Hi, I'd like to share a project I've been working on the last few months. It was well received over at r/raspberry_pi, and since it now runs in a container and on pretty much anything, I thought it might fit here too.

It sits on top of BirdNET-Go, a popular self-hosted bird and animal analyzer that listens on a mic and identifies the species it hears.

Fugleramme draws the birds it has heard recently as real 1800s natural-history illustrations. Mine runs on a Raspberry Pi 5 with an e-ink display, but it also works on a TV, any screen or a browser and can run on pretty much anything with python or docker.

Everything runs fully locally and it works offline. Got no birds where you live? It can also read from a BirdWeather station.

What sets it apart: over 1200 hand-cut birds from scanned natural history works, covering over 700 species - all attributed and public-domain. No AI-generated images.

Live from my garden (running in docker on my homelab): https://fugleramme.arnegiacomo.dev

Source and docs: https://github.com/arnegiacomo/fugleramme

Happy to answer any questions!

I was thinking with more and more exploits coming out, probably a good idea to close down the ole ports again and VPN for access, worked through that over the past day.

Luckily it was pretty straightforward, but was curious when I was doing it if anyone else is feeling the same? I always had the impression that exploits were difficult to take advantage of depending on the exploit, but AI makes it so much easier to take advantage of them, feels a bit more dangerous out there.

I have firewall, and some observability but still..

What's everyone feeling like?

Hello everyone!

Pangolin 1.25 is here with two highly requested features from this community: HTTP redirects and mutual TLS (mTLS) for public resources. It also includes roles for machine clients and more!

Pangolin is an open-source, identity-aware remote access platform that simply and securely connects and authenticates your users to applications, infrastructure, and AI workloads.

GitHub: https://github.com/fosrl/pangolin

Redirects

Redirects can be attached to a public resource and share its hostname, so you can send traffic from one path to another at the proxy level. You can also create redirects on any domain or subdomain that Pangolin controls, even if there is no resource behind it.

Each redirect uses one of three matching rules. Exact matches a single path, prefix matches everything under a path, and regex lets you write a pattern for more complex cases.

Mutual TLS (mTLS) for Public Resources

Public HTTP resources can now require clients to present a TLS certificate signed by a CA you trust. Normally, anyone with the URL can reach the authentication page. With mTLS, the connection fails unless the client has a valid certificate from your CA, so unknown devices are blocked before they reach your resource.

Machine Client Roles

Machine clients can now be assigned roles just like your users. This way, servers and automation can share the same private resource access as a group of users. Their access is the union of direct grants and roles. You can still assign machines directly to resources.

Full Release Notes

Read the full article here: https://pangolin.net/news/1-25-release

Available for self-hosting via Community or Enterprise editions, or on Pangolin Cloud (Enterprise is free for personal use). If you haven't starred us on GitHub yet, it genuinely helps!

I'd like to expand my private Wiki beyond the contents of my notebook collection and a few random thoughts.

What topics would you recommend?

I’ve been looking for a good Android client for Firefly III, but Waterfly and Abacus haven’t quite met my expectations in terms of polish and overall user experience.

I’m considering building a native Android client for Firefly III and making it open source, but before I put in the effort, I’d like to know if there’s enough demand for it.

If you’d be interested in using such an app, what are the must-have features you’d want from Day 1?

Also, please mention your mobile platform: Android or iOS.

Your feedback will help me decide whether to pursue this project and prioritise the features that matter most.

Here's a quick script to check if you have a vulnerable version of php running on any of your docker containers.

https://gist.github.com/jonmchan/f68bf6aeb5e58048e6654743d9e618e5

$ sudo ./audit.sh

=== Starting Docker PHP2Shell Audit ===

[SAFE] Container: kimai-kimai-1 is running patched PHP v8.3.36. 
[VULNERABLE] Container: nextcloud-nextcloud-aio-nextcloud-1 (PHP v8.3.19) is vulnerable to PHP2Shell! 
[VULNERABLE] Container: wildcard-web (PHP v8.3.31) is vulnerable to PHP2Shell! 
[VULNERABLE] Container: root-web (PHP v8.3.31) is vulnerable to PHP2Shell! 
[VULNERABLE] Container: home-web (PHP v8.4.16) is vulnerable to PHP2Shell! 
[VULNERABLE] Container: whblog-whblog-1 (PHP v8.2.25) is vulnerable to PHP2Shell! 

