Turnkey images are usually built on popsicle sticks and chewing gum; they use old packages, their configs are often really janky and they do not like being updated.

I’m not kidding you, you’d be better off building nextcloud in a generic debian container.

As for the errors, as others have mentioned these are more or less easily fixed one at a time.

HBC failed to adapt in the 70s to customers moving away from catalogue orders, it failed to adapt to malls in the 80s, and it failed to decommission its expensive white elephant department stores in the 90s.

By the time it was being passed around like an old car, it was already dead and gutted of its value.

I’m all for reminiscing on things lost, but this is just a funeral 45 years late. HBC died a long time ago.

There’s a bunch of posts about the iptables-save function of the built-in iptables module not working in many cases, so I figured it was a safer bet to suggest the playbook include an actual command invocation.

In my personal experience, the module doesnt actually save the persistent rule in about half the cases. I haven’t looked into it much, but it seems happen more on systems where systemd iptables-firewall is present. (Not trying to start a flame war)

I think in this case, there just isn’t awareness.

Are you OK?

Generally, you set up a rule + command playbook, where the command invokes the iptables-save command.

So if you neglected your paperwork for something, you wouldn’t help one of your family? Seems incredibly callous.

Stuff happens. Life happens. Paperwork is forgotten, sometimes id is lost , stolen, etc. What happened to that woman isn’t illegal for her, something could have been done to help.

Put yourself in that woman’s shoes for just one second.

Holy shit. Tell me you read the article.

I read the old thread and now this one.

As I understand it, you want to create connection between clients on your lan, but you don’t trust your lan, so it’s like having a raspberry pi server and some client both on the coffee shop network and you want them to communicate securely?

Tailscale is what you want. Easy setup, free, and allows exactly this to happen.

I was looking for this. Op seems to be obsessed with “zero trust”, so creating a trusted area for this stuff would be an easy win.

Do you have port 80 to nginx open? Certbot dry run will give you some diagnostics, but that is the most common issue (port 80 being closed).

The effect is similar to sticky ports, but sticky ports is just filtering based on Mac address, which can be spoofed.

802.11x allows traffic from a device only if they also have the correct EAP certificate.

https://en.m.wikipedia.org/wiki/IEEE_802.1X

802.1x are a set of protocols that allow port access to be locked to specific devices, which would preclude your need for multiple subnets. You would likely need a few extra physical ports on your white box router, the unmanaged switch could later become overwhelmed passing traffic in a more complicated setup, and you would still need to keep trusted and untrusted traffic separate at the gateway subnet.

Your use case is exactly why vlans were invented.

However, I suspect from your other answers that you are actually looking for an open source managed switch so your entire networking stack is auditable.

There are a few solutions like opx, but hardware supporting opx is prohibitively expensive and it is almost always cheaper to build a beige box and use Linux or get a 2nd hand supported device and use openwrt.

For simple cases you might be able to use 802.1x authentication if “trust” is the issue. This doesnt scale well as a solution on a larger network though.

Op specified they have a dumb switch

Troll.

Kind of a vague question, but I take it you mean OS-level hardening, which should be fine with CIS hardening.

In a virtualized environment, there are many security layers to take care of: network access, storage, api control, identity access, cluster config, backups, etc.

If the NSA has backdoor or encryption keys to your phone, they got them from the cloud providers you’re suggesting people back up to.

Your advice won’t stop border agents from compelling you to unlock your device with biometrics.

*potatoes, Mr. Quayle.

And to think people hailed Facebook and other online services so much in the Arab Spring of 2010 that someone in Egypt named their kid Facebook.

“Power corrupts” seems to be universal with humans.