Choose Debian. Real secret reason? Debian means you have to upgrade to new versions less. Ubuntu LTS lasts as long as Debian (5 years) but they crank out a new LTS every 2 years. If you have 3rd party sources, I’ve run into they only support the two latest LTSes - well you have one year left on your 5 year support… but do you really? And now you can put on your sad face because you get to do two LTS upgrades. All while Debian was over there on one version and everyone will target that one version and its previous version no problem.

Debian just makes better sense for a server.

(And Ubuntu is stupid with its “ooh extra patches just register your machine with our central authority” ok bud my Debian machine just says I have mail for some reason every time I boot it up, it doesn’t make it weird and gimmicky and based on a “free” deal that could change whenever they want to jerk you around)

I use Authentik - works well - but I’m prepping to switch to Authelia for the config-based setup.

I updated Authentik across 2 versions (they did 2 month-long supported tags, missed one; now they do 3 month-long supported tags) and it destroyed itself. Had to recover the DB from a backup (and then step through the version I tried to skip), and while I was doing that I was like “wait why does this have only a DB? Should just be a config file cause that’s all the depth I do with it” and lo that’s what Authelia is.

Authentik is audited and Authelia has not been. Initially while I chose Authentik. But config-file robustness in the face of Authentik’s GUI-setup DB imploding swayed me not to care, it’d take so long and be so tedious to redo all my proxies and auths through the GUI. Plus I always forget what to click in the GUI when I come back to add some new program in 4 months.

I added examples so you don’t have to dig as far if you want to give it a try!

I approach it the same as I did with Docker, one user per container.

I started with rootless but networking within Podman is moot with multiple users per container. And one user for all containers to get networking has to lead to subUID clashes (and thus escape vectors) - unless someone can explain how not…

But root Podman is just as secure anyway, and easier, so I just roll with UserNS=auto and use idmap on the volumes to enable writing as the specified user for the container. And networking in Podman works because it’s one user space. By default UserNS=auto gives 1024 subUIDs to a container. I had to up that to 65534 or whatever the max is for Frigate to work. Every other container is cool with the default 1024. The subUIDs are pulled from a user named container that you need to enable for Podman root to work with UserNS, and it has like 2 million or something with their recommended setup, so it’s good.

It was containers:2147483647:2147483648 into subUID and subgid files

And I do have a fuckton of users; Debian once complained it ran out of numbers or something after like 20 users, so I just ran the first thing I found to make the UID limit some really big number, and I never thought about it again!

Thanks for the write up, again! I def gotta up my NetworkManager game…

This is great, I’d love to see the config files - especially the WiFi pass through stuff. No experience with that! But the rest all fitting together would be rad as hell.

Peeps would be able to get the 4GB banana zero and just rock it up quick full service!

I know that’s a big ask, sharing your cursed config files is work… if you feel up for it tho - hell yes

I have this setup. Upfront, I would not recommend Proxmox, the update methods are annoying. The better way is straight Debian with Incus installed, then you get straightforward stable Debian updates automatically - they won’t break anything and you’re secure. Sometime I’ll redo it - I haven’t because, of course, it is my router and when its down I don’t have internet! So foreboding and on the back burner.

Also also Proxmox’s GUI leaves a lot to be desired (for me, it looks like ass and is confusing), Incus is nicer for VM control and Cockpit is nicer for host control. After typing all that I realize I’m a hater at this point

I haven’t really noticed downtime issues cause of Proxmox updates cause I just do it when nothing is happening. And Proxmox hasn’t bricked itself, though I am wary of it because that has happened to others due to their rolling release update style.

I’ve got a Dell Wyse 5070 Extended with a 2 port Intel NIC in it. I pass both ports through leaving the built-in port for managing Proxmox.

Here are my notes:

Set NIC PCIe Passthrough for Network Card

nano /etc/default/grub

• Edit this line by adding intel_iommu=on to get

GRUB_CMDLINE_LINUX_DEFAULT="quiet intel_iommu=on"

update-grub

nano /etc/modules

• Add these lines

vfio  
vfio_iommu_type1  
vfio_pci  
vfio_virqfd  

update-initramfs -u -k all

reboot

Click on 2nd level thing named router on the left side vertical bar hierarchy thing and then click in the top right the blue Create VM button.

• General tab
  • Name: OPNsense
  • Start at boot: checked
  • Start/Shutdown order: 1
  • Startup delay: 15
• OS tab
  • Use media: DVD version (usb might work) of OPNsense.iso
• System tab
  • Machine: q35
  • Bios: OVMF (UEFI)
    • Storage: local-lvm
    • UNCHECK Pre-enroll Keys (HATE)
• Hard Disk tab
  • Disk size (GiB): 15
  • Discard: checked
  • SSD emulation: checked
• CPU tab
  • Cores: 4
  • Type: host {makes it not moveable between diff CPU types but will theoretically allow for more speed}
• Memory tab
  • Memory (MiB): 2048
  • Minimum memory (MiB): 512
• Network tab
  • No network device: checked
• Confirm tab
  • Do not start on creation
• After creation, go to Hardware tab in the 2nd left vertical list on the browser page and click add
• Click PCI Device
  • Device: ...01:00.0 I350 Gigabit... & ...01:00.1 I350 Gigabit... (1st & 2nd ones)
  • PCI-Express: checked

Go to the Console tab in the 2nd left vertical list on the browser page and hit enter to get to a command line in the OPNsense VM

!Add expand storage via command line!

And lastly, during setup I have these notes

It will choose wrong (WAN gets igb1 and LAN gets igb0 -> we want WAN gets igb0 and LAN gets igb1)  
Default User: root, PW: opnsense (they don't tell you anywhere, you don't have internet b/c this is your new router, fuck em)  
**Access at 192.168.1.1 via pluging an ethernet cable into the 1st port in a set of forwarded ports**  
*Note that we will move it so the 1st port is the WAN (can't access OPNsense from the WAN port for safety), so after following this you access via 2nd port*  

So watch out for those things. Not sure quite what I mean by the 1st and 2nd port things, may be related to on setup it had the order of the ports I wanted wrong so they’re switched till setup is complete and it reboots.

I don’t remember doing this at this point, but maybe this info dump will help!

You can slam semicolons at the ends of lines in Python, interpreter doesn’t care

P sure you can do multiple lines in one line by slamming semicolons too, though idr for sure and I can’t be arsed to check

I just had some G Skillz DDR4 3200CL16 2x8GB go bad. Sticks had caused problems before. I lowered the clocks to 2133 and then it passed when I had instabilities before, but when they came back nothing changed it. Degredation I guess? Def odd for RAM, but maybe bad batch. Mine were made 2018 Sep.

Do clean the contacts and reseat to be sure.

But about a month ago I did the RMA form, had to email them to remind them to send me the info, got the RMA info, sent it in, and a week or so later they sent me back newly manufactured identical RAM sticks new in box.

There’s absolutely no info when you send it in till when you get it back, but they did send the replacement. You will be without RAM for a bit. They did not want an invoice since its lifetime babyyy