=== Audit Complete ===

I've been running my own mail for a while. My first setup was Mailcow, and for my homelab I've now decided to go with Stalwart. Before switching I compared both in detail, so here's the short version. Maybe it helps someone facing the same decision.

Mailcow

• ~15 containers: Postfix, Dovecot, Rspamd, SOGo, ClamAV, MariaDB, Redis, Nginx…
• Official minimum is 6 GiB RAM + 1 GiB swap, 8 GiB recommended for 5–10 users
• Everything included: webmail, CalDAV/CardDAV, ActiveSync, antivirus
• Battle-tested components, big community, roughly monthly releases
• LXC isn't supported, needs a full VM

Stalwart

• One Rust binary: SMTP, IMAP, POP3, JMAP, CalDAV/CardDAV/WebDAV, spam filter, ACME
• ~100 MB RAM idle, 1 GB is enough for 5–10 users
• Pluggable storage (RocksDB, Postgres, S3…)
• JMAP support is great if you like building your own tools
• But: still 0.16.x, 1.0 isn't out yet. No built-in webmail (planned after 1.0), no built-in AV, some features are Enterprise-only. Read the release notes before updating – one recent update needed manual ALTER TABLE on MySQL/MariaDB setups.

Why I picked Stalwart: my Proxmox host runs lots of other services, and I'd rather give my mail server 1 GB than 6+. One process, one log, one config fits how I like to run things. And I barely use webmail anyway.

Why you might still pick Mailcow: you want everything (webmail, AV, calendar) working out of the box today, you host mail for non-technical people, and you have the RAM.

One thing applies to both: neither will fix your deliverability for you. Check outbound port 25 before you start, and set PTR records for IPv4 and IPv6. Gmail rejected my mail until the IPv6 PTR was set for the exact address, not just the /64.

I wrote up the full comparison (table, pros/cons, who should pick what) on my blog. It's in German, but browser translation handles it fine: https://frickelfabrik.de/blog/stalwart-vs-mailcow/

Curious about your experience: anyone running Stalwart in production yet? How did your Mailcow → Stalwart migration go?

In self-hosting setups, repurposing decommissioned Kindle e-readers, Kobo devices, and cheap Fire tablets as dedicated wall dashboards is a great way to give old hardware a second life without relying on proprietary cloud services or dealing with bloated lithium batteries.

Over the past few months, I documented three production architectures to achieve zero-lag local control:

1. Passive E-Ink screensavers: Headless SVG rendering pipeline running automated deep sleep routines on the reader, achieving 3 to 6 weeks of battery life per charge on Kindle Paperwhite and Kobo hardware.

2. Direct local ES5 touchscreen engines: Lightweight dashboard interface served straight out of Home Assistant local storage (/config/www) engineered specifically to render smoothly on older WebKit and legacy browser runtimes.

3. Debloated Android and Fire OS wall kiosks: Fire OS debloated via ADB to strip background telemetry and lockscreen ads, running Fully Kiosk Browser on an isolated zero-trust IoT VLAN with local REST controls.

For permanent 24/7 wall mounting, the build uses 5V to 3.7V/4.2V step-down dummy battery bypasses so you can remove the swelling-prone lithium pouch entirely and power the tablet directly from low-voltage wall lines.

I compiled all three architectures, circuit schematics, and 3D print mount specs into a complete walkthrough. All reference configs and free download links are pinned directly on my Reddit profile for anyone building their own setup.

