It’s definitely dried up a fair bit over the last couple of years. In January 2025 I got some recertified 12TB Ironwolfs for $140 each from GoHardDrive, and that was already a fair bit over what they historically had been. Same drives are now $200 on GoHardDrive, and $220 on Amazon. You can just get them new $250, so at that point I barely think it’s worth it to get recertified unless you’re really stretching a budget. I’m sure the businesses are very happy with the demand they got now, but it’s hard to escape the conclusion that LTT and other Youtubers covering these sites really drove up demand and prices.

Also, the smaller drives are a lot harder to find recertified these days since enterprise users will usually go for much larger capacities, so yeah, for 4TB you’ll probably have to go for new. You could also just get a larger drive and only use 4TB of it, assuming this is going into some kind of array. Upgrade the other one at a later date, then just expand your pool!

Authentik has done the opposite of enshittification. As they’ve gotten more successful, they’ve taken enterprise features and moved them into the community edition. I’ve been extremely happy with Authentik so far and the dev has been nothing short of fantastic every time I’ve seen them interacting with the community.

Something you might want to look into is using mTLS, or client certificate authentication, on any external facing services that aren’t intended for anybody but yourself or close friends/family. Basically, it means nobody can even connect to your server without having a certificate that was pre-generated by you. On the server end, you just create the certificate, and on the client end, you install it to the device and select it when asked.

The viability of this depends on what applications you use, as support for it must be implemented by its developers. For anything only accessed via web browser, it’s perfect. All web browsers (except Firefox on mobile…) can handle mTLS certs. Lots of Android apps also support it. I use it for Nextcloud on Android (so Files, Tasks, Notes, Photos, RSS, and DAVx5 apps all work) and support works across the board there. It also works for Home Assistant and Gotify apps. It looks like Immich does indeed support it too. In my configuration, I only require it on external connections by having 443 on the router be forwarded to 444 on the server, so I can apply different settings easily without having to do any filtering.

As far as security and privacy goes, mTLS is virtually impenetrable so long as you protect the certificate and configure the proxy correctly, and similar in concept to using Wireguard. Nearly everything I publicly expose is protected via mTLS, with very rare exceptions like Navidrome due to lack of support in subsonic clients, and a couple other things that I actually want to be universally reachable.

I have no idea how you’re getting packages older than Debian. Unstable is a rolling release and stable has a 6 month release cadence with no LTS. Were you pulling from an old dead repo? If you followed an outdated guide, they probably linked you to an old one.

I do agree that the learning curve is steep and the knowledge is nontransferrable though. In my case, that just encouraged me to unify all my systems onto NixOS at home. Not sure if that’s a solution or addiction yet.