Here’s the how it works doc for NetBird: https://docs.netbird.io/about-netbird/how-netbird-works.
It uses a signal server for establishing the initial connection and then makes p2p WireGuard tunnels.
Because of your question, I tested disabling the server, which I run on a VPS, and I could still reach all the connected hosts and routes. I didn’t think to try it at the time, but I’m guessing I wouldn’t be able to add new clients while the server is down.
I do this with self-hosted NetBird, but that’s not raw WireGuard. I’ve heard about a few projects that help set up mesh WireGuard topologies, but I haven’t used them directly:
Maybe those would be a good starting point for your own version.
Unbound can query the root dns servers, but it’s also commonly used as a recursive resolver, which just uses a server upstream, similar to systemd-resolved. I use unbound network-wide, but I have it querying 9.9.9.9 to take advantage of their filtering.
You may already have a local dns caching mechanism on your computer. I think by default Ubuntu uses systemd-resolved (it does on my desktops anyway). If you check dig it’ll show lookups coming from 127.0.0.53. With that in place, your local machine is caching lookup results and anything it doesn’t know, it’s forwarding to the network’s resolver (which it gets via dhcp, usually).
In the long run you’ll want to specify where it lives. Manually you could use the mount command, but really you want the share to mount every time you reboot the machine so it’s always available. If you’re after a GUI app to do that, check out smb4k. I think that has options to do automatic mounting to a directory of your choosing (the path would typically be something like /media/<your username>/<synology hostname>/<name of share>).
If you want to do this from the command line, look into autofs, which lets you define a configuration and automatically mount an SMB share whenever your system needs it.
It sounds like in your situation, you’d create a shared folder where your media lives (smb or nfs) on the Synology and mount that share to the machine running jellyfin. Then adding the folder as a library will be the same as choosing a local folder.
The thing I like for this purpose is smokeping. It checks basic connectivity on a periodic schedule and records latency over time. I keep it pointed at my isp’s gateway as well as a number of public sites and services I run to keep tabs on basic network health and to try to pinpoint where issues come from.
I’ve only ever tinkered with it slightly on a Proxmox host, but I ran it locally when I was testing it and it was glad to setup the VMs on the same system it was on.
You can definitely run VMs or containers on your desktop system and there are a lot of ways to do that (as others have said). If it’s the automated, reproducible setup you’re after (and you are purposely avoiding docker), give a look to terraform and ansible to create and provision your software.
I set up an old thin client with Debian and lxqt to connect to a VM on Proxmox. Got the idea from an Apalrd’s Adventures video about VDI. It worked pretty well on a decent network, but