ᛒᛚᚢᛖᛇᚦᛖᚱ (BlueÆther)

I have AdGuard Home running on OPNSense as a local DNS with a wild card for for the ‘local domain’ pointing to Caddy

in Caddy I have this section:

*.<domain>.net {
#header X-Frame-Options "SAMEORIGIN"
        tls internal
        encode gzip
        import sec-headers
        @sub1 host pve.<domain>.net
        @sub2 host kasm.<domain>.net
       ...
       handle @sub1 {
                import sec-headers
                reverse_proxy * https://10.1.1.11:8006/ {
                        transport http {
                                tls_insecure_skip_verify
                        }
                #       header_up Host {host}
                       header_up X-Real-IP {remote}
                       header_up X-Forwarded-For {remote}
                       header_up X-Forwarded-Port {server_port}
                       header_up X-Forwarded-Proto {scheme}
                }
        }
        handle @sub2 {
                import sec-headers
                reverse_proxy  https://10.1.1.119/ {
                        transport http {
                                tls_insecure_skip_verify
                        }
                #       header_up Host {host}
                       header_up X-Real-IP {remote}
                       header_up X-Forwarded-For {remote}
                       header_up X-Forwarded-Port {server_port}
                       header_up X-Forwarded-Proto {scheme}
                }
        }
...

Back up the server then work through:

Just follow the guide https://iocaine.madhouse-project.org/documentation/3/getting-started/ Bind the iocaine service to 0.0.0.0:42069

cat /opt/iocaine/etc/iocaine/config.d/00-server.txt.kdl 
http-server default {
  bind "0.0.0.0:42069"
  use handler-from=default
}

expose interface to Docker (make sure not to expose it to the world).

sudo iptables -I INPUT 4 \
  -s 172.18.0.0/16 \
  -d 172.18.0.1 \
  -p tcp --dport 42069 \
  -j ACCEPT

add the interface to the proxy service in a custom/docker-compose.yml.template

proxy:
    {{COMPOSE_CADDY_IMAGE}}
    env_file:
      - ./caddy.env
      - {{ CADDY_EXTRA_ENV }}
    volumes:
      - ./caddy/Caddyfile:/etc/caddy/Caddyfile:ro
      - caddy_data:/data
      - caddy_config:/config
    extra_hosts:
      - "host.docker.internal:172.18.0.1"
...

add iocaine to caddy in a custom/Caddyfile.template

{$LEMMY_HOSTNAME} {
        import caddy-common

        ######################################
        ########## iocaine  code ##########
        @read method GET HEAD
                reverse_proxy @read host.docker.internal:42069 {
                @fallback status 421
                handle_response @fallback
        }
...

rebuild all the docler images (at least the caddy one ./deploy.sh -f) and test

I think that should work

CrowdSec

I declare the Golf Gulf of America a NZ territory. Hence forth it shell be named after the most powerful country in the region - The Golf of Mexico

edit: well that is embarrassing, but Ill leave it mostly as is

Well done on getting it up and running, federation seems to be working https://moplemmy.fyi/instances & https://phiresky.github.io/lemmy-federation-state/site?domain=moplemmy.fyi

You shouldn’t have to put instances in the Allowed Instances, just use blocked list for stuff you dont want to see

Yes email is a pain in the arse. More so if you are having to deal with dynamic IPs

Now just wait for the scrapers to turn up. Both Dave (lemmy.nz) and I are getting well in excess of 500k requests from content scrapers per day atm and they are tyring to pull in whole comment trees and walk through all posters.

Have a look at Iocaine to help tarpit some of them if you dont want to route through something like cloudflare.

yes github

those ~2000 blocks were in the hour after turning on the full proxy, still getting a fair few from china hitting the real IP address that they must have cached.

Grep’d the logs and had 250,000 requests from china in the last 20 hours asking for full threads via the api

up untill now I’ve not had too much bot traffic, but I’m betting hammered atm. Make sure to have some good firewall rules for when it happens:

Yes you are mad, I know as I did that over 3 years ago. Went from at home => a cheep VPS => paid for Oracle VPS.

If you go down the lemmy route (vs piefed) then I would deply with Lemmy-Easy-Deploy by @ubergeek77. this makes setting Caddy and mail simple

I hit the same thing on git yesterday, used the “Main” search thing not realizing it was their copilot shit. it took ages to think, then spew out a pile of shit with the links to what I actually wanted buried in a wall of text - how the fuck is that better?

I’ve got sad news, some of those 90’s movies are bad quality when you are used to watching 1080p and above.

What sort of movies? I’ve never really looked for too much ()'s stuff except for the very popular stuff.