nitrolife

You can use socks server for download toorrents. Best choise insert socks traffic to wireguard connection and use sockd for outgoing and clean wireguard + port forwarding for incoming connections.

And you can use i2p network for download torrents in that networks. qBittorrent support it in experimental mode.

I use my home server as media library and cloud gaming device (kvm with sunshine). Also I hosted my friends web sites and some my sites.

hosting my home lab’s server on hetzner would have been much more expensive I think.

But in reality, this will only allow you to receive incoming mail. In order for outgoing mail to work, it is necessary that the mail server and all the strapping go through the VPS to the Internet. This requires a rather complicated configuration of iptables, and I recommend that you simply either fill up the mailer on a VPS (there will be a maximum of gigabytes of mail. it’s not that heavy), or buy a static address at home.

If you still decide to go the hard way, here’s an approximate plan for what you need to do in the spirit of iptables, because setting it up in firewalld is a real torment.:

*mangle
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A OUTPUT -m owner --uid-owner 924 -j MARK --set-mark 0x300
COMMIT

where 924 is the postfix user ID, you may have a different number. check it out

ip route add default via 10.8.12.4 dev wg0 table 100

adding the default route via the VPS address to the routing table 100. replace 10.8.12.4 with the address of your VPS and wg0 with the name of the interface for communication between the VPS and home. Then

ip rule add from all fwmark 0x300 lookup 100

We are sending all packets with the label 0x300 to the routing table 100. In other words, the postfix user will have his own custom routing table via VPS.

This creates several problems due to the fact that with this configuration, it may not be possible to connect to postfix via your server’s interfaces. But in basic case all will work. Bypassing this problem will create even more complex routing rules and will generally be overkill. But if you’re interested, write to me and I’ll sign it.

Well… as I already wrote, my home server is literally on the Internet because I rent a static public IP address from the provider.

But if you have a VPS, then you just need to do port forwarding to your server with a VPS, and then add the following entries to the mx DNS server:

you.domain.              21600   IN      MX      10 you.first.vps.
you.domain.              21600   IN      MX      20 you.second.vps.

Where 10 and 20 are the server priority Or if the VPS is part of your domain then:

you.domain.              21600   IN      MX      10 first.vps.you.domain. 
you.domain.              21600   IN      MX      20 second.vps.you.domain. 

first.vps.you.domain.             21600   IN      A       1.1.1.1
second.vps.you.domain.        21600   IN      A       2.2.2.2

And if you also have IPv6, you can do

first.vps.you.domain.             21600   IN      AAAA       fd00::1
second.vps.you.domain.        21600   IN      AAAA       fd00::2

Where 1.1.1.1, 2.2.2.2, fd00::1 and fd00::2 are the addresses of your VPS

You also need to enter the address in the SPF:

you.domain.              21600   IN      TXT     "v=spf1 +mx -all"

What does it mean

v=spf1 is the SPF version.

+mx – it is allowed to send mail from the IP addresses specified in the MX records of the domain.

-all – prohibits sending from any other servers (hard refusal).

Also, in order for the signature to work on the mail server, you need to make several TXT entries (for a detailed explanation, see my links about DKIM):

keyname.__domainkey.you.domain. TXT "v=DKIM1; ...%DKIM params%"

and

you.domain.             86400   IN      TXT     "v=DMARC1...%dmarc params%"

And you need ask you VPS provider set PTR for you VPS IP address with first.vps.you.domain. Or some providers access that config in web panel.

Thanks, I’ll give it a try sometime.

On my home server. My ISP gives me a static address and makes PTR records for only about $1.5 per month.

I have been using my own email for many years (to this day). Everything is working great. The main thing is to have a static IP and be able to specify your domain in the PTR record of the ip address.

In general, you will need: postfix (https://wiki.archlinux.org/title/Postfix) OpenDMARC (https://wiki.archlinux.org/title/OpenDMARC) OpenDKIM (https://wiki.archlinux.org/title/OpenDKIM) Dovecot (https://wiki.archlinux.org/title/Dovecot) Some interface to choose from (soGO, roundcube) Maybe graylists, ClamAV, SpamAssassin, or something else to protect your mailbox from spam and viruses. And if you want filtering functionality, then you also need Sieve.

