[-] versionc@lemmy.world 1 points 4 days ago

Like I said earlier, I didn't say that you or anyone else should boycott Kagi. I merely informed everyone for transparency. It's up to you how you compromise your morals, because compromise we all do. I can live without Kagi, and therefore I don't need to pay them. If I can refrain from supporting war and shitty governments, I will do so. That includes avoiding American companies, which I do primarily thorough self-hosting alternatives to big tech software.

Either way, you're a very exhausting person to communicate with so this will be the last time I respond to your comments.

[-] versionc@lemmy.world 1 points 4 days ago
[-] versionc@lemmy.world 5 points 4 days ago

Yes, boycotting American companies is a good idea.

[-] versionc@lemmy.world 10 points 5 days ago

Kagi pays Yandex to use their API.

Yandex represents about 2% of our total costs and is only one of dozens of sources we use.

https://kagifeedback.org/d/5445-reconsider-yandex-integration-due-to-the-geopolitical-status-quo/19

[-] versionc@lemmy.world 7 points 5 days ago

We have wildly different definitions of the word discrimination. The fact of the matter is that doing business with Russian companies funds the Russian war. There's no away around that, and the fact that innocent Russian civilians have to suffer the repercussions of that is tragic, but it's through no fault of the people choosing to boycott. Throwing accusations of discrimination in this situation is asinine.

Stop with this childish nonsense.

[-] versionc@lemmy.world 10 points 5 days ago

Discriminatory? Are you for real?

So anyone who does business with a Russian company is "sponsoring the Russian war"?

Yes. Russian companies pay taxes to the Russian regime, and the Russian regime uses that tax money to fund their war. Therefore, if you do business with Russian companies, you sponsor the Russian war.

Am I saying that means you shouldn't pay for the service? No. We can't boycott everything, but people should at least know where some of their money goes. Where you draw the moral line is entirely up to you.

[-] versionc@lemmy.world 7 points 5 days ago

It's worth noting that Kagi, the company behind this browser, is sponsoring the Russian war against Ukraine through its business with Yandex.

https://web.archive.org/web/20251201130700/https://old.reddit.com/r/SearchKagi/comments/1gvlqhm/disappointed_in_kagis_decision_to_integrate_yandex/

1

What do you use for syncing your password manager between your Android phone and your PC? Apparently Nextcloud doesn't support two-way syncing on Android for some reason, and Syncthing-Fork is still untrustworthy since the disastrous handover. The AI generated profile picture of researchxxl doesn't exactly inspire confidence either, neither does his GitHub bio:

Hi! My name is Jonas and I like to use my coding skills from games and modding to continue work on the Syncthing for Android wrapper.

Everything about this person screams vibe coder.

Bitwarden is an alternative, but I don't like how non-standard it is. It's cumbersome to manage and backup, meanwhile the KeePass format is just a file that I can backup wherever and however I want and there are many frontends to choose from.

Have you solved this?

[-] versionc@lemmy.world 1 points 1 week ago

It's worth noting that Obsidian is closed source and proprietary.

[-] versionc@lemmy.world 4 points 1 week ago

Enabling SSH password authentication is unnecessary and not a good idea, especially if your temporary passwords are simple.

Noted, thank you!

I haven’t used Hetzner but there is probably a way to upload a file or to paste into the console

Pasting generates garbled text, with letters and symbols being replaced or simply missing. I haven't found a way to upload a file, nor have I found a solution to the issues in general. I found a few threads on Reddit complaining about the same thing, but no one had found a solution. It just seems to be an issue with the way Hetzner has set up their KVM console.

There is a way to upload custom ISO files, but it's quite annoying as you have to open a ticket with a direct link to the ISO and wait for the staff to upload it for you to the UI.

You may want to look into cloud-init instead of manually installing and configuring your VMs.

Thank you! I'll check it out.

LUKS may not make your server meaningfully more secure. Anyone who can snapshot your server while it’s running or modify your unencrypted kernel or initrd files before you next unlock the server will be able to access your files.

That's true. It's mostly just to prevent data recovery should the VPS be recycled for services that don't support E2EE, like Immich. I thought it would be better than nothing.

