u/thomaspatrick16

Hey guys,

I'm running a public VPS reverse proxy (NPM + CrowdSec) that tunnels back to my home lab.

My ISP uses CGNAT, so my home IP is always changing. Recently, a background sync on my local machine freaked out over some broken endpoints, triggered a CrowdSec brute-force rule, and banned my entire home network.

Since my IP is dynamic, a static whitelist won't work, and whitelisting the ISP's whole subnet is obviously a bad idea.

I was thinking about a DDNS workaround:

1. Home server pushes IP changes to a DDNS domain.

2. VPS runs a cron job every 5 mins to check the DDNS.

3. If the IP is new, update the CrowdSec allowlist and clear any bans.

The catch is the race condition. If my IP rotates and a local app immediately triggers a ban, I'm locked out until that 5-minute cron job wakes up to rescue me.

For anyone else dealing with CGNAT and CrowdSec:

1. Have you found a clean way to whitelist dynamic client IPs?

2. Did you just give up on public endpoints and move everything behind Tailscale/Twingate?

3. Or do you just tweak the CrowdSec scenarios to be less aggressive with false positives?

Would love to hear your setups!

https://preview.redd.it/3854gw06eaih1.png?width=2069&format=png&auto=webp&s=05f35ff3c9bd4c64ed5673c560ee88d1cb57f1c0

I have a 2 stage homelab setup, my cloud instance serving my home server via reverse proxy. Have been using fail2ban on the cloud instance (entrance) ever since i started homelabbing. But after learning about a lot of safe practices i decided to setup a distributed crowdsec setup covering both my instances as LPs (the cloud instance being the brain processor). And "Holy moly guacamole" i see this. Is this normal for a selfhosted instance? Have never actually spent time analyzing my previous fail2ban setup. But this looks serious. 119 incidents, 42 unique IPs, 9 banned (Thanks to crowdsec's paywall i cant analyze y the rest didnt get banned). Now am paranoid, is my setup secure enough?

Hi,

I've been hosting Actual budget for a couple of months and have painstakingly automated the entire pipeline. Since my banks (thankfully) send me all my transactions as real time email alerts (safe to say after a couple of service requests and hours of talking to unhelpful customer care reps), I have setup a centralized script on google scripts to pull alert emails and post it to actual budget using Regex and Http-api container. This way the transaction is posted without depending on my phone (ex. To read the transaction sms). This has been working flawlessly until now.

Recently I wanted to add my parents to actual and created a separate finance file inside my instance. But unfortunately they are banking with a very old school bank who don't send emails for alerts (they receive emails (emails only) for self transfers like sb to rd/fd), only sms. This creates a problem where the post pipeline has to depend on their phones to grab the transaction and it being continuously connected to the internet for real time posting/syncing. Added to that one of them had a credit card which only sends pdf statement email once a month. So I took this up as a project and built a n8n workflow to capture all these edge cases. After 3 days and a gazillion cups of coffee, their pipeline is up and running. This n8n pipeline takes in anything on one end and posts it correctly to actual budget, may it be sms, email, pdf, password protected PDFs, etc.

I have two questions for you guys:

1. Unlike in europe or the us where they have bank integration using simplefin etc which we don't have. do we have an easier workaround for this? Or does anyone have a better solution that u have come up with. I had also been testing different budgeting apps from the store and only this particular app called FOLD (backed by zerodha) does automatic transaction pulling from Indian banks. Haven't poked around how they do it. Ig api pulls are banned by RBI in india.

2. Have always had an eye on sure finance, thanks to its sleek UI. I also want to expand my base into a larger finance trackers which includes my stock portfolio. But now that I have all this setup, I don't wanna throw this overhead into the trash and figure this all out all over again. Is anyone using sure? How is it for indian bank account and stock market usecase?

Thanks!! 🙏🏻

Hi, I recently plugged in a TPLink Archer C6 as a wireless repeater, as the 5ghz band of my main router was not very strong in my bedroom. Weirdly enough, I was having issues streaming videos on a patched version of YT. It takes around 5-10 secs to stream a video until which it shows a loading screen as seen in the image (refer pic 1). Then after a couple of interactions with the patching community i thought it was the issue with the patches. but then when i connect to my main router, the video streams without any issues. Then i did some Q&A with gemini, which pointed out that the IPV6 handshake might be an issue, and that it waits for a couple seconds to get the IPv6 handshake and when it fails it goes to IPv4 and starts playing the video. SO i tried disabling IPv6 on my main router, but unfortunately, the ISP issued router has restricted it. And then i found this option on the archer (refer pic 2). I saved it and rebooted the router only to have the same loading screen issue. Does anyone here have an idea what this might actually be a byproduct of? Thanks and appreciate your help!

Pic 1

Pic 2

Hey, I recently noticed that the immich android app from the playstore stayed at 2.7.4 even when the server was updated to 2.7.5. Didn't really care about it at that time and thought might be updated in some time. After a couple of weeks now, I happened to check it again, the playstore version is still 2.7.4 while the apk on the GitHub releases section does have a 2.7.5 apk. Does someone else see this or is it just my playstore that's stuck in 2.7.4?

Hey everyone, I’m pulling my hair out over what seems to be a caching, build, or volume sync issue during a minor version upgrade.

The Setup:

• Hardware: Raspberry Pi with an external HDD.
• Architecture: Docker Compose using a custom Dockerfile to bake ffmpeg into the official Nextcloud image.
• Volumes: Bind mount directly to the external drive (./nextcloud:/var/www/html).

The Problem: Nextcloud notified me that version 33.0.3 is available. I wrote an update script to pull the latest base image, rebuild my custom ffmpeg image, and recreate the container. However, when I run the pull command, Docker completely skips the Nextcloud app, and my dashboard remains permanently stuck on 33.0.2.

Here is the exact terminal output when I run my script:

⬇️ Pulling latest images...
[+] pull 22/22
 ✔ app                Skipped No image to be pulled                                            0.0s
 ✔ Image mariadb:10.6 Pulled                                                                  24.6s
 ✔ Image redis:alpine Pulled                                                                  13.3s

My files:

docker-compose.yml (snippet):

app:
  build: .
  restart: always
  ports:
    - 8080:80
  volumes:
    - ./nextcloud:/var/www/html

Dockerfile:

FROM nextcloud:latest
RUN apt-get update && apt-get install -y ffmpeg imagemagick ghostscript && rm -rf /var/lib/apt/lists/*

Do you guys know how to go about this?