Skip Navigation

User banner

TheIPW

@ TheIPW @lemmy.ml

Posts
17
Comments
50
Joined
4 mo. ago

Sysadmin and FOSS enthusiast. Self-hosting on Proxmox with a focus on privacy and digital sovereignty. Documenting my experiences with Linux, home labs, and the ongoing fight to keep Big Tech out of our hardware.

@unknownuniverse@unkn.uk

  • Finally done with the distro-hop: My return to Fedora

    Jump

  • I get the opposite with any Linux distribution I've tried on my HP laptop. Windows, fans never shut up but with Linux just pure silence!

  • Why I moved from GrapheneOS to iodéOS on my Google Pixel

    Jump

  • I’m not saying privacy and convenience are the same thing, or that the situation is somehow natural or benign.

    I agree that the real issue is power, distribution control, and the way mobile software has been turned into a duopoly.

    What I meant was more practical, for ordinary users, the choice often ends up being between an ideal setup and one that still lets them do necessary day-to-day things like banking and navigation.

    That doesn’t make the underlying problem any less political, it just means people are forced to make compromises inside a system they didn’t choose.

  • Disabling Windows 11 Recall, AI "Click to Do", and Telemetry via Group Policy - 2026 Manual Guide

    Jump

  • It is a fair bit of homework but for those of us who use Linux on a daily basis, we'd rather do the legwork once to have a private, predictable system than deal with the out-of-the-box bloat.

    Regarding updates: that’s exactly why I focused on Group Policy tweaks rather than simple registry hacks or UI toggles. Policies are designed for enterprise environments where IT managers would be furious if an update reset their security configurations, so they tend to survive major build updates much better than standard settings, it's not foolproof but it is the best way to stay ahead!

  • Technology @lemmy.ml
    TheIPW @lemmy.ml

    Disabling Windows 11 Recall, AI "Click to Do", and Telemetry via Group Policy - 2026 Manual Guide

    the.unknown-universe.co.uk /tech-stories/great-betrayal-windows-handheld/
  • Privacy @lemmy.ml
    TheIPW @lemmy.ml

    Starmer is gone, but the "Vicious Circle" of surveillance remains.

    the.unknown-universe.co.uk /privacy-security/vicious-circle/

  • The “Nude” Ultimatum: Privacy is Dead

    Jump

  • The UK PM has just announced an under-16 social media ban.

    This is the 'Trojan Horse' in action. You cannot enforce a ban without an Age Verification layer, and you can’t have Age Verification without a National Digital ID or biometric database. They are using the 'child safety' card to build a mandatory surveillance gate for the entire internet.

    Between the new taxes and the constant bans, it’s clear this government has zero respect for personal agency or digital sovereignty. If you aren't already moving your data off the cloud and into your own home lab, start now. The gap between our current society and a total surveillance state just got a whole lot smaller.

  • [Tool] Privacy-focused AUR Malware Audit Tool (Atomic Arch Incident)

    Jump

  • Those are solid resources but I built mine specifically for the folks who don't want to pipe a remote bash script into their shell during a malware outbreak. My goal was simple, a private way to audit the list without needing to clone a repo or install Python dependencies.

    Use the forensics scripts if you’re a power user, but if you just want a quick, client-side check that doesn't touch your filesystem, that's what the tool is there for.

  • Linux @lemmy.ml
    TheIPW @lemmy.ml
    Tool

    Privacy-focused AUR Malware Audit Tool (Atomic Arch Incident)

    the.unknown-universe.co.uk /privacy-security/atomic-arch-audit-tool/
  • Privacy @lemmy.ml
    TheIPW @lemmy.ml

    The “Nude” Ultimatum: Privacy is Dead

    the.unknown-universe.co.uk /privacy-security/the-ultimatum/

  • Why I moved my Plex library to Jellyfin after 14 years

    Jump

  • Why I moved my Plex library to Jellyfin after 14 years

    Jump

  • You're right, I missed that.

    I personally use a reverse proxy and Wireguard setup to access remotely.

  • Why I moved my Plex library to Jellyfin after 14 years

    Jump

  • I have a dedicated VPS with reverse proxy connected to my network via Wireguard. It acts as the front door to my network so I don't have to port forward or rely on Cloudflare etc. I used to use Tailscale as the go between but switched to WG recently. Both work fine for streaming content whilst self-hosting all other services including my website.

  • Selfhosted @lemmy.world
    TheIPW @lemmy.ml

    Why I moved my Plex library to Jellyfin after 14 years

    the.unknown-universe.co.uk /home-lab/plex-to-jellyfin/

  • The Luna Deadline: industry problem, not just Luna

    Jump

  • My bad, GOG is absolutely the gold standard for DRM-free ownership. Personally, I buy on Steam for the convenience and the Proton support but I still collect every free titles on GOG

  • The Luna Deadline: industry problem, not just Luna

    Jump

  • It’s why I treat everything cloud-based as a rental now. If I can't install it locally and back up the data myself, I don't really own it.

  • Technology @lemmy.world
    TheIPW @lemmy.ml

    The Luna Deadline: industry problem, not just Luna

    the.unknown-universe.co.uk /privacy-security/the-luna-deadline/

  • Replacing Tailscale with a 2-VPS WireGuard setup (No port forwarding)

    Jump

  • The home server is an old, low-powered mini PC running Debian. It acts as the bridge between the WireGuard tunnel and my local LAN.

