Same. I just stopped apache and let everything else run.

Sir, this is /c/selfhosted.

Oh, you can tear it down as soon as you get the certification.

Mine still runs decades later though.

If your domain registrar doesn’t do DDNS, and you don’t want to pay extra for one that does, you can get free DNS for life at Hurricane Electric:

https://dns.he.net/

All you need to do is finish their little online IPv6 course. TBH the “course” is just setting up your own server properly and proving it.

When I retire my desktop PC, the old parts become my router. If you have two network ports, it can do it.

To warrant the power bill, it’s also a NAS, NVR, mail server, print server and web server.

All my Wifi APs are various home routers flashed with OpenWRT.

Don’t scan your face for Insta,

The influencers want your polaroid.

Don’t scan your face for Twitter,

Elon wants your dogecoin.

Don’t scan your face for YouTube,

The vloggers want your shorts.

Don’t scan your face for Twitch,

The Slime Ranchers want your plorts.

It’s running the private DNS for my phone. If it goes down, I realise quite quickly.

Nope. I don’t use them. Especially not to communicate with a server in the same room.

That’s the best part! I used a “-” because nobody supports it. If I used a “+” like gmail, it would be very obvious what my base address was.

I have the format “{user}-{anything}@mydomain.com”. The aliases are separated by the hyphen (automatically), and they’re all permanent. I use a password manager to keep track of which service uses which address. Making them distinct prevents data brokers from linking them all.

It’s because people keep finding ways around them and they evolve in nonsensical ways.

I’ve been on IPv6 years before Google turned it on. My ISP gave me a /48 and I’ve got different subnets for my WAN, LAN and guest LAN. I have a 4-port NIC so I could put a different subnet on each port.

I didn’t mention it in my first post, but I only made AAAA DNS entries for my internal stuff. I just enable IPv4 for the few services that actually need it.

Nope. SSL certs are pinned to the hostname, not the IP address. I can change the IP address in DNS and it will still work.

That’s exactly what I’m doing.

I’ve also got a completely different DNS config for WAN and LAN traffic. WAN devices can only resolve PTR records for my mail server. My LAN devices have DDNS so internally they a get allocated DNS entries by hostname. Even my guest network has a different config for isolation.

They definitely all need to be kept separate.

Routing between two interfaces on the same NIC takes nanoseconds. You wouldn’t notice a performance difference.

When I first set it up, I didn’t have a static IP address, so it would not be great when it changed. I also want my server to remain reachable locally if my internet goes down. I had different firewall/ACL rules for wifi too. For example, some of my internal websites only prompt for a login if you’re outside the network.

IPv6 has been awesome here. I have my server and clients on different /64 subnets in the same /48 block. The nearby devices on Android assumes only the same /64 is local.

I think Firefox also gave me the first clue that something was up.

Native apps all have a backwards-compatible setting so it’s allowed by default. That will surely get dropped when Google bumps the minimum Android target API so newly published apps need to explicitly configure it.

I actually went through my apps list and disabled nearby devices for all the apps that don’t need it. It’s a good security measure. I just don’t like how it was rolled out.

I self-host a DoH/DoT server and my local DHCP advertises it to local clients. It’s kinda cool because android phones on my wifi will use DoT when private DNS is set to “automatic”.

Private DNS sort-of broke while I was tinkering with internal/external IP addresses for nearby devices. It wouldn’t always connect when I specified my external IP (despite being available externally). I made it IPv6-only too. It wouldn’t be the first time something couldn’t handle it.

I’m actually on GrapheneOS.

I’ve found that you can deny “Network” permissions and permit “Nearby devices”. The app becomes LAN-only this way.

I’m actually using GrapheneOS.