Google nagged me into this, along with every other enshittified cloud ~~provider~~ dealer. For about a year, my phone warned me that the account was nearly…
54 comments
My experience is similar. I no longer use dedicated NAS, firewall, or other exotic distributions. I run plain Debian, and add what I need through standard repo packages. My "NAS" is simply a Samba daemon. The same box runs countless other services including hostapd (WiFi), DNS (Unbound), an email stack (Postfix/Dovecot), multiple game servers, and Podman.
> everything else in Docker Compose
I would suggest Podman instead. It is far more secure by design (rootless) and is unable to silently alter the firewall's configuration.
I'd like more informations about this as I'm not too familiar with firewall setup but every time I tried to setup iptables / nft it was indeed bypassed by docker. Recently I found out in the docs that docker adds a DOCKER-USER table, isn't it enough to put your rules in it to prevent the outside world to reach containers ?
Though I really don't use the server anymore and it's probably worth several thousand dollars with the RAM in it. Been thinking of using a spare laptop with external HD bays to do the same job.
I used btrfs raid0 on USB drives for more than a year. Every month or so, a drive would disconnect from the bus and immediately redetected as another device (sde->sdf). Btrfs does not auto-recover from this. The choices are 1) reboot and scrub, which recovers the missing drive without doing a full resync, but it needs a reboot (any hosted site is offline for 3 minutes) and scrub takes a long time reading in the background, or 2) run btrfs replace which doesn't need a reboot, but the full resync takes even longer than a scrub and increases wear if it's a ssd because it wipes everything and writes all data again.
Everyone who builds this should really have "homeprod" and "homelab". And when the experiments and tests inevitably lead to an outage, the movie streaming or photo storage or home control parts don't die with it.
But I'm not as convinced as the article's author that "NAS" is outdated as a separate concept, just that as new people learn more about networking they rediscover why just having storage on in its own box can be a good setup. And when new people are brand new, having everything on one box is conceptually simpler, though not always optimal.
I think, in the family/household context, I like the names:
Homelab: the box/cluster you use to experiment and test new stuff.
Homeprod: the box/cluster you use to deploy stable services for family. Runs only things that have graduated from at least a yearlong successful deployment or so on homelab.
Homebase: the box/cluster you use to make ZFS pools and databases available to both homelab and homeprod (on the same network or overlay network). Basically a NAS in the older sense of the word, before homelabs started expanding its scope in casual use.
Famadmin: the sysadmin for the family (i.e. "you" in the three items above). The person to whom, as you say, "providing services that support your family's larger existence, independent of the surveillance industry," is a matter of deep principle. And well put, BTW.
Maybe the division is more apparent if you're using containers, and/or have more of a social group to communicate support levels to? Personally I'm just using NixOS and am still at the stage of "I'm going to reboot the router now, it might take ten minutes or it might take days" [0]
If we don't need this distinction, then perhaps "homebase" could actually make more sense than "homeprod" ? Slightly different connotations, less putting on a show for lots of people but more homey like for a small family?
[0] from a technical perspective I'd love to separate the router out onto its own machine, but I want fast wireguard/openvpn/TOR/etc so it's a VM on a larger machine and I'm not really looking to expand my power consumption footprint to another large machine. I suppose I could split it out to two routers, one with straight NAT+wireguard and one with openvpn/TOR/etc, then the main could run on its own low-power box.
I'm wondering what:
- the failure mode is if it can't provide enough current.
- How to properly test it under a fake load
- If these tiny power cables can really handle 150 W (this is 12 A at 12V). I don't have such a powerful 12V PSU, so I am thinking about adding capacitors to handle transients.
I imagine that it is really built to handle transient peaks to 150 W, with a more reasonable baseline.
Anyway, if anyone knows a good knowledge source for these PSU, I'd be interested.
My initial motication for going with these was:
- hopefully increase my PSU efficiency
- less cable clutter
- hopefully power it from a small DC UPS (there are plenty of "router" UPS sold on the market, though the power rating is a bit low, 18-36 W usually).
Measurements are not accurate, but comparable. I used a Tasmota smart plug - the same one in both cases.
Anyway, it may be a transient that I am measuring, as the PC turns off during the boot sequence, after the CPU fan starts revving up. My 5A PSU may not be enough, I'll try limiting the TDP and the power brick.
Realtalk: make sure you are religious about testing your RAM if you're going to run ZFS with non-ECC RAM. I'm not going to say “don't do it”, but know what you're getting into and how to protect yourself from this failure mode.
It's unintuitive, but ZFS will actually modify your files on disk as a side effect of a read-only operation if blocks get read into bad RAM and checksum mismatch compared to the blocks on disk.
This happened to me in 2013–14 with some bad PC3 10600 in my 2600K desktop FreeBSD system, and it rotted a bunch of my most frequently accessed files. I was able to figure out what was going on once audible blips started appearing in all of my favorite most-listened-to music, then I learned about `flac -t` and was able to confirm the rot thanks to the fact that FLAC files embed an expected MD5 digest in their `STREAMINFO` block. `man flac` sez…
“In test mode, flac acts just like in decode mode, except no output file is written. Both decode and test modes detect errors in the stream, but they also detect when the MD5 signature of the decoded audio does not match the stored MD5 signature, even when the bitstream is valid.” (emphasis mine)
[Lammy@popola] flac --test "Floating Door - Hypersomnia in loop - 12 templeOS.flac"
Floating Door - Hypersomnia in loop - 12 templeOS.flac: ok
[Lammy@popola] metaflac --show-md5sum "Floating Door - Hypersomnia in loop - 12 templeOS.flac"
d9ccdc78cfa45dda01b38198575b4f56
[Lammy@popola] flac --decode --stdout --silent --force-raw-format --endian=little --sign=signed "Floating Door - Hypersomnia in loop - 12 templeOS.flac" | md5
d9ccdc78cfa45dda01b38198575b4f56
After that experience, I moved my ZFS storage to a dedicated system — first on an Atom C2750 board and later (and currently) an Atom C3758, both with ECC UDIMMs. (Stay away from the C2xxx series tho; they are all doomed to CLK-circuit-degradation death which repairing only prolongs but does not prevent)Read the full thread on Hacker News →
Related stories
- Hacker News · 4 points · 11 days ago
- Google Home MCP Serverdevelopers.home.google.comHacker News · 2 points · 10 days ago
- Linux Server Hardening Best Practices: Essential Steps to Secure Your Servermobilestuff2026.blogspot.comHacker News · 2 points · 3 days ago
- The Verge · 0 points · about 16 hours ago
- The smart home graveyard is getting crowdedtheverge.comThe Verge · 0 points · 4 days ago
- Hacker News · 27 points · 13 days ago