If you run an e-ink or wall-mounted dashboard in your self-hosted setup, what hardware are you using and how did you handle constant power? Happy to discuss hardware setups in the thread.

https://github.com/0vm/NetDeflect (Apache-2.0, active commit history, screenshots and a demo video in the README)

If you expose anything you self-host, a game server, a VPN, a web app, a Jellyfin server, you eventually get DDoS attacks, floods and reflection attacks hitting the server. Most answers are either a paid DDoS protection service (like Cloudflare (no Jellyfin or UDP) or OVH) or writing your own rules that you have to figure out yourself and those will happily block real users when they misfire.

It runs on a VPS or whatever server faces the internet, installs in one command and only if you want to, it sets up as a systemd service. It exposes Prometheus metrics (node_exporter textfile or a built-in /metrics page) so it drops straight into Grafana, has a watch-only mode so you can test it against your normal traffic before it blocks anything, validates WireGuard and OpenVPN on your VPN ports and only filters the interfaces you pick so Docker networks are left alone. Honest limit: an attack bigger than your connection fills the line before it reaches you, and that has to be handled upstream. It handles everything that does reach the machine.

fail2ban works on logs, so it's too slow for packet floods and honestly useless against spoofed traffic. Plain nftables or a script can ratelimit, but it has no idea what the attack is and will ban forged source addresses which is exactly how you end up blocking your own users. NetDeflect samples the traffic, classifies the attack on real header fields (110 signatures, plus it fingerprints ones it doesn't know) and drops it in the kernel, while never banning spoofed sources. It also learns your regular users and lets them through first during an attack. I wanted something that does the detection and responds automatically and tells me what happened, rather than me writing rules mid attack.

I've been building this since 2021 and I designed and built it myself: the detection logic, the classifier, the mitigation, all of it. AI helped around the edges, generating novel DDoS variations to throw at it (basically trying to evade my own detection, until the model's safeguards kicked in and it refused to attack further), confirming whether detection was actually working during tests against my own services and helping track down bugs. I brought my own, somewhat outdated, knowledge of past DDoS attacks to the design. My bug-finding process is "push to prod and wait for someone to open an issue" (joke). More seriously, it's been audited by AI, by other network engineers and by the lovely people who open issues and PRs on GitHub.

This classifier can process data from the public DHT to filter, map, & match torrents extremely accurately while also filtering out malware, junk, and fake torrents. you can now obtain the same level of quality torrent feed data as a public site with simply a regular dht crawler (like bitmagnet)

I’ve been experimenting with how far you can push a tiny byte-level RoPE Transformer (8.3M params, 8.3 MB INT8 ONNX on CPU / <100 MB RAM with plugins) on a messy real-world domain: raw BitTorrent and DHT metadata. Instead of fragile regex rules, using a heavy LLM, or manually searching, a single forward pass predicts the content category, extracts clean title/year/episode byte spans, catches disguised executable lures and poisoned swarms, and resolves tricky audio/dub vs. subtitle-trap edge cases (like anime dual-audio or foreign releases tagged .Eng.Sub).

I've been using this with BitMagnet & Rats Search -> sonarr / radarr stack.

I’m still expanding the gold evaluation splits for a few minority classes, but across our current benchmarks it beats every open-source regex/BERT torrent parser we tested, and on most dimensions it matches or outperforms frontier fast-tier LLMs (Claude Haiku 4.5, Gemini Flash, GPT) while running locally in ~2.4 ms on a single CPU core.

I use AI tooling to help with pre-training data, docs, and charting, while the N proofing/benchmark splits are human-validated

I’ve split the release into two versions so far:

Armiger (~8 MB INT8 on CPU)
Armiger-Ultra (bundles 6 extra plugins and uses ~60–100 MB of RAM)

Base Armiger does almost everything out of the box and matches the full model 99.9% of the time on standard torrents.

Armiger-Ultra trades a bit more RAM to close the edge-case gaps: it’s +4.2% to +10.3% better on stripped/zero-cue TV and movie releases that lack S01E01 or year tags (+23.9% on completely bare titles via an offline hashed catalog), +2.2% better at catching foreign-audio subtitle traps (eng subs vs true dubs) , and adds a dedicated swarm-viability neural adapter (96.8% AUROC) that predicts whether a torrent will actually finish downloading instead of trusting fake seeder numbers.

find it here

Hi all, I’m very new to the selfhosted/homelab community, and I need advice from hopefully some of the sages here.

