Yeah that’s my guess at well. Before I figured it out, I used a VPN connection into my local network (which works through hairpin NAT). I’m not a security expert, but that may be more secure than granting the permissions wholesale.

I had this happen too recently and only for certain apps. Turned out Android has a new permission that was being enforced: “Nearby devices”. Once I granted that to my browser, it could access my LAN again.

Your diagram is almost right, but I think it will help to understand more of the details. It’s important to understand the difference between DNS (domain name lookup) and IP routing.

To break your diagram down more, this is what happens when any computer looks up your website:

1. The device does a DNS lookup of “example.com” using their name server, which may forward it to another DNS server (most home routers do this). I won’t go into the multiple levels of DNS lookups and caching here.
2. Through looking it up by DNS, the device now has the final IP. DNS is now out of the picture and we’re doing IP routing.
3. The device tries to make an HTTP connection to your external IP. HTTP is a protocol that runs over TCP/IP (UDP is used for QUIC/HTTP3). To keep things simple I’ll stick with old fashioned HTTP over TCP without SSL. I am also skipping over NAT.
4. For TCP, it performs a handshake, which the reverse proxy will negotiate. Once the connection is established, the browser speaks HTTP to the reverse proxy. It looks something like:

GET / HTTP/1.1
Host: example.com
...lots more headers...
<blank line>

5. The reverse proxy then takes that request, maps it to an upstream (if any), and makes another request to it via the configured transport. If that part falls down, you will see a 503 error. Otherwise, you will see the response from the upstream, possibly with some modifications made by the reverse proxy (some will rewrite links and cookie paths, for example)
6. The reverse proxy sends that response back to the client.

That’s all very simplified, of course.

As others pointed out, things may seem to work differently from the “inside”, if hairpinning is not available or enabled. This is not related to DNS, but to IP routing. The firewall doing NAT can get confused and not know what to do when an internal request goes to an external IP that it itself has. When it turns that around and routes it back to the internal network, that’s called hairpinning.

One “fix” for this, often used in enterprises, is to use so-called split DNS. All that means is that if you’re asking your internal DNS server for an internal name, it will give you the internal address (192.168.1.123 for example), but an external client would get an external IP.

TL;DR: DNS and IP routing are separate concerns and happen at different parts of the TCP/IP stack.

I guess that’s fair, and I really need to learn to not make off the cuff statements without going into details on Lemmy :)

I really had in mind more things that have prices printed on, etc. I definitely agree we would be better off including tax on price tags.

I agree it shouldn’t take that much effort to include it in things that have dynamic displays (like gas), but I suspect the reason for that is part inertia, part confusion when it’s included or not, part nobody wants to look like they raised prices.

Sales tax in the US is also not a VAT. And every state and municipality are free to have their own rules. My town where I live and the next one over have different sales tax rates (on top of state sales tax), which is part of the reason why it won’t be on the price tag. It’s just not practical.

Glad you got it working!

My hypothesis is that it was DNS (channeling Jeff Geerling here). Since Pihole is your DNS (makes sense), it may have recognized that address as its own and given you its IP. By resolving the naming collision, you fixed the problem because the name is now unambiguous.

These problems can happen very easily when you’re using DHCP and sharing a network and domain name between your clients and upstreams, so I think using home.arpa for one and your other domain for the other was a good idea.

What is your DNA setup like? A lot of dhcp clients are set up to register their name in DNS (if allowed). It could be your pihole server is hijacking it.

If you have multiple DNS servers (eg your home router and your lab) them you may not be getting the full picture.

Can you confirm that the DNS actually resolves to the NGINX IP address (and only that address) when you use PiHole’s FQDN? It sounds like it’s bypassing the proxy because it stopped working when you turned 443 off.

100% this. I’ve gotten the same spam even on Mastodon. They are cat fishing. They will get you engaged with photos they stole off the Internet (sometimes you find them with reverse search), then try to get more personal on a less moderated medium like email or text, maybe Signal or something. It’s a long con, but can go as far as “pig butchering” scams that can cost you everything.

When you get these, just report and block. They’re most likely a bot, or worse: people who are victims of human trafficking forced to scam people. (I suggest not researching this if you have any shred of faith in humanity left.)

For learning, VMs are fine. Spin up as many as you’d like. Install, duplicate, reinstall, delete at will. I would start there.

Then, while you’re learning, set aside since money to get an SBC or mini pc. That will allow you to keep it running as a server continuously. Phones can work for this, but to act as servers you’ll probably need to root them.

Computers are way more expensive than they used to be but within reach for most people if you can save up for it.

Check thrift stores, Facebook, eBay, the usual suspects. Watch out for PCs stripped for RAM and other shenanigans, though.

I read that they walked it back but only partially. And the fact they tried it tells me they can’t be trusted with my data.

They also make it very difficult to move your data off their NAS once it’s on there, because everything is proprietary.

Your best option remains open source with commodity hardware. Had I known what I know now in 2023, I would have probably just built a low power PC server with TruNAS.

Synology has started enshittifying their products lately by forcing you to only use their hard drives, etc. I have a DS933+, but I’m only using it for file storage and trying not to lock myself into their apps. It works well, but to avoid lock in your only real option is open source.

Married with five kids?

best known for his ability to roll cigarettes with his lips.

I see.

No. You should scrape off chunks but you should not rinse them off completely.

Like others I highly recommend seeking the wisdom of Technology Connections on YouTube, but if you prefer reading over video, here is an article from The Spruce that covers the main points.

