u/TheSchred

I'm using Thunderbird for android and coudn't find any information on how the higher polling frequencies (like 15 or 30 minutes) affect battery life, but I can't imagine it's that much. I'd also be interested in how they compare to push notifications or if there is another reason I shouldn't choose the highest polling frequency I just can't think of. I have a relatively modern smartphone (Galaxy A55), if that's relevant.

Thank you all!

Hey everybody!

I have the following problem: I have a WireGuard network running on my Raspberry Pi that my devices, including my android phone, connect to to access the services running on it. On my phone I specify the DNS server running on my Pi, which returns an IP in the VPN subnet for my domains, as the DNS server in my WireGuard config. Only traffic going to IPs in my VPN subnet gets routed through WireGuard.

I have now decided to get ProtonVPN and would like to use it on my phone as well. However, I can't have both VPNs active at the same time. So I either lose out on access to my services (they are publically accessible, but only using forward auth meaning mobile apps don't really work) or on Proton. My idea is, that I could run proton on my Pi and route all my traffic from my phone through the Pi and therefore also through proton. Would this work? Is this a good solution? I'm thankful for all feedback. :D

Hey guys!

This is my setup: I have a Raspberry Pi 5 as my server at home that I access from the public internet via Caddy on a VPS that is connected to the Pi via a wireguard tunnel. I now want to run some applications for which increased privacy could be useful on my pi and am wondering if it is necessary or a good idea to put my Pi behind a VPN like Proton. I would of course somehow need to configure it to route all requests coming through the wireguard tunnel back normally, I guess. Is this the way? What else do I need to do? I am very new to this and possibly very confused and would appreciate your help very much! :D

Bonus question: I have my android phone also connected to my wireguard network, because that allows me to skip (through my caddy config) forward auth for some services which I need for their mobile apps to work. Since I'm now paying for a VPN, I would also like to use it on my phone. However, I can't have both VPNs active on my phone. My current idea to solve this is to route everything from my phone through my own wireguard network and then from there through proton. If proton is setup on the Pi anyways, that should help. Would you say this is a good solution?

I'm running wg-easy on my VPS server which connects through wireguard to my PI where I host some services that I expose to the internet through a caddy on the VPS. I switched to wg-easy from bare metal wireguard for the ease of the UI and am struggeling with the following problem:

My peers can reach (ping) my VPS, but on my VPS, I can only reach my peers from inside the wg-easy container (docker exec wg-easy ping 10.22.0.2).

This means I also can't reach any of the services I'm tunneling, which is my end goal here. How do I fix this?

I actually got this working with AI and a lot of trial and error, but I have no idea what the final solution was and since its IP table based is also ephemeral in my understanding. I also think there has to be an easy and well documented solution to this, as I would have to imagine this is a common usecase. Thank you for all your help!

This is my wg-easy docker-compose.yml:

services:
  wg-easy:
    environment:
      - PORT=80
      - INIT_ENABLED=true
      - INIT_USERNAME=admin
      - INIT_PASSWORD="{{ secrets.wg.easy_admin_password }}"
      - INIT_HOST="{{ vps_public_ip }}"
      - INIT_PORT=51820
      - INIT_IPV4_CIDR=10.22.0.0/24
      - INIT_IPV6_CIDR=fd22:1022::/64
      - INIT_ALLOWED_IPS=10.22.0.0/24,{{ public_ip }}/32,196.168.0.0/16
    image: ghcr.io/wg-easy/wg-easy:15
    container_name: wg-easy
    networks:
      caddy:
    volumes:
      - "./storage:/etc/wireguard"
      - /lib/modules:/lib/modules:ro
    ports:
      - "51820:51820/udp"
    restart: unless-stopped
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    sysctls:
      - net.ipv4.ip_forward=1
      - net.ipv4.conf.all.src_valid_mark=1
      - net.ipv6.conf.all.disable_ipv6=0
      - net.ipv6.conf.all.forwarding=1
      - net.ipv6.conf.default.forwarding=1


networks:
  caddy:
    external: true

I'm running wg-easy on my VPS server which connects through wireguard to my PI where I host some services that I expose to the internet through a caddy on the VPS. I switched to wg-easy from bare metal wireguard for the ease of the UI and am struggeling with the following problem:

My peers can reach (ping) my VPS, but on my VPS, I can only reach my peers from inside the wg-easy container (docker exec wg-easy ping 10.22.0.2).

This means I also can't reach any of the services I'm tunneling, which is my end goal here. How do I fix this?

I actually got this working with AI and a lot of trial and error, but I have no idea what the final solution was and since its IP table based is also ephemeral in my understanding. I also think there has to be an easy and well documented solution to this, as I would have to imagine this is a common usecase. Thank you for all your help!

This is my wg-easy docker-compose.yml:

services:
  wg-easy:
    environment:
      - PORT=80
      - INIT_ENABLED=true
      - INIT_USERNAME=admin
      - INIT_PASSWORD="{{ secrets.wg.easy_admin_password }}"
      - INIT_HOST="{{ vps_public_ip }}"
      - INIT_PORT=51820
      - INIT_IPV4_CIDR=10.22.0.0/24
      - INIT_IPV6_CIDR=fd22:1022::/64
      - INIT_ALLOWED_IPS=10.22.0.0/24,{{ public_ip }}/32,196.168.0.0/16
    image: ghcr.io/wg-easy/wg-easy:15
    container_name: wg-easy
    networks:
      caddy:
    volumes:
      - "./storage:/etc/wireguard"
      - /lib/modules:/lib/modules:ro
    ports:
      - "51820:51820/udp"
    restart: unless-stopped
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    sysctls:
      - net.ipv4.ip_forward=1
      - net.ipv4.conf.all.src_valid_mark=1
      - net.ipv6.conf.all.disable_ipv6=0
      - net.ipv6.conf.all.forwarding=1
      - net.ipv6.conf.default.forwarding=1


networks:
  caddy:
    external: true

I have a couple services (Immich, Nextcloud, ...) accessible from the public internet through my reverse proxy (Caddy) and am logging in to them with Authelia OIDC. In my understanding it would greatly increase security if I put the services behind forward auth in caddy, because then they could never even be hit by someone unauthenticated. However, I had to make the realization, that forward auth breaks the mobile app for each service I've tried, because the API calls don't go through (my understanding). To fix this, the solution is probably to have forward auth enabled generally, but to disable it for requests coming from my phone, which I could only think to do by setting up a VPN between my server and phone and disabling forward auth for requests coming through the tunnel. This would mean that other people couldn't install the corresponding apps without also setting up a VPN and also increases complexity.

Is this just the way it is? Could the mobile apps in theory work with forward auth? I don't understand enough about authentication to understand why the API calls fail with forward auth enabled.

I'm thinking about putting Authelia in front of my homelab services which are exposed to the public internet, the important ones being Nextcloud, immich and paperless-ngx. Would you say it's worth the effort, from a security perspective? Would you even say not doing it is a bad idea?

Was sind eure besten Ideen/Rezepte für selbstgemachte, vegane und tiefgekühlte Snacks? Bei den Temperaturen👀

I'm searching a program I can run on my server that periodically checks various IMAP inboxes and sorts/filters them based on some rules. I don't like to use mail client filters because I have to open those for the sorting to happen and have them on multiple devices. Does anyone know of anything?

This looks good but unmaintained: https://github.com/CollinAlpert/MailSort