I’d mount it as a second storage location in Steam, then, within Steam, use the storage option to move the files over to the main library. That will ensure that they all get moved properly and reduce any potential issues.

Oh, maybe I misunderstood? It sounded like he didn’t understand what advantage a “tunnel” could provide.

If your server is behind CGNAT, you need a TURN-style “tunnel” to allow incoming connections. If you have your own remote server with a public IP, then you can absolutely use that and create the tunnel using wireguard (or openvpn, ssh, etc).

I just mentioned CF in my blog post because it’s probably the most popular solution.

The point is, if you have CGNAT, you need to create that “tunnel” somehow if you want to allow incoming connections.

That’s exactly the use case for “tunnels”: allowing public, incoming connections behind CGNAT.

Wireguard requires a public IP on at least one side of the connection and only allows private access. If you want to host a blog or website AND you’re behind CGNAT, then a “tunnel” service is a very easy solution.

Edit: my previous blog post on the topic: https://blog.k3can.us/posts/2025/feb/2025-02-21_cloudflarefort/

Late to the party, but I have a second PBS instance that’s at another family member’s house.

Sounds like you’re fairly invested in this, so why not reach out to the maintainer? It shouldn’t be difficult for them to offer a signed hash.

…But keep in mind that most images are built using base images and various other dependencies, which could all also be compromised. It might be better to eliminate docker entirely.

I grabbed a used Lenovo Tiny I5 6500 with 16GB around the same time for $32 (even included the PSU). Now it looks like you can’t even get just the RAM for that price.

I also bought a new Sapphire RX 6800 that year $399. It looks like the used ones are selling for around $500.

This was recently posted on Reddit and might be helpful.

https://www.reddit.com/r/openwrt/comments/1vwq1ey/google_nest_wifi_router_h2d_board_mistral_qcs404/

I use mTLS for Home Assistant and Navidrome.

It’s very secure, the only limiting factor is that the client apps need to support them (or you use a PWA).

Sorry, I think I misread the comment when I made my initial reply.

Edit:

If you mean the key provided for the demonstration, you could ensure that you get the correct one by checking the signature (it’s signed by my personal key) or by doing the initial download through i2p or tor. Once it’s added to your keyring, you maintain that same key for all the subsequent checks. Or, if you don’t want to do either, you could consider it as a Trust-on-first-use system.

The important point is that it’s a layered system, rather than a single point of trust, and that once you trust it, it cannot be compromised.

deleted by creator

I’ll add: mTLS would only break because the client certs are typically signed by a private CA and the host is configured to only trust that specific CA (similar to the enterprise solution I referenced in the post).

If, for some reason, the host was configured to trust all of the typical public CAs, then mTLS would theoretically share the same problem.

Not directly, but I believe mTLS would break if the traffic was intercepted/altered, so it sort of works to test the connection.

mTLS requires installing a certificate on the client device, though. If you’re able to do that, then you’re also able to pin the correct cert or install a custom CA. This would be the “enterprise” solution, as far as I know, but doesn’t work well for public sites, since you can’t always configure your end-users devices.

Edit: mTLS is still very useful, though. I use it to secure some of my services. It just doesn’t solve this specific problem.

Really depends.

It’d be massively overkill for me, so even if it’s technically a “good value”, it doesn’t make sense to buy one if my cluster of $60 thinkcentres is chugging along without an issue (and I get HA).

On the other hand, if you need all that extra performance for something, then it’s probably a great buy (hence its popularity here).

I use beets to add synced lyrics to my library automatically.

To display them in the web browser interface, click the lyrics button (looks like a book).

Have you explored any other options?

Yeah. I briefly explored some other possibilities in the post, including a potential self-hosted option, but ultimately landed on CF as a practical compromise.

I didn’t see an obvious link to the source code, so here it is for those interested: https://github.com/Drop-OSS/drop

Crowdsec does it by using crowd-sourced blocklists (hence the name). So if an IP triggers a scenario on other machines, that malicious address will be proactively added to your blocklist before it ever gets a chance to impact your machine.

That is the big advantage of crowdsec over reactive-only solutions, like fail2ban.

Yep.

Never noticed a difference, myself.

The 3DS on the other hand…

https://github.com/zoeyjodon/moonlight-N3DS

What is the advantage of this over just dropping HTML files onto a USB drive?