7, 8, and 9. Most attempts end in a black screen or kernel panic. Debian itself also fails to detect the RAID 0 logical drive. I have tried both the older CCISS driver and the modern HPSA driver with no luck. Ubuntu installs without issues and sees the array fine, but I do not want Ubuntu running bare metal. I chose Proxmox because the original ESXi install is full of security vulnerabilities and ongoing problems, and I need something better supported. Has anyone got Proxmox working on this exact hardware, or found a reliable way to make the P411 visible during install?

PS. unfortunately I cannot update the firmware right now and since it is not mine and it is for the place that are work in, this is the test hardware that they gave me to try proxmox and see if it's better than EXSI or not.
#Proxmox #ProxmoxVE #HPProLiant #DL380G6 #SmartArray #P411 #Homelab #SelfHosting #Linux #Virtualization

The XMPP Newsletter for August 2026 is out!

Read about the latest updates in the #XMPP universe and our #standards!

https://xmpp.org/2026/09/the-xmpp-newsletter-august-2026/

Enjoy reading! ☕

#jabber #chat #interoperability #SelfHosting #rtc #opensource #decentralization #federation #messaging #newsletter #xep

Alt...

The XMPP Newsletter banner with the XMPP logo and a letter symbol on the side.

(Linux news in previous posts)

FOSS NEWS

Elon Musk's X Tried to Kill Nitter. The Project Just Said It’s Coming Back:
https://feed.itsfoss.com/link/24361/17441795/nitter-returns-after-legal-troubles
(FOSS alt frontends are basically unkillable (if they have enough contributors). Not even a billion dollar corp can shut down a community project. See the Invidious case, when YouTube sent them an email threating them with legal action 3 years ago. The project is still active, with a few functional instances.)

GIMP 3.2.6 released with faster font loading, Wacom barrel rotation:
https://www.omgubuntu.co.uk/2026/09/gimp-3-2-6-wacom-rotation-input

Kdenlive 26.08.1 Releases: Stability Fixes, FFmpeg Modernization, and Crash Patches:
https://www.linuxcompatible.org/story/kdenlive-26081-releases-stability-fixes-ffmpeg-modernization-and-crash-patches/

Shotcut 26.9 Video Editor Beta Brings UI Improvements, Better Audio Quality:
https://www.phoronix.com/news/Shotcut-26.9-Beta

BleachBit 6.0.4 offers faster scanning, improves Linux cleaners:
https://www.omgubuntu.co.uk/2026/09/bleachbit-6-0-4-update

Cryptomator Hub 2.0 adds user management and emergency access:
https://alternativeto.net/news/2026/9/cryptomator-hub-2-0-adds-user-management-and-emergency-access/

Firefox redesign will arrive in v157 release:
https://www.omgubuntu.co.uk/2026/09/firefox-nova-redesign-coming-september

Ladybird web browser gains video playback, JS debugging, and downloads that pause & resume:
https://alternativeto.net/news/2026/9/ladybird-web-browser-gains-video-playback-js-debugging-and-downloads-that-pause-and-resume/

Zen Browser 1.22.1b Ships With Cross-Device Sync and Shareable Workspace Links:
https://www.linuxcompatible.org/story/zen-browser-1221b-ships-with-crossdevice-sync-and-shareable-workspace-links/

Ente Photos introduces encrypted library sharing and faster on-device machine learning:
https://alternativeto.net/news/2026/9/ente-photos-introduces-encrypted-library-sharing-and-faster-on-device-machine-learning/

Privacy-focused email aliasing service addy.io now blocks email tracking pixels by default:
https://alternativeto.net/news/2026/9/privacy-focused-email-aliasing-service-addy-io-now-blocks-email-tracking-pixels-by-default/

OpenVPN 2.7.7 Released with Various Improvements, Bug and Security Fixes:
https://9to5linux.com/openvpn-2-7-7-released-with-various-improvements-bug-and-security-fixes

Immich 3.2 debuts new search API, cluster groups, workflows' expansion, and much more:
https://alternativeto.net/news/2026/9/immich-3-2-debuts-new-search-api-cluster-groups-workflows-expansion-and-much-more/

Jellyfin 12.0 adds major books and comics support, faster browsing, and FFmpeg 8.1:
https://alternativeto.net/news/2026/9/jellyfin-12-0-adds-major-books-and-comics-support-faster-browsing-and-ffmpeg-8-1/

(more FOSS news in comments)

#WeeklyNews #OpenSource #FOSSNews #FOSS #OpenSourceNews #News #Nitter #GIMP #Kdenlive #Shotcut #BleachBit #Cryptomator #Firefox #Ladybird #ZenBrowser #EntePhotos #AddyIO #OpenVPN #Immich #Jellyfin #Browser #SelfHosting #FosseryTech

@KurtKettlerJunior Selber hosten ist super, aber das Backup sollte man nicht vergessen. Wenn SD-Karte oder SSD ausfällt, sind sonst im dümmsten Fall auch die Daten weg.

Genau deshalb gibt es BackupPilot auch für ARM64 und damit für den Raspberry Pi.

https://git.onesystems.ch/BackupPilot/App

#SelfHosting #RaspberryPi #Backup #Proxmox #ProxmoxBackupServer #ARM64 #BackupPilot

I used the new #immich compose builder[1] released to make some changes to my existing instance:

-upgrading the underlying DBs: not so scary (done before)
-running the container as non-root: little scary (never done that before)
-moving the docker volume to a bind volume: quite scary (wait it works?)
In the end, all good! 🚀

#selfhosted #selfhosting
[1] https://immich.app/docker-compose-builder

I finished the initial setup of a local server and am now starting to move my websites onto it. If you notice any connection issues with my sites, please be patient; everything should stabilize as the migration completes over the next week. #SelfHosting

envelope sieve scripts have never worked for me...I clearly don't understand how it works.