I’ve just gotten my first homelab set up on unraid and I’ve already hit a knowledge wall — while I’ve already gotten a handful of local services up and running — how the heck do I expose those services to the internet and do so securely?

I had planned to use cloudflared tunnels using a .cc domain I bought and relying on cloudflare’s zero trust for authentication, however, because I want my parents to be able to access my Plex server over the internet, that would violate the TOS for cloudflare tunnels.

So onto plan b — I’m kind confused with the options and what route to go down. I’d preferably want to actually use the .cc domain I purchased, TLS for HTTPS, and have each service/app behind some kind of authentication.

So here’s the questions, what should I use? What would you recommend? How do you handle this for your own servers? Do you have a better or simpler solution to what I’m suggesting? Am I on the right path of thought or way off base?

I ran out of storage on my all ssd nvme NAS...

With the current insane prices on SSD and (well everything computing) I thought about returning to HDD (at least for the time being) since I have a few used ones of those lying around...

So I turned to this Elite Desk G3 I found on ebay for $34 and installed a NAS Software on it (TrueNAS in my case, but it would work with most software I believe)

My build included:

• 3xHDDs of 4TB each
• 10 GbE on the PCIe slot
• TrueNAS boot on the wifi m2 with a A+E key adapter
• Dedicated apps pool (drive) on the G3 native nvme
• Had to get "creative" to fit the 3 drives inside the case!
• Power Consumption on idle around 24W, which IMHO is pretty decent

I did have to flash the bios password that came with the EliteDesk, but overall TrueNAS booted perfectly from the converted m2 slot, and runs pretty well.

Anyway... this is just a budget alternative that worked out well for me and I thought about sharing in case someone is looking for cheap hardware to run a NAS, so I made a video about it. The video also includes a setup for installing TrueNAS, creating a pool, user, dataset and SMB share in just a few minutes.

Hope this helps someone!

I have a media server running on my Terra master F2-425 on TOS7.

I have been maintaining the media folder structure and file names manually over the heart. So it's in a bit of a mess but it currently works in Plex.

I'm planning to run Jellyfin simultaneously and automate the file naming with Radarr. Radarr is installed in a docker container.

Problem is that I can't seem to get Radarr to map to my Movies or Downloads folders.

Here's what my volume's folder structure looks like. Red arrows show where my Movies and Downloads folders are.

https://drive.google.com/file/d/1hRQihfy3a2bL-cT9WdSMqtt6R7usnkYD/view?usp=drivesdk

And here's the parameters when installing the app mapping.

https://drive.google.com/file/d/14eZ5iKkz376zkINoqVZpXzfesvhIBurR/view?usp=drivesdk

Any help is appreciated!

The update is out: https://github.com/alexjustesen/speedtest-tracker

Hey everyone! 👋

A few months ago I shared GyroidVault here — a self-hosted, local-first web app to organize, inspect, and slice 3D printing models (STL, 3MF, STEP, G-Code) on your own server or NAS with 1-click slicer deep-linking and 3D millimeter dimension inspection.

Thanks to the awesome feedback from this community, I’m excited to release v2.3.0! This release focuses heavily on UI customization, homelab integration (SSO), and NAS optimizations.

(Full disclosure: English is not my native language, so I had AI assist me in drafting and polishing this post to make sure all technical details and release notes are clear!)

🌟 What's New in v2.3.0:

1. 🎨 Customizable Themes & Accent Colors

GyroidVault now features a dedicated User Interface tab in Settings with 6 built-in themes: - Dark Glass (Default): Calm glassmorphic look with subtle ambient lighting. - Slate: Neutral dark gray workspace. - Midnight: Deep navy dark theme. - Light Mode: Clean, bright layout. - OLED High Contrast: True #000000 pitch-black theme for OLED screens. - Cyberpunk: High-energy dark terminal with neon accents. - Plus 6 vibrant accent color swatches (Cyan, Blue, Emerald, Purple, Amber, Rose) with instant live preview.

