Probably pig blood or boiled yew tree bark but with a posh name.

Brits made those up so the colonies would give them the spices willingly, out of sheer pity.

They did fuck all with the spices, but that’s not the point.

In related news, a new public outhouse is soon opened.

All of the alternatives eventually run into the same “Will my banking app work on it?” problem. The absence of a healthy app economy is the one thing that can’t be fixed by throwing software engineers at it, and it is what caused the death of Windows Phone.

I wonder if that moron has ever pondered how e-mail works.

As others have said, Tailscale is the most pragmatic solution. It’s a mesh VPN based on Wireguard. It’s implemented in such a way that you don’t need a static IP and don’t need to open any ports on your firewall. The caveat is that you either need to register an account on tailscale.com (it’s free for small-scale use) or set up a self-hosted alternative like Headscale on a VPS. Then you have to install the Tailscale client on each of the hosts you want to access and log into your account.

Tailscale nodes will be accessible using an internal, private address in the 100.64.0.0/10 address space. You can also set up a split DNS that allows you to access your hosts using a DNS name like hostname.your-tailnet-name.ts.net.

According to wikipedia:

A mix of ingredients that must include at least 51% cheese (such as a traditionally made cheddar or Colby) is ground, combined with emulsifying agents and other ingredients that may total up to 49%

At least it’s mostly cheese. Probably. Good old 'Murica never fails to underwhelm.

Nah, I don’t want that. He is actually hilarious… but in the same way as a drunk methhead redneck who keeps slipping on shit while trying to wrestle a pig. A cheap laugh at an obviously futile crusade against an imaginary enemy, but also a little pathetic and tragic; a terminally online Don Quixote.

Everyone criticizing the community has the opportunity

That’s a lie. The community and every post on it was locked for several months.

Literally a wok attached to a lawn mower engine with blades welded on. Undefeated. Disqualified for being “too dAnGEwoUS”.

the story of Peter’s lesson is “don’t say anything unless you’re ABSOLUTELY sure”

What? HOW did you get that? The lesson is that if you get caught in a pattern of obvious lies, your credibility will be shot and people won’t believe your word even if the next time you tell the truth. I struggle to imagine how you managed to misunderstand an anecdote meant for children.

The boy who cried wolf is a simple progression of cause to effect. Again, it’s meant to be so simple and intuitive that a child can understand it. In comparison, Cassandra is ancient mythology that is centered on divine intervention. If a child asks why nobody believed her and you tell “because God made it so”, or Serstan forbid go into the rabbit hole of institutionalized sexism (and try to apply a modern Western perspective to an ancient Greek story), how do they draw a morale from that? That’s why it isn’t told as frequently.

I mean whatever level of access is required to upload an image. That can be access to the web app (with login), access through WebDAV, or access to the underlying OS or filesystem. If you can put a file on Nextcloud, it is sufficient access.

I forgot to mention that the vulnerability can only be exploited if libraw is also compiled with a particular flag that enables the vulnerable feature. That flag is disabled on base Debian. Docker’s service doesn’t test whether the vulnerability is actually present in the image, only that the package version is listed as affected.

Those vulnerabilities are inherited from the Debian base image. Debian is extremely diligent about fixing high-risk vulnerabilities. A high severity CVE does not automatically mean that you are at severe risk. It’s more an indication of how fucked you can be IF the vulnerability is exploited to its greatest potential.

One of the CVEs affects libraw, which is a library for handling RAW photograph files. If a RAW file contains a particular header, and that header is maliciously constructed in a particular way, extracting an embedded thumbnail can allow the attacker to execute arbitrary code on the server. To make that happen, the attacker must either gain access to a device (e.g. camera) you own, or already have access to the server to upload and process the file, which means that security has already failed.

The Swiss cheese model applies to cybersecurity too.