I always try to use it and just end up using header :contains "From" "email@here.com"

#email #selfhosting #homelab

Spun up a fresh Hetzner instance from an old snapshot last week, no login screen, just a UEFI shell staring back at me.

New Hetzner hardware only boots UEFI now, no legacy BIOS fallback, and my snapshot's disk never had an EFI partition. The server type I originally ran got marked "Limited availability", so redeploying the same box wasn't an option.

Fixed it from the rescue system: shrank the filesystem live, carved an EFI partition out of the freed space, chrooted in, lost an evening to CentOS 7's dead repos.

Mid-fdisk I said yes to wiping the ext4 signature by reflex. Caught it before writing. You get to make that mistake exactly once.

The site is uasource.com, me and my dad's old Counter-Strike: Source project from when I was a teenager coding mods for it. Almost lost the only working copy of it to a partition table.

Still don't get why Hetzner doesn't warn you before a restore.

Full write-up: https://dol.ch/blog/hetzner-snapshot-wont-boot-uefi-fix

#Hetzner #UEFI #Linux #Sysadmin #SelfHosting #CentOS #Fediverse

More loggia work.
💚

#HomeLab #SelfHosted #SelfHosting #HomeAssistant

For anyone following this #selfhosting thread, I am already in love with Immich:

• Trivial integration with Authentik for OAuth SSO
• hierarchical albums
• Effortless launching as an app on TrueNAS
• tagging
• Customizable share links. (E.g. if I want the public link to my album to be /s/Christmas2025, I can do that)

It does not upload folders (ente did that trivially), but I still like it.

Ente is about privacy. Since your password acts as an e2e encryption key, they can’t support SSO. They can’t do server-side ML like OCR or facial recognition. The only way to do ML stuff with Ente is a desktop app or a mobile app (running on your desktop or phone’s CPU!)

Immich does not do the e2e stuff at all, which gives you all the server-side benefits.

If you lose your Ente encryption key, you have lost all your photos, even though you still have the data. Immich is just files on a disk and a Postgres database. Easier to backup and restore.
#photos

Amusing. I wrestled and wrestled several evenings this week and finally got #ente installed #selfhosted. Much like #JellyFin before it, as soon as I got working with it I disliked it. I"m going to shut it down and try #immich.

The two deal breakers for me were:

• No tags. Ente literally doesn't let you tag photos. It has facial recognition and "favourites." But no tags.
• No hierarchy. I don't understand how someone puts 60,000 photos into a series of albums that have no hierarchy. No folders, no nested albums. Just a straight, flat topology of albums.

JellyFin was like that with video. No way to organize MY way. Only their way or the highway.

#selfhosting

Six of my 194 backups came back failed. Retry did nothing.

I had just published an article about pulling 2 TB out of Glacier Deep Archive for 15 dollars flat rate, so I assumed flat rate has limits after all.

It does. Just not that one.

CloudFront refuses to serve a file over 50 GB in one GET. Mine were 250 to 350 GB, because years ago I decided one big archive is easier to move around than many small ones, and I did not think one step further.

The way around it is in the AWS docs. One curl per 40 GB chunk with a Range header, then cat the parts back together. Worked first time, 250 GB in about an hour.

AWS is still not switched off, by the way. Not because of AWS. The disks in my NAS have ten years of runtime on them and HDD prices right now are out of control.

Wrote it up with the script:
https://www.dol.ch/en/blog/cloudfront-50gb-limit-en/

#AWS #CloudFront #S3 #Backup #Bash #SelfHosting #Homelab #Blog

I'm looking for some self-hosted, opensource, service help. I need to monitor a bunch of the services I'm running around the house and the only dashboard I've come across is kuma. It looks like what I need, but I like to shop around before choosing.

Does any self-hosters here have suggestions?

https://uptimekuma.co

#selfhosting #homelab #opensource

It has been a while since I wrote a proper long guide about something I actually love doing.

In September 2025 I wrote up how to run Mastodon on Kubernetes. That blog is gone, the guide survives only in the Web Archive. A text about backups that exists as somebody else's copy. At least it stayed on topic.

So I rewrote all of it against Mastodon 4.6.

The part I got wrong the first time was the most important one: Postgres as a Deployment with a PVC next to it.
Kubernetes sends SIGTERM, Postgres reads that as a smart shutdown and waits for every client to disconnect. Sidekiq never does. Thirty seconds later, SIGKILL and a crash recovery.

CloudNativePG and continuous WAL archiving now, RPO down from 24 hours to minutes. Still no Helm, everything by hand, because I want to understand what runs.

My own instance came off Kubernetes in March, purely on cost. This is the config as it last ran.

https://www.dol.ch/en/blog/mastodon-4-6-kubernetes-en/

#Kubernetes #PostgreSQL #CloudNativePG #SelfHosting #DevOps #Mastodon #Blog #Fediverse

please boost.

https://solarpunk.au/

been running this 45 TB disk array for some time now.

the intention behind it was to provide services to the community.

i was thinking, what sort of services do you want to see or use?

some ideas:

- IRC
- gemini/gopher, there are some forum softwares
- neocities instance

i'd like there to be some way to share this disk space in a useful way.

#selfhosting #permacomputing #solarpunk