I just pay Hetzner 2.50-ish euros per month for their cheapest mail hosting offer and call it a day. I did self-host mail for quite some time, it was a huge PITA to set up and keep working. Every now and then I even had issues with my mails not being delivered to outlook addresses (f u M$), so I just gave it up and switched to Hetzner. Their cheapest plan even includes one domain, so depending on the domain you choose, it’s not even 1€ per month for the actual email hosting

Jokes on you, my server has no terminal, not even a shell (I use Talos, everything is managed via mTLS protected API)

The immich mobile app can use OIDC, it just shows you the button on login, which then opens a browser window to login with the external provider

I migrated my backups from Hetzner Object Storage to OVH, because Hetzner had too many service disruptions in the last few months for my taste (no dataloss, only unavailability). My automatic backup afterwards worked without any issues. Plus point, OVH doesn’t charge for traffic or API calls, only for used storage, and has replication jobs, so I can automatically replicate the backups to another bucket in another location.

Upgrading docker usually isn’t an issue, and if all your native services are from the default apt repo, there shouldn’t be an issue either. If any of them isn’t present anymore in trixie, I believe apt will warn you when you try to upgrade

Do you run all your services in docker? If yes, the upgrade should be nothing more than the upgrade including switching the docker repo to the new version codename and rebooting

Nö, nix Vodafone, Vereinigte Stadtwerke Media, Vodafone kommt uns nicht ins Haus. Und ja, eigene IPv4 ohne CGNAT, die ist theoretisch nicht statisch, hat sich aber anscheinend noch nie geändert. Eine Fritzbox 7590 AX war für eine Einmalzahlung dabei, günstiger als regulärer Marktpreis, ohne Anbietermodifikationen an der Firmware, lediglich die Credentials waren voreingestellt. Und bisher hatten wir keine signifikante Downtime, der letzte Reconnect des Routers war Mitte Mai, aber das war wegen Firmwareupdate, nicht Connection-Loss.

DSL? Or Cable?

I’ve been using Keycloak for multiple years now, it has some complexity, because it supports about everything OIDC or SAML offer. I used Authentik before, but ran into limitations with its OIDC token mappers and found its Python codebase to be harder to extend than Keycloak with its properly typed Java API

I could do that, wouldn’t lose a bit, but I hesitate anyways because downloading a few TB over a 300 Mbit/s Internet connection isn’t fun at all and takes a shitload of time

Yeah, for most things, a premade dashboard exists, and if it isn’t fully to your liking, just customize it. Also for more professionally maintained metrics exporters like the node-exporter, there’s usually an official dashboard. But learning PromQL before relying on premade stuff is probably a good idea, so you know how to adapt them to your needs

I mean, I got the whole set of default dashboards, some for networking and one each for backups (k8up) and Postgres (CloudNativePG), but I don’t look at them often, usually only if something’s wrong. I also have logs available via Grafana, but I don’t have any dashboards for that, I just query what I need. If I ever have enough time and motivation, some things I’d put on a kind of overview dashboard would be in addition to your list:

• zpool health (scrub status, IO etc.)
• list of crashing pods
• list of warnings from FluxCD (e.g. application upgrade failures or invalid manifests)
• list of failing persistent volumes

Yes, my own hardware. But before I decided to build my own server last September, I was on a similar setup on a dedicated server at Hetzner, just less powerful (I’m so goddamn glad I bought the memory and storage back then, I probably wouldn’t even get the 192GB DDR5 right now for the price I paid for all memory and storage combined).

Terraform starts at the Talos initial machine config and cluster bootstrap including CNI setup and routing configuration (I have an opnsense in front that handles ingress routing) until FluxCD is fully set up and takes over.

Ingress traffic works via a small Hetzner VPS, and BGP through Wireguard, so there is no DNAT or SNAT between the open Internet and my Kubernetes load balancers and all services see the actual client IP. This took a shit load of time to get right, because wireguard only has an mtu of 1420, but the regular uplink is usually 1500, so pmtu discovery in my load balancers implementation (Cilium) and mss clamping in opnsense had to all be configured

Maybe a bit more on the overkill side, but I use Talos Linux (declarative K8s distribution), then Terraform for initial setup and FluxCD for everything else (including VMs via Kubevirt). It’s a hell of an initial learning curve, but afterwards I just do my talosctl upgrade and upgrade-k8s from time to time, and don’t have to worry about anything else. Upside is, Kubernetes provides a unified, extensible API for everything, for example:

• reverse proxy via Ingress or Gateway-API
• firewall via NetworkPolicy
• even databases like Postgres through an Kubernetes Operator like CNPG, with a similar simplicity as with the big cloud providers (just a single yaml file with the specs like storage capacity, CPU and memory limits, backup target and schedule etc.)
• it is very scriptable (everything is managed via the API)
• automated image updates via either FluxCD itself or just dependabot/RenovateBot creating PRs to your GitOps repo

Downsides:

• you have to figure out persistent storage (CSI), which is slightly more complicated than just a single filesystem and manually specifying volume mounts like with docker, but if done right, you have a simple interface with powerful capabilities via the Kubernetes API
  • there are simple CSI implementations that just expose node local disks via LVM or ZFS, so if you just have a single node, or don’t care about replication, it’s fairly easy to get started
• initial learning curve is quite high, especially if you have no prior experience with container orchestration in general
• definitely overkill if you just want something simple that “just works”

Iirc I had to check in my checked bag before going through security. Also had no problem with putting my Nintendo Switch and controller in my checked bag.

Although I only flew within the EU, so different regulations may have applied than in the US.

Afaik you should be ok as long as you have it in your checked luggage, not your carry-on bag

I’m at around 1-2 TB per month, so you clearly have some room for improvement there xD

I do push only, as I’m using cloud-based object storage, so I know the destination is online 24/7. I do encrypt them before uploading, so couldn’t care less about privacy or security. Only availability, but if one uses multiple different cheap storage providers and replicates the backups, it doesn’t matter either.

It’s also easier and more secure to automate push if you don’t fully own the destination.

I’m using headscale with headplane as the UI, looks like tailscale, is feature complete (at least it says so on their GitHub readme). Headplane even integrates with an external OIDC provider (I self-host Keycloak for centralized identity management across my services).

Only mechanically. You could technically remove the small piece of plastic at the end of the slot, and still put a x16 card in a x1 or x4 slot, should work anyways. Some mainboards even have open-ended slots directly instead of closed ended. Haven’t done it and wouldn’t recommend it, but it would technically be possible.