To be honest, I would probably play a game with such a plot with more pleasure than a game where all Pokemon look like puppies.

By the way, surprisingly, cartoons are also fictional, but for some reason, child abuse in cartoons is 18+ marked or prohibited. ¯_(ツ)_/¯

Well, I have nothing against the players. It’s just that it’s really hard for me to play this series.

I hope the movies are not the same as the cartoons of the 90s. I once watched a couple of episodes where Ash sends Pikachu to fight in the arena and then cries when Pikachu gets hit hard. I just wanted to ask, “buddy, you literally sent Pokemon into the damn arena where he was supposed to FIGHT, what were you hoping for?” But in general, I understand you now. In fact, the plot is not important at all. People just collect Pokemon like Magic the gathering cards.

Pokemon. Behind the pleasant facade of the game series, there is a reality: people kidnap animals in the forest, lock them in pokeballs, and force them to fight in arenas, at least until they are damaged. I didn’t understand this game series when I was younger and I still don’t. Do people really like playing this game?

It all depends on the greed of the campaign. I worked in a campaign where it was considered normal to keep a degraded raid without repair. Of course, data loss is a normal story in such companies. The raid guarantees data security only when one disk is being pulled (except for some raids), so it also needs to be monitored and replaced. On the other hand, with proper operation, you probably won’t lose any data.

P.S. RAID0 - raid that can’t be restored when degraded any disk in RAID. This is exactly worse choice for data save. STRIPE also writes blocks one at a time to the first disk and to the second, so that you would definitely lose exactly 50% of data blocks. Best choice raid10 for performance and raid5 if you need save money.

Well, in, my case first there was communism, so the state provided us with a pension regardless of who worked how much and what was happening in general.

And then there was the collapse of the USSR and in general after a while everyone realized that they would just work until death. And so it happened.

I just went to libraries and asked my friends for information.

By the way, the internet didn’t suddenly become filled with all the knowledge in the world. The first internet pages were like personal blogs filled with not-so-useful information. In those days, the internet was similar to today’s darknet. Google was just starting out, and there was no search engine as such. As a result, people just shared websites with each other. The current internet is the result of millions of people’s efforts to fill it with information. So, having access to the internet didn’t change my life overnight.

But we used to buy collections of websites and data on CDs when CD-ROMs first became available, and that was pretty fun.

UPD: and at some point, people started exchanging data through modem calls, and that’s how fidonet was born. It was a whole cultural layer where you could get an address and slowly receive newsletters and exchange data through late-night calls to sisops. It was like a prehistoric torrent, but instead of pirating, you were exchanging data.

Yes. Sorry, I still don’t speak English well, so I use Google Translate.

Well, I can only write from my own experience. I’ve worked for several major campaigns in my life. In banks, in telecom operators. And it’s almost always been like this. And where there was none, the campaign collapsed. Not in a moment, of course, because campaigns, like people, do not die instantly, but age and degrade. But as a result, it was.

The job of people around the CEO is primarily to make decisions. All this huge chain of managers is needed only to aggregate information so that the CEO can make an informed decision. This is how many large companies operate. I would even say that there is a direct correlation between the size of the campaign and the number of monitors at the bottom.

The flip side of sitting behind a huge monitor is that you won’t stay outside with a huge number of your employees if you make the wrong decision. It’s just a different job.

ISC DHCP switched to KEA DHCP, They don’t have package in Debian repo, but you can add repo and install: https://cloudsmith.io/~isc/repos/kea-3-0/packages/

ISC really deprecated… =( You can install dnsmasq of course, but he is much more slow. But nice for small networks.

Firewalld is much worse for small sustems. Who is really need mark ports? But in difficult cases you need write iptables rich rules anyway. So, as result I love old school with clean iptables without any upperlevel daemons.