I have several docker servers, but for Immich I want a dedicated VM. Regardless the problem isn't going to be setting it up, that should be easy. But for something as important as this, I am going to pore over every possible architectural design decision from the storage tier to the HA and DR strategy. I don't want to start migrating to it then realize I wanted to do something differently and have to migrate again.
If it's replacing Google Photos for my family, I expect the same level of resiliency and data protection standards. Or at least as close as I can reasonably get.
While the cybersecurity organization admits IPsec with IKEv2 isn't free of flaws, it believes switching to it would significantly reduce the attack surface for secure remote access incidents due to having reduced tolerance for configuration errors compared to SSLVPN.
Basically, every vendor has their own implementation of SSL VPN as there is no real standard, whereas IPsec is mostly vendor-agnostic. And you effectively need to keep an open web server to receive the client connections, making exploitable misconfigurations or vulnerabilities much more likely.
Sure IPsec with IKEv2 is preferred, but SSL VPNs at least as a fallback will never go away unless it becomes commonplace for outbound firewall rules to allow udp/500 (which I don't ever see happening).
The way I'm set up is to have Windows AoVPN connect to my Fortigate w/ IPsec automatically. Then if that doesn't work due to outbound rules (which is more often lately than it used to be) and I need to connect back to HQ, I manually fire up Forticlient.
Most likely it was a password stuffing attack. If they used the same password on multiple sites, there is a good chance one of those other sites was compromised and the attackers took the compromised credentials and tried them on other sites like Instagram. It could have been something more advanced like a stolen cookie, but usually the simplest explanation is most likely.
Always use a different password for each service, enable MFA where possible, and use a password vault like Bitwarden.
I agree as long as the money is actually going toward building out the charging network and not just getting sucked up by corporations like the ISPs that were supposed to improve our network infrastructure.
Although it would be nice for them to let us know what is happening and when we can expect some real improvements. Maybe that info is out there, but I haven't seen it and this biased reporter sure isn't looking to do any real journalism.
In that case, if CF is taking to Traefik and not the actual origin server, you just need to forget about the origin certs altogether and use LE certs in Traefik.
If you, Traefik, and your origin server are on the same network, then it's going to be one hop regardless of whether you're hitting the Traefik proxy or the origin server. If Traefik is serving up the origin server's cert and not the LE cert, then Traefik is misconfigured to pass through instead of proxy, but I'm still not sure that's the case as it's almost harder to configure it that way than the correct way as a proxy.
What IP:port is your origin server listening on, what IP:port is Traefik listening on, and how is Traefik configured to reach the origin server?
I have several docker servers, but for Immich I want a dedicated VM. Regardless the problem isn't going to be setting it up, that should be easy. But for something as important as this, I am going to pore over every possible architectural design decision from the storage tier to the HA and DR strategy. I don't want to start migrating to it then realize I wanted to do something differently and have to migrate again.
If it's replacing Google Photos for my family, I expect the same level of resiliency and data protection standards. Or at least as close as I can reasonably get.