Plan sounds fine to me, debian + immich in docker + tailscale is pretty much the boring setup and boring is good for a box in a shed. one thing I’d do before carrying it out there, install tailscale and ssh, reboot it a couple of times and make sure it comes back on its own without a screen, because walking to the shed with a monitor gets old fast. also something like uptime kuma on another machine (or your NAS) pinging it, so you know it’s down before you’re on holiday and the photos stop uploading. I run a box at home I only reach over tailscale and that’s the part that saved me most.

good to know about the limit, thanks. for one domain plus DNS-01 that’s all most of us need anyway

They don’t go away on their own, every installed snap is mounted as its own loop device and snapd keeps an older revision or two so it can roll back, so the number moves around after updates. snap list --all shows which snaps they are, if one says disabled that’s the old revision and you can remove it with sudo snap remove <name> --revision=<rev>. about libation, if it’s installed as a snap itself that could be the actual problem, snaps are confined and can’t read folders outside your home or on other drives unless you connect the removable-media interface, so I’d check that before worrying about the loop devices.

Good to hear it’s been smooth, the caddy plugin was the main reason I looked at it in the first place.

oh, didn’t know that, thanks for the heads up. deSEC still hosts dns for free if you bring your own domain I think, so a cheap one plus deSEC for the acme dns challenge still works, just not the free subdomain part

that’s actually a nice idea, updating with people around makes it way less of a chore, and someone always knows the weird fix. I’d probably steal it if I had more than one box to look after.

same here on the reboots, I never let it reboot on its own either. for me the reboot wasn’t the problem, it was needrestart bouncing nginx and postgres right after the upgrade, which you only notice if something long lived is running at that moment, like a stream lol

512mb and getting killed every morning at the same time sounds like a fun one to track down lol. a fixed weekly slot like your tuesday evening is probably the sanest setup honestly, I just know I’d forget.

yeah exactly, no reboot, it was needrestart restarting nginx and postgres after the systemd update. you’re right that the timer is kind of the blunt fix, the cleaner one is probably telling needrestart to only list instead of restart ($nrconf{restart} = ‘l’ in needrestart.conf), or excluding nginx from it. I went with the timer because I still want things restarted, just not while I’m live

it’s a single cheap VPS that only I look after, so I’d rather get security patches the same day than remember to log in and do it, I guess that’s the tradeoff. and yeah you’re right about scheduling, that was the whole fix, the default timer runs around 6 UTC plus up to an hour of random delay and that happened to land on top of the stream. moved it to the afternoon and it’s been quiet since

nobody said desec.io yet, it’s a non profit from berlin and they give free subdomains under dedyn.io, with a proper API, so you can do the DNS challenge for let’s encrypt (there’s a caddy plugin for it too). I haven’t run a domain there myself so can’t say how it is long term, but for a “try some things” domain it looks like the least shady of the free ones I guess.

What I do for that is turn it around, instead of checking for a failure I alert on the absence of a success. backrest has hooks, so on snapshot success it pings a push monitor in uptime kuma (healthchecks.io works the same), and if no ping arrives in ~26h it alerts. That way it catches the backup that never ran, which is the one that scares me the most I guess

money wise no, not even close. it’s a bitaxe gamma doing around 1 TH/s solo, so it’s basically a lottery ticket, the odds of hitting a block are tiny. it costs me like 3 euros a month in power so I treat it as a toy, I like checking the best difficulty it found and it’s a nice way to learn how mining works

Most of my stuff lives on a cheap hetzner vps so that power is someone else’s problem lol. at home it’s a raspberry pi that’s always on (a few watts) and a bitaxe miner doing about 19W, that’s around 14 kWh a month, like 3 euros here. the gaming pc is the only hungry thing and it stays off, the pi wakes it with wake-on-lan when I actually need it. took me a while to get the bios settings right (erp off, power on by pci-e) but it was worth it.

I’d add backup age and size, not just status, like alert if the newest dump is older than ~26h or smaller than 1MB, a job can say success and still leave you a useless file. and disk fill with a threshold, not only the graph. learned that one the hard way, a table on my vps was getting a row every minute with no cleanup and one day the disk hit 100% and postgres just died for like 40 min, obviously nobody was looking at the dashboard right then lol. now 80% warns and 90% sends me an email, and uptime kuma checks the cert expiry from outside. I guess the dashboard is nice to look at but the stuff that matters should ping you