2. ⚙️ Granular Module Toggles & Default Landing View

Don't use categories, print history, or network printers? You can now toggle off any features you don't need: - Toggle Categories, Collections, Tags, and Favorites. - Toggle Folder Explorer (Browse), Statistics Dashboard, or Format Pills. - Toggle Print History, Public Sharing, or Moonraker/Klipper Printers. - Set your preferred landing page (All Models, Browse Disk, or Collections).

3. 🔑 OpenID Connect (OIDC) Single Sign-On (SSO)

Native SSO integration with Authentik, Keycloak, Authelia, and Okta: - Auto-provisioning for new users on first login. - Configurable Role Claim and Admin Group mapping. - Customizable SSO button text.

4. 🌙 Spin-Down Friendly Disk Sync (for Unraid / NAS Users)

Multiple Unraid and TrueNAS users pointed out that the hourly background disk sync was waking up sleeping mechanical hard drives. - You can now set the Auto-Sync Interval in System Settings (or via SYNC_INTERVAL_HOURS). - Setting it to 0 completely disables automatic disk sync, letting your storage array remain in low-power spin-down mode 24/7 without unnecessary wakeups.

5. 📂 Library Scan Modes (Folder Mode vs. File Mode)

• Folder Mode (Recommended): Treats each subfolder as a single multi-part model (assemblies and multi-color prints).
• File Mode: Indexes each standalone 3D file as its own model with automatic companion pairing (e.g. benchy.stl + benchy.png + benchy.gcode).
• Root files in your library path are now indexed cleanly as standalone models instead of being grouped into a generic folder.

6. 🖨️ Creality Print Slicer Integration

Alongside existing 1-click launch support for OrcaSlicer, Bambu Studio (with on-the-fly .3mf packaging for raw STL files), Elegoo Slicer, and Cura, you can now launch models directly into Creality Print (crealityprint://) with 1 click.

7. 💬 Hover Tooltips & 🛡️ 1-Click Backups

• Tooltips: Hovering over truncated model or folder names now shows the full filename.
• 1-Click Backup: Export a complete .zip snapshot containing your SQLite database (gyroidvault.db), collections, print logs, and custom thumbnails for secure offsite backups.
• Automated Test Suite: Now passes 42 automated E2E and security checks in CI (npm test).

🚀 Getting Started

Docker Compose: yaml services:   gyroidvault:     image: ghcr.io/teecodedev/gyroidvault:latest     container_name: gyroidvault     ports:       - "3457:3000"     volumes:       - ./data:/app/data       - /path/to/your/3dprints:/library     environment:       - NODE_ENV=production       - PORT=3000       - LIBRARY_PATH=/library     restart: unless-stopped

Unraid: GyroidVault is available directly in the Unraid Community Applications store — just search for GyroidVault.

🔗 Links:

• GitHub Repository: https://github.com/TeeCodeDev/GyroidVault
• Official Website: https://gyroidvault.com
• Wiki & Documentation: https://github.com/TeeCodeDev/GyroidVault/wiki
• Ko-fi (if you want to support development): https://ko-fi.com/D1D51ZGUNL

I'd love to hear your thoughts, feedback, and any features you'd like to see next! Happy printing and self-hosting! 🚀

Hi everyone, I'm Robin. I've spent the last three months building Smart Drink Fridge, a small project that started with a Raspberry Pi, a camera and the question of how much beer was actually left in my fridge.

It's a drink inventory you run on your own server. When you take a bottle or can, you scan its barcode or book it through the web interface. That updates the stock and keeps a history of what was taken. You still have to remember to scan things; it doesn't magically recognise everything inside the fridge.

The project has grown quite a bit since that first version. You can now assign several barcodes and package quantities to the same product, so a crate and a single bottle can use the same stock. It also supports multiple fridges or storage locations, USB barcode scanners and remote scanner devices. Optional user accounts and NFC identification let you associate bookings with different people.