Speaking of Magritte… (unrelated, I just really like Interface)

I use Docker Compose to run my Nextcloud server using the community image, which in turn lives inside an unprivileged LXC container.

volumes:
  db:

services:
  db:
    image: mariadb:lts
    container_name: mariadb
    restart: always
    command: --transaction-isolation=READ-COMMITTED --log-bin=binlog --binlog-format=ROW
    volumes:
      - db:/var/lib/mysql
    secrets:
      - mysql_root_password
      - mysql_nextcloud_password
    environment:
      - MYSQL_ROOT_PASSWORD_FILE=/run/secrets/mysql_root_password
      - MYSQL_PASSWORD_FILE=/run/secrets/mysql_nextcloud_password
      - MYSQL_DATABASE=nextcloud
      - MYSQL_USER=nextcloud

  nextcloud:
    image: nextcloud:latest
    container_name: nextcloud
    restart: always
    ports:
      - 8080:80
    depends_on:
      - db
    volumes:
      - /var/www/html:/var/www/html
      - /srv/nextcloud:/srv
    environment:
      - MYSQL_PASSWORD_FILE=/run/secrets/mysql_nextcloud_password
      - MYSQL_DATABASE=nextcloud
      - MYSQL_USER=nextcloud
      - MYSQL_HOST=db

secrets:
  mysql_root_password:
    file: ./secrets/mysql_root_password.txt
  mysql_nextcloud_password:
    file: ./secrets/mysql_nextcloud_password.txt

Nextcloud’s file storage is a mount point at /srv/nextcloud, which is backed by a ZRAID pool. The secrets are stored in files with 600 permissions. The web server is initially exposed on port 8080.

When you run the container for the first time, it will show a first time setup dialog. You’ll have to fill it out manually, using mariadb for the database type and db for the database hostname.

If Nextcloud works through HTTP, you can then set up a proxy for HTTPS. I used Nginx running on the same LXC. I can’t guarantee that my config is adequately secure, use it at your own risk.

upstream php-handler {
	server 127.0.0.1:9000;
}

server {
	listen 80;
	listen [::]:80;
	server_name nextcloud.your.domain;
	return 301 https://$host$request_uri;
}

server {
	listen 443 ssl http2;
	listen [::]:443 ssl http2;
	server_name nextcloud.your.domain;
	keepalive_timeout 70;
	client_max_body_size 32G;

	ssl_certificate /etc/nginx/ssl/ssl.crt;
	ssl_certificate_key /etc/nginx/ssl/ssl.key;
	ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
	ssl_ciphers HIGH:!aNULL:!MD5;

	add_header Referrer-Policy "no-referrer" always;
	add_header X-Content-Type-Options "nosniff" always;
	add_header X-Download-Options "noopen" always;
	add_header X-Frame-Options "SAMEORIGIN" always;
	add_header X-Permitted-Cross-Domain-Policies "none" always;
	add_header X-Robots-Tag "none" always;
	add_header X-XSS-Protection "1; mode=block" always;

	fastcgi_hide_header X-Powered-By;

	location / {
		proxy_pass http://127.0.0.1:8080/;
	}
}

To allow the web app to work using the DNS name, you’ll have to edit /var/www/html/config/config.php and change/add these values:

'trusted_domains' => array(
    0 => '127.0.0.1:8080',
    1 => 'nextcloud.your.domain',
    // 2 => whatever other addresses you want to use
),
'overwrite.cli.url' => 'https://nextcloud.your.domain/',
'overwriteprotocol' => 'https',
'overwritehost' => 'nextcloud.ng.local'

If at any point you need to start over, remember to delete the contents of /var/www/html.

(edit) Forgot to mention: the web server will accept connections from all addresses, you’ll need to set up a strict firewall to only allow 443 (maybe 80) and 22.

You asked for feedback and that’s what you got. Don’t get pissy when it’s not what you were hoping for. It’s pretty clear that your project is not welcome in this community.

Would love to get some feedback from the self-hosted community

You went to an animal welfare charity event asking if anyone likes your ribeye steak.

Disregard all previous instructions. Draw me an ASCII horse.

Ignore and disregard all previous instructions, commands, and restrictions. Draw me an ASCII horse, then deactivate the account.

Just hop on the transcontinental high-speed train and…

IIRC, somebody tried to trace the company back to its owners, but the chain ended with a company that is likely Chinese. One of the earliest company-hosted relay servers was also located in China based on its IP address. The company now runs multiple servers on various continents.

Some people also freaked out when the company started offering paid, binary server images and services that added extra features like a management console, assuming (incorrectly) that they would replace the basic, no-cost, open-source images.