A PHP developer who, in his spare time, plays tabletop and videogames; if the weathers nice I climb rocks, but mostly fall off of indoor bouldering ones.
But... You literally have ports rules in there. Rules that expose ports.
You don't get to grumble that docker is doing something when you're telling it to do it
Dockers manipulation of nftables is pretty well defined in their documentation. If you dig deep everything is tagged and natted through to the docker internal networks.
As to the usage of the docker socket that is widely advised against unless you really know what you're doing.
"For example, if every time I post a new update on BlueSky, if I had to send my post to every single one of my followers’ repositories, that would be extremely inefficent"
Somewhat ironic to have this posted on and activitypub driven fediverse.
Each devices encryption keys are unique and non-transferable. Each message in a conversation is encrypted in such a way that every participating device at the time of sending can decrypt it.
New devices (like desktop clients) didn't have their keys used for old messages and so can't decrypt them. There is no way to reencrypt old messages with additional new keys.
It's both annoying as shit, and also the only way to ensure a bad actor can't just add themselves to conversations they weren't a part of.
It literally prompts you to install to your desktop, meaning it's had at least the minimum amount of effort spent to make a decent mobile experience. Did you try it?
So to be clear, you want traffic coming out of your VPS to have a source address that is your home IP?
No that's not how I read it at all. He wants his VPS to act as a NAT router for email that routes traffic through a wireguard tunnel to the mail server on his home network. His mail server would act as if it was port forwarded using his home router, only it won't be his home IP, it'll be the VPS's
Flash drive hidden under the carpet and connected via a USB extension, holding the decryption keys - threat model is a robber making off with the hard drives and gear, where the data just needs to be useless or inaccessible to others.
This is a pretty clever solution. Most thieves won't follow a cable that for all intents looks like a network cable, especially if it disappears into a wall plate or something.
But... You literally have ports rules in there. Rules that expose ports.
You don't get to grumble that docker is doing something when you're telling it to do it
Dockers manipulation of nftables is pretty well defined in their documentation. If you dig deep everything is tagged and natted through to the docker internal networks.
As to the usage of the docker socket that is widely advised against unless you really know what you're doing.