Matty_r @ Matty_r @programming.dev

Posts

10

Comments

210

Joined

2 yr. ago

I've been thinking of switching back to Arch. Currently using Nobara, and its moved to rolling release anyway.

About 15 years go I had to go somewhere that was much much colder than I anticipated, so we made an emergency drive to the closest town, and I bought the warmest jacket they had. It was like $300, but I never regretted it. Its the most practical, comfy, jacket ive ever owned and doesn't look half bad - even has a hoody you can clip on and off. Got me through snow as well, but its not water proof.

Love that jacket.

I haven't seen a shiny one in like 20 years :(

Nah just shove it through in random patterns like a hundred times. It works well enough.

I tried to get something on iPhone once, added credit to my account using one of those vouchers you can get from the store. I was able to add the credit, but it refused to allow me to purchase anything without adding payment details.

Damn, not sure I'm a fan of any of this. I left Arch because I didn't want to be on Rolling release any more, and really liked what Nobara was offering for the out of the box experience.

Brave is super sketchy, and not sure about putting in yet another thing to handle updates (replacing plasma-discover and gnome-software).

I'm wondering if its worth forking it to remove some of these changes.

What about Deskflow? Worked pretty well for me.

Proxmox is definitely on its way to become a viable replacement for sure. There's also OpenShift from Red Hat which could be worth a look at as well.

All good, yea its because I need crowdsec installed on the proxy as well - not just the bouncer - in order to actually send the logs to Opnsense.

I ended up having some weird performance issues so I pulled it all out for now and will revisit another time.

With the bouncer setup, I assume I need to pass in where to look for logs or something for those to be passed into the lapi? I followed this CrowdSec and Nginx Proxy Manager , as far as I can tell everything is connected an running, I have crowdsec running on OpnSense via the plugin - it appears to be healthy as per the CrowdSec Console.

    
npm  | [nginx       ] nginx: [error] [lua] crowdsec.lua:62: init(): error loading captcha plugin: no recaptcha site key provided, can't use recaptcha       
npm  | [nginx       ] nginx: [error] [lua] ban.lua:37: new(): BAN_TEMPLATE_PATH and REDIRECT_LOCATION variable are empty, will return HTTP 403 for ban decisions
npm  | [nginx       ] nginx: [alert] [lua] crowdsec_openresty.conf:5):11: [Crowdsec] Initialisation done                                                    
npm  | [supervisor  ] starting service 'app'...                                                                                                             
npm  | [app         ] [5/5/2025] [11:26:30 PM] [Global   ] › ℹ  info      Using Sqlite: /data/database.sqlite                                               
npm  | [supervisor  ] all services started.


  

Cheers, I've since discovered that's is "bouncers" that I want on the endpoints I.e on my Nginx Proxy Manager. I'll just use the LAPI on the Opnsense box for now I think.

I thought crowdsec does everything fail2ban does in addition to global block lists?

Where did you have it setup? Is your proxy configured to forward the real IP?

Nah, that one conflicts with my IPoAC networks unfortunately :(

I did have that same thought actually, with opening up opnsense to be modified. But I also like the idea of it getting blocked before it even gets into my network, instead if letting it in initially and then blocking afterwards - that's kinda the whole job of a firewall after all ha ha

Awesome that makes a lot of sense, cheers. So I'll install the Crowdsec agent on the Nginx Proxy Manager, and potentially also on the servers.

Thanks those links were helpful to get me on the right path. I like that there is a plugin for Opnsense directly and has that central LAPI, because I'd need something similar if I was to use f2b.

CodeBerg is a public instance of Forgejo. You can run your own local instance of Forgejo.

At some point they'll have federation working so you'll be able to use your home instance of Forgejo to interact with other projects/instances.

ITX is fun to build, but really limits your options and expandability.

For an ITX build make sure you've got a CPU with integrated graphics, so you're not wasting a slot for a GPU. You can also get an internal SATA/RAID card to expand the amount of drives you can have.

I have some alerts like that using Pushover. You can set it to treat high priority alerts like an alarm which bypasses things like do not disturb and silence etc