PCPartPicker is your best bet (hint: sort by price/gb), but they don’t really track shucking prices

I’m pretty sure they’re referring to hdmi-cec, nothing to do with a phone.

I had to disable d3cold on my nvme. Same symptoms. Would work fine on boot and then after some time fail.

Just as an aside, you’re half way to being able to use wildcard certs, you might as well just do the last bit of work so the domain names you’re using are a little less public. Let’s Encrypt puts every domain name on every cert in a public database. I’ve seen much less random probing of my services since moving to wildcards

No support for comments? Hard pass

That’s a basic requirement for almost any company. If you’re into hard coding credentials just use wireguard directly.

I’m not familiar enough with cloudflare proxy stuff. I just have my DNS pointed at my router external IP (and luckily my ISP doesn’t reset my IP ever.) It sounds like CF has designed this intentionally as a profit center. Sorry couldn’t be more help

This isn’t a cloudflare limitation. It’s a TLS limitation. It was a conscious decision not to support multi-level wildcards. You won’t find a service that supports it. Most people get around this by just not using TLS certs like this. You can encode your multi-level name spacing in 1 level So instead of something like svc1.svcgroup.dev.domain.org You can do it like svcgroup-svc1.dev.domain.org

Never heard of a tool to get around this TLS limitation. There are tools that manage lots of certs (cert-manager in k8s comes to mind). If you had a more concrete example it might help people to suggest solutions.

The only Radxa I’d bother with is the Rock 5 and for the price, I’d probably just go with rpi5 (unless you like to tinker… a lot). That’s coming from someone that owns 3 Rock5’s. The new Orion board looks interesting, but if it’s like any other Radxa products it’ll be 2+ years before it gets decent software support.

There’s a fine line between “auto-updates are bad” and “welp, the horribly outdated and security hole riddled CI tool or CMS is how they got in”. I tend to lean toward using something like renovate to queue up the updates and then approve them all at once. I’ve been seriously considering building out a staging and prod env for my homelab. I’m just not sure how to test stuff in staging to the point that I’d feel comfortable auto promoting to prod.

I have a couple Aoostar R7’s (4x in a hyper-converged ceph+cloud-hypervisor+k0s cluster, but that’s overkill for most). They have been rock solid. They also have an n100 version with less storage expansion if you don’t need it. My nodes probably idle at about 20w fully loaded with drives (2x nvme, 1x sata SSD, 1x sata HDD). Running ~15 containers and a VM or 2. You should be able to easily get 1 (plus memory and drives) for $1000. Throw proxmox and/or some NAS OS on it and you’re good to go.

Caddy can do both. If you’re using a wildcard already, stick with it. In fact, I’d say it’s more prudent to use wildcards (with DNS challenges) than http challenges.Then you aren’t listing all of your domains in letsencrypt’s public database for everyone to see. Nobody needs to know you’ve got a site called bulwarksdirtyunderpants.bulwark.ninja

Good write up. Thanks for the good lessons learned section.

Tmux is your friend for running stuff disconnected. And I agree with the other post about btrfs send/receive.