It depends greatly on the game. For a shooter I probably just want to jump in for a little while and blast things. A lengthy intro will just be annoying.

Even forced tutorials are annoying like that. I like when games give me the option to skip, and then to come crawling back to the tutorial when I clearly should have done it anyway.

I think games that let you pick your own style and pace work best for me. Open world games, for example, where I can go discover the story for myself, but it’s just there in the background otherwise. I’m ok with some hints though, like overhearing NPC conversations or finding random notes.

Even something we simple as Portal works. You’re solving puzzles, but you can discover the story behind it by looking for more clues. Half life, too, is really light on telling you what’s going on until you play through and discover more. But you could also just play it through without paying any attention to the story part.

I don’t think I’ve bounced off a game because it was lacking a story, but I’ve definitely given up on games because there was too much fuss to get going. I have little tolerance for long unskippable cut scenes and dialogue as well.

I have quit games I just couldn’t figure out or enjoy without taking a long time to learn how it works before even getting started. I like to learn things gradually.

Don’t get me wrong: a good story that is revealed over time to be does add a lot to the game. I just want to feel like I’m paying a game, not watching a movie or reading a book

I don’t see anyone addressing the question from the post: whether it is a problem that Docker Desktop on Linux runs in a separate VM.

The page says:

Docker Desktop on Linux runs a Virtual Machine (VM) which creates and uses a custom docker context, desktop-linux, on startup. This means images and containers deployed on the Linux Docker Engine (before installation) are not available in Docker Desktop for Linux.

To expand on what that means: If you install Docker as usual (the CLI) on Linux, it runs as a process (running as root). The process will isolate the container processes from the rest of the system using Linux kernel features, but you’re really just running processes on your host kernel that have limited access to the file system, network, etc.

When you run in it a separate VM, which is how Docker Desktop is also run on Windows and MacOS, you are running it in a separate Linux instance (VM) that cannot communicate with the outside by default. So, if you’re running Docker on the host computer and inside a VM, those are separate Docker installs and can’t talk to each other. That is what the warning is about.

You can absolutely expose the VM to the outside, the same as if you ran it on Windows. Docker will let you expose those ports and it handles the messy bits of the networking for you. You just have to tell Docker when you run the container (on the command line or in a docker compose file) which ports to expose. By default, nothing is exposed. To do that you can use the -p option. For example:

docker run --rm -it -p 8080:80 httpd

Will run an instance of Apache HTTPd and expose it on port 8080. The container itself listens to port 80, but on the outside it’s 8080. If you then hit http://localhost:8080/ you should see “It works!”.

A note on Docker networking: from within the container, localhost is referring to the container itself, not the host. So if you try to do e.g. curl http://localhost:8080/ inside the container, your connection would be refused.

Docker Desktop is often frowned upon because you have to pay to use it in a commercial setting (there was some backlash because it used to be free), it’s quite expensive, and they require a minimum license count for enterprise licenses (I know because we bought one at work). So, I suggest exploring free alternatives like Podman Desktop. However, note that they do not always have feature parity with Docker Desktop.

I like Docker Desktop because it gives me a nice dashboard to see all my containers, resource usage, etc. I would not have requested it for work, though, if it weren’t for my IDE (Visual Studio) requiring it at the time (they have added Podman support since).

Final note: I recommend just diving into using Docker from the command line and learn that. Docker complicates networking a little bit because it adds more layers, but understanding Docker is very useful if you’re into self hosting or software development.

If you’re just looking for appointment scheduling then Easy!Appointments may work. It has a self-hosted version. Note: I’ve not tested it, I just went searching online because I was curious.

Aside from that, there looks to be a ton of WordPress plugins you can use, though they usually have a (smallish) cost associated with them.

No idea about your specific case, but in the past when I’ve had frequent zombies it’s been due to some blocking network process; typically NFS mounts.

They don’t use any resources, but I agree they’re annoying and could indicate some underlying issue.

I would check for issues with I/O and network access, especially anything that happens at kernel level. Look for anything suspicious in dmesg.

I’m not a cyber security expert, but I think about it this way:

First, consider your threat model. What could possibly go wrong? What do I do if the worst thing happens? What information do I need to protect? If everything is already public (like blog posts), maybe there isn’t much of a threat of information loss. If you keep your tax documents on there, maybe rethink that.

Second: think defense in depth. None of these measures will make you totally safe, but every barrier is another thing that can make a hacker’s life more difficult. You move the ssh port and it’s not as easily found by someone who’s just literally scanning the entire Internet for open ssh ports. It’s trivial to find, sure, but at least you dodged one bullet.

OK, they found your ssh port. Now they’re gonna start scanning for common username/password combinations. Fail2ban will stop this by blocking access after a few failures. If your credentials have leaked somewhere, the hackers may have a good guess at it though. But you’re OK because you’re using a key pair not your usual password (please don’t have a “usual password”).

Bad luck: they guessed your password. Or maybe they exploited a bug in your web server software (must have been a zero-day because you kept things up to date). Their exploit needs to open a server port for them to talk to, though. You blocked it on your firewall so that didn’t work. They try a reverse shell, but you blocked outgoing connections, too. Well done.

And on it goes.

If they keep trying, they will eventually succeed, but they have to try a lot harder when you lock things down, and the longer they are at it, the more opportunity you have to notice.

your Blinkenlights fluid. Not to be confused with blinker fluid