[-] versionc@lemmy.world 3 points 1 week ago

If I can use E2EE, I will. This VPS will never be exposed to the internet, it will only be accessible through Netbird. The main reason for setting up FDE is for Immich which doesn't support E2EE, so that the data won't be (as easily) recoverable should the VPS be recycled. But yeah, it's not perfect, but like you said it's better than nothing.

I don't really take physical access (including Hetzner and law enforcement) into account in my threat model.

18
submitted 1 week ago* (last edited 1 week ago) by versionc@lemmy.world to c/selfhosted@lemmy.world

Hello!

I've spent a lot of time struggling with Hetzner's KVM console, there are a lot of problems causing severe issues with setting up passwords and passphrases. I just thought I'd create this "guide" to get things rolling, for everyone who faces the same issues I've faced.

Step 1 - Firewall

Set up a firewall and only open port 22 with your IP (you can look it up using ip.me).

Step 2 - Installation

Perform the installation procedure as normal, setting very simple passwords and passphrases for the user accounts and the disk encryption. Set them to something like 123. These will be changed later!

I'm using Debian 13, the steps may or may not be the same for your choice of distribution.

Step 3 - SSH access

Unmount the ISO and reboot. Enter the console again, log in as root with your simple password. Now, if you have the same problem as me, keys like /, CTRL etc. won't work, so I used tab completion and vi to to modify the config file.

# cd ../etc/ssh/
# vi sshd<TAB>

Inside vi, press o to create a new line and enter insert mode. Add:

PermitRootLogin yes
PasswordAuthentication yes

Press ESC and then <SHIFT>-yy (so holding shift and pressing y twice). This will save the file and exit vi. Restart the SSH services:

# systemctl restart ssh sshd

Step 4 - Dropbear

ssh into your VPS. Now you have full keyboard access like usual. Install dropbear-initramfs, which is an SSH server that's placed in the initial RAM filesystem so that you can ssh into your VPS during start up so you can easily enter your encryption passphrase.

Generate a new key pair and add the public key to /etc/dropbear/initramfs/authorized_keys

Run update-initramfs -u and reboot. You should now be able to ssh into your VPS using the key you just generated. The following command lets you unlock the encrypted disk:

cryptroot-unlock

This will probably disconnect you from the tunnel, simply re-establish the SSH tunnel again.

Step 5 - Changing passwords and passphrases

To change the encryption passphrase:

# cryptsetup luksAddKey /dev/sdXY
# cryptsetup luksRemoveKey

Lock the root user and change the password of your user (don't forget to add the user to the sudo group!):

# passwd -l root
# passwd user

Done!

At this point you might want to use some other means to access the server, such as Netbird or Tailscale or Wireguard. Regardless of how you decide to access the server, you should revert the changes to sshd_config.

P.S.

I have no idea if this is a secure or good way to do this. Use at your own risk!

1

Hello!

I've been playing around with self-hosting for a while now and I've started moving over to a VPS. At home I have a PC that's on more or less 24/7 with an *arr stack, jellyfin and some other services. They can only be accessed through Netbird. The services aren't that important, the data doesn't really need to be backed up since it's not very important. On the VPS, however, I would like to host some more critical services, such as:

  • Vaultwarden
  • Immich
  • Gitea
  • Overleaf

I want them available 24/7, even if I decide to distrohop and wipe my PC at home. The problem is how to structure all this. My current idea is to run Gitea and Overleaf out in the open behind some reverse proxy without authentication (Nginx or Nginx Proxy Manager). I'd like Vaultwarden and Immich to be on the same VPS, but, I don't want those services to be accessible to anyone but me, so I'd need some form of ACL or authentication system. I'm thinking of using Netbird for this, since I already use it on all of my devices.

So I would set up DNS records from within Netbird that would point immich.domain.tld and vaultwarden.domain.tld to the internal Netbird IP of the VPS. In the reverse proxy, I'd set up access control such that it only redirects the Netbird IP range to those services. On Cloudflare, I'd point git.domain.tld to the external IP of the VPS with proxy enabled.

Everything would receive HTTPS certificates, and I'd block incoming traffic on every port except for 80 and 443.

Is this a good setup? Any tips or recommendations? Any pitfalls?

Thanks!

versionc

joined 2 weeks ago