One useful part is the Home Assistant shopping list integration. Set a minimum stock level, and drinks get added to your shopping list when they run low, then removed after you restock. There are also consumption statistics and prices if you enjoy putting numbers to your fridge habits.

The server is Python/Flask with SQLite, runs through Docker Compose, and is free under the MIT licence. You can start with just the web interface on a compatible Linux host; a Pi, camera, NFC reader or display are optional. Your inventory lives on your server, and there's no hosted Smart Drink Fridge account to sign up for. Optional services such as product lookup and notifications do use external providers. For remote access, the docs cover Tailscale and HTTPS; the Flask service should stay off the public internet.

There's also a free iPhone and Apple Watch companion app now. It connects to your own server over HTTPS and includes camera barcode scanning, inventory, shopping lists and widgets. You don't need it to use the server. I'm also working on a native Android app. In the meantime, Android users can use the web interface.

Source, screenshots and setup:

https://github.com/DerRobin99/smart-drink-fridge

Installation guide:

https://github.com/DerRobin99/smart-drink-fridge/wiki/Installation

Optional iPhone / Apple Watch app:

https://apps.apple.com/app/smart-drink-fridge/id6799288886

I'd be interested in hearing from anyone who has tried keeping an inventory like this: did scanning become a habit, or was that the part that made you give up? Feedback on the setup and everyday workflow would be especially helpful.

I just set up my I-P.T.*V (trying to avoid spambots here) and it works great from a quality standpoint. I am currently watching through Dispatcharr-to-Jellyfin which... works... but its not great. You have to manually click play for each stream on seperate windows. Is there a service that allows switching channels like the old days of cable tv? Thanks!

Hello all,

I am starting a CTE program on IT infrastructure and support. I want to purchase servers or server equipment that I can use as part of instruction. Some of the topics I thought kids could explore during their labs were

• Setting up Dedicated Servers on the LAN and running video game servers on them
• Setting up a self hosted LLM
• Setting up an application server for student projects
• Setting up a self hosted DNS Server
• Local File Storage for another CTE program
• Setting up a local Mail server ( no exchange, never again)

We're on some grant money, so we can use this to purchase new equipment. I'm trying to figure out which of these servers can run on the same server (I'm guessing the video game and application server can run on different partitions), but I'm less clear about the LLM and the DNS server.

I don't have a lot of experience setting up servers other than a Proxmox server I ran some software on. Can anyone give me some suggestions about how much RAM, CPU, and GPU power I'm going to need for those. Keep in mind this would serve about 20 students plus myself, so they don't need to be that powerful, but I'd like to purchase rack mounts so that students can understand what professional work looks like.

Pulse is a status page and uptime monitor that runs as one Go binary with a SQLite file. No separate database, no Node, no Redis. The checks run inside the same process.

What it does:

- HTTP, TCP, ping, DNS and TLS certificate checks

- Several status pages on your own domains from one instance

- Incidents with a timeline, maintenance windows that mute alerts

- Scoped API keys, 2FA, Prometheus metrics

- Imports your monitors from Uptime Kuma

Install it with apt, Docker (amd64 and arm64) or one binary. Releases are signed and come with SBOMs.

Live instance: https://status.shreeda.xyz

Code (MIT): https://github.com/memetics19/pulse

Docs: https://docs.shreeda.xyz

I built it for my homelab and it's what I use every day. It's young (3.0 just shipped), so I'd really like to hear what breaks or what's missing. Alerts are email and Slack today, and ntfy, Gotify and Discord are next.

Hello all,

I am trying to deploy Crowsec WAF on my self hosted Vaultwarden instance which is behind Traefik but I am a bit confused and would appreciate some help.

I already have Crowdsec installed *as a package* and working on the host. My Vaultwarden and Traefik are running as Docker containers.

