Hey, thank you for the comment!

That makes sense, that I would be tightening security on the LAN. It’s not just one machine, I have a Raspberry Pi 4 as well running a flavor of Debian (and the Synology NAS), so I would assume a firewall on both the Raspberry Pi and my NUC would make sense? I don’t have any VMs that I’m aware of, and I’ve heard of VLANs but don’t know anything about those.

Services don’t always have to be available! It’s just me and my partner who are accessing them, so nothing like a lot of people who need media playback. I’ll have to weigh if it’s worth fighting with the NAS over auto reboots, but I’m leaning towards yes as an experiment. I’ll have to actually look into how to do unattended Debian security updates, though.

Finally took the leap and wiped my NUC to start doing things over. Originally had a family member who works in IT set everything up, but he did the absolute bare minimum and I screwed some stuff up along the way the first time around, so I figured now was as good at time as any to teach myself to set things up from scratch!

I also have moved from Portainer, to Dokploy, to Arcane for docker management, and I actually really like Arcane. I’ve also accomplished something I’m really damn proud of, which is getting HTTPS working on Tailscale (so, for example, arcane.(my subdomain).ts.net but with HTTPS!) alongside Pocket ID for all of it. Maybe it’s just me, but I had trouble finding clear documentation on how to do this, no matter how much I searched. But I documented it for myself, at least. And it’s probably that I lack a lot of knowledge in this field, too.

I have some questions, and although I know there’s a chance this gets buried, I figured I’d try asking anyway. Little skittish about making a thread myself.

My NUC is running Debian 13, and I was wondering some security things. Everything is behind Tailscale and I don’t plan on exposing anything to the internet (even through Tailscale Funnel, I’m using Tailscale Serve for the HTTPS.)

• How valuable is a firewall in this case? I’ve never used one, and I’m wondering if it’ll just make adding services more of a hassle than it’s worth for the security since everything is staying local.
• Similarly, what about Fail2Ban? I have it on my RPi and it’s not a big deal to set up, but I was reading a firewall is more important?
• Is it okay to run unattended updates for security OS stuff on the NUC? I don’t always check updates, admittedly I’m easily distracted and forgetful. I’m a little worried about auto restarting it to finish the updates up just because I utilize a NAS and sometimes it’s annoying to get them to reconnect to each other (even with the fstab edited) when there’s a restart for either of them.
• Thoughts on auto updates on docker containers? I know this is pretty personal preference, but I mostly ask because I’m forgetful and distractable. I know this is kinda my own problem, but I want to know other people’s thoughts if possible.

Thank you for reading my very long update! And any answers to my questions are very appreciated. Hope everyone else is doing well!

Thank you again! I actually really appreciate the infodump and it was well explained. I’ve made notes on this in my selfhosting documentation so I can reference it later! I didn’t even know the difference between “docker volumes” and “bind mounts” really.

First, thank you much for suggesting BookOrbit! I actually just installed it because I was having a lot of issues with Grimmory making dupes of books in every folder and couldn’t figure out why it was doing it. Haven’t had any issues with BookOrbit and I really like that it’s got achievements. Plus, the less RAM usage is nice.

I’m using docker and docker compose files! Thank you for answering, the last time I took a crack at selfhosting, I really felt lost and screwed a lot up, so I wasn’t sure if that was even possible.

Oh I can actually answer something, neat.

I thought I was missing the appeal too, but when I got back into tabletop roleplaying games, a lot of the community is located over on Substack blogs, and I don’t like Substack. My solution was to start running FreshRSS and put all of the feeds into it so I could read at my own pace, and also not have to go to a million sites to keep track of content. Saves me a lot of tabs in an internet browser, if nothing else.

Sadly, not all sites or blogs have RSS feeds to hand out, but I’ve used https://openrss.org/ to get around that for the most part if they don’t.

Finally think I got everything installed on my Raspberry Pi 4 that I want there, thankfully.

I’ve been trying to document my journey with selfhosting this time better than previous attempts, as far as writing down what worked and didn’t work. It’s coupled with me trying to write little explanation guides for my partner about what service does what, and how to use them. They’re really excited to actually use them, but I want to get the guides done first, which has been a challenge.

Kinda surprised Grimmory is taking up so much RAM but if it becomes an issue I’ll put it on my other, beefier server. It was the last service I was struggling with, because every time I would upload a book, something would go wrong. An example being that one time I uploaded a book and it went into every single folder after, then deleting one copy deleted all the copies.

Admittedly, I’m not terribly well experienced so it was probably an issue on my end. Still learning!

Speaking of, my next project to tackle is overhauling my more powerful server and what it’s running. Since I use a split setup where I store media on my NAS, I’ve had difficulties with databases hating that aspect. Now that I know a bit more than I did when I started, and I have nowhere else to ask (thank you for having this community, by the way, it seems a lot more newbie friendly than some others) I was wondering if I could map the database of a service to be on the server itself, while having the media mapped to my NAS? From my research, I think this is possible, but I’m not 100% sure.

Hope everyone else’s experiences are going well!

hi! first time posting from this account, but a long time lurker.

I have Adguard Home on my router, but here are my other machines. I’m currently working on overhauling the NUC, mostly because I didn’t know what I was doing when I got it.

I use Dokploy for my services right now, I like it more than Portainer.

currently running on a Raspberry Pi 4:

• Diun (for notifying me of updates to my containers)
• PDFding (for my ttrpg collection and some other stuff like crochet patterns)
• Grimmory (for ebooks)
• Mealie (for recipe storage, I don’t really use the other features)
• Pinepods (for podcasts)
• Shiori (for archiving webpages and bookmarks)

things I’m going to be running on my NUC:

• Prowlarr (it’s just easier for me to find stuff using the interface)
• Diun (again, notifying me of updates)
• RomM (for game ROMs, I like that some of them I can play in my browser or put on my desktop)
• SABnzbd (for sailing!)
• Qbittorrent (same deal as above)
• Emby (was using Jellyfin but for a couple reasons I want to try Emby. if I don’t like it, I’m going back to Jellyfin)
• Tubeless (it’s a fork of Pinchflat, which is a way to download Youtube videos specifically to watch them through something like Emby or Jellyfin)
• Navidrome (for music playing, planning on using Feishin on desktop and Symfonium to listen to it on my phone)
• MusicGrabber (kinda does what it says)
• probably Immich (unsure on this, might just store my photos for safekeeping but I kinda like the idea of looking at them laid out like Immich does)

I currently have a 10TB NAS in RAID 1 for storage, though I’ve found it a bit difficult to map storage to docker containers while leaving the databases on the NUC because I have very little experience and am still learning. thankfully, I’m taking notes this time around.

I would love to get more storage, but man. prices.