    I've just finished migrating one of my AdGuard Home instances onto it today. Its role is now twofold:

    Routing: It has ip_forward enabled and a bit of NAT (iptables/nftables) so that traffic arriving from the VPN can actually "hop" onto the local network to reach my other VMs and containers.

    DNS: It provides ad-blocking for the tunnel. VPN clients point to this node's internal WireGuard IP for DNS queries.

    Technically, it's just another WireGuard peer, but with AllowedIPs configured to advertise my 192.168.x.x subnet back to the hub (VPS2). This is what allows  VPS1 and my mobile devices to resolve and reach home services without a single open port on my router.

  • Replacing Tailscale with a 2-VPS WireGuard setup (No port forwarding)

    Jump

  • You're right, and for a lot of people, one VPS is the sensible choice. I actually addressed this in the post:

    "VPS1 is my web-facing server. It handles the public side of things. VPS2 is the VPN hub. At first glance, that probably looks unnecessary. Strictly speaking, it is unnecessary. I could have crammed WireGuard onto VPS1 and called it done. But splitting the roles makes the whole thing cleaner.

    One machine serves public traffic. The other handles VPN duties. That means fewer networking compromises, fewer chances of Docker or firewall rules becoming annoying, and a clearer separation between the public-facing stack and the private tunnel. It also means I can change one side without poking the other with a stick and hoping nothing catches fire."

  • Replacing Tailscale with a 2-VPS WireGuard setup (No port forwarding)

    Jump

  • It's not that I didn't like it, I just wanted to back to basics! A simple config file on each machine, job done

  • Replacing Tailscale with a 2-VPS WireGuard setup (No port forwarding)

    Jump

  • Exactly that, VPS2 handles the WireGuard port and has no domain pointing to it, so it’s basically hiding in plain sight. VPS1 holds the domain and handles the web traffic.

    I keep SSH open on both, but locked down (key-based auth + restricted to my IPs).

    Your idea of using the provider firewall (Ionos in my case) as a “mechanical” lock is a good one, block it at the edge and only open it when needed. I’ve thought about doing that, but I’m generally happy relying on a hardened SSH config and the provider’s KVM if everything goes sideways.

  • Replacing Tailscale with a 2-VPS WireGuard setup (No port forwarding)

    Jump

  • Thank you for the heads up, turns out it was the custom html code in the code blocks causing the issue. Fixed now.

  • Selfhosted @lemmy.world
    TheIPW @lemmy.ml

    Replacing Tailscale with a 2-VPS WireGuard setup (No port forwarding)

    the.unknown-universe.co.uk /home-lab/wireguard-vpn-two-vps/

  • Turns out I have been updating wrong all this time! 🤦🏼

    Jump

  • No, apt isn’t just a rename. apt upgrade largely replaces apt-get upgrade, but it’s a bit more aggressive: it may install new packages if required as dependencies (it still won’t remove packages). If an upgrade needs to remove packages to resolve dependencies, use apt full-upgrade (same as apt-get dist-upgrade).

  • Turns out I have been updating wrong all this time! 🤦🏼

    Jump

  • dist-upgrade and full-upgrade are essentially the same command but yeah, I won't be using apt upgrade again in the future! Like I said in my post, the joys of being self taught is that you learn by my making mistakes and that's part of the "fun" 🤣

  • Turns out I have been updating wrong all this time! 🤦🏼

    Jump

  • Glad you found it useful. I'm the same, I can't stand those long posts that make you read a life story before getting to the commands, even worse when a page is riddled by ads or behind a paywall!

    I figured if I’d missed it, a few other people probably had too.

  • Turns out I have been updating wrong all this time! 🤦🏼

    Jump

  • I've not come across this with my non Debian based systems. Only use Debian for servers because it's so stable, Arch and Fedora everywhere else!

  • Linux @lemmy.ml
    TheIPW @lemmy.ml

    Turns out I have been updating wrong all this time! 🤦🏼

    the.unknown-universe.co.uk /tech-stories/update-conundrum/
  • General Discussion @lemmy.world
    TheIPW @lemmy.ml

    Do you still use Github

    the.unknown-universe.co.uk /tech-stories/ghostty-leaving-github/
  • homelab @lemmy.world
    TheIPW @lemmy.ml

    Hypervisor, VM, LXC and Docker: A Simple Guide

    the.unknown-universe.co.uk /home-lab/hypervisor-vm-lxc-container/
  • Browsers @lemmy.ml
    TheIPW @lemmy.ml

    A week with Brave Origin Nightly.

    the.unknown-universe.co.uk /privacy-security/brave-origin/
  • Linux @lemmy.ml
    TheIPW @lemmy.ml

    Reclaiming the desktop: Why I’m still on Linux in 2026

    the.unknown-universe.co.uk /linux-foss/linux-migration-guide/
  • Linux @lemmy.ml
    TheIPW @lemmy.ml

    Is the "Year of Linux" actually a trap?

    the.unknown-universe.co.uk /privacy-security/year-of-linux-trap/
  • Privacy @lemmy.world
    TheIPW @lemmy.ml

    BrowserGate: Technical breakdown of LinkedIn’s covert browser extension fingerprinting

    the.unknown-universe.co.uk /privacy-security/linkedin-browsergate/
  • Privacy @lemmy.ml
    TheIPW @lemmy.ml

    Google’s Sideloading Crackdown: Why It’s a Threat to Everyone’s Privacy and Freedom

    the.unknown-universe.co.uk /privacy-security/google-sideloading-crackdown/