Crowdsec's documentation of the WAF only talks about deploying it as a container, so I am not sure if there is a way to somehow add the feature to my existing, working install. Even though since the WAF required communication between Traefik and the Crowdsec instance, that would mean I need to give my Traefik container access to the host network which I see as a downgrade.

So my question is: shall I deploy the WAF as a container on top of the existing setup? Is this even possible? Or shall I stop and remove the package before?

Thanks for your help.

If you run the LiteLLM proxy in Docker and let Watchtower or anything similar auto-update it, check it now. The 1.107.0 release on PyPI and the official image litellm/litellm:1.107.0 carried an infostealer plus a backdoor that polls the attacker's server for new code every hour. The latest, main-latest and main-stable tags pointed at it, so auto-updaters pulled it in. The image has since been removed from Docker Hub and GHCR. Original analysis from Aikido: https://www.aikido.dev/blog/litellm-compromised-infostealer-rat

What it took: every provider API key stored in the proxy's database (it read LiteLLM_CredentialsTable directly), plus cloud credentials, SSH keys, env vars, Kubernetes tokens and more.

Quick checks. Don't exec python or pip in the container to check, the payload runs on interpreter startup:

docker images --digests litellm/litellm
docker ps -a --filter ancestor=litellm/litellm:1.107.0
docker exec <container> ls -la /tmp/.pc_once_72129118c59f5636c0bb /tmp/remote_code_loader.lock

The first file means the stealer already ran, the second means the backdoor ran or is still running.

If you get a hit: cut its network, rotate the provider keys from another machine right away, then rebuild. And pin images by digest instead of a moving tag, at least for anything that holds API keys. This is the second LiteLLM compromise this year (1.82.7/1.82.8 in March), but last time a pinned Docker tag kept you safe. This time the image itself was bad.

Disclosure: I work on LLM Gateway (open source, also self-hostable). We put the full checklist, IoCs and what to rotate in one place here: https://llmgateway.io/blog/litellm-compromised-again

I'm back.

https://www.reddit.com/r/selfhosted/comments/1x9ldb1/self_hosted_llm_goals_possible/

I posted this earlier this week or something and I'm at a cross roads.

Part of me wants to set up a local AI model for the learning ability of it. (how to do it) but I got a lot of people saying i shouldn't bother due to too low of compute.

What sort of computer (specs) would you suggest I get for an average AI model and can also use for some other things (tail scale exit node, plug into TV to use as a better OS / compute for TV)

the device I have could be upgraded to have an SSD instead of HDD and up to 32GB ram. But not sure if worth it.

Thanks!

I'm not sure if this is the right subreddit for this, but I see lots of discussions on NFS, SMB, etc. so I figured this would be the right community to ask! Also, full disclosure, I've made a [nearly] identical post on r/homelab, but I want to get as much advice as possible so I figured I'd ask here too. Unfortunately crossposts are not allowed, so I had to make two separate posts.

I'm trying to set up my workflow such that I download my .TIF film scans (i.e. 100MB+ per image) to my PC, since it has plenty of storage available, and then have a network mount on my laptop for the directory containing the images. Once I do that, I'd be able to work on Darktable on my laptop using the images stored on my PC. Only issue is... both NSF and SMB are unbearably slow. Copying a single roll's worth of photos (12 images + corresponding .XMP sidecar files, ~1.5GB) takes up to 10 minutes, and waiting for a single image to load takes several seconds.

While I don't have gigabit internet, I do consistently get 200Mbps down, 100Mbps up (according to speedtest.net). And, I will admit, my setup does involve Tailscale since I often work on these photos from outside of my LAN. Ping between the two computers when not on the same network is 5ms-10ms, sometimes up to 20ms. I'm not the most knowledgeable person networking-wise (that might already be apparent from this post 😅) so I don't know if the ping times are that relevant, and I don't know how to measure up/down speed directly between the two. When I do try to copy files over, either via NSF, SMB, SCP or Taildrop, they don't seem to go above 10mb/s.

Inspired by u/jonmchan's post, here's a script to audit eMudhra's compromised intermediate CAs in your containers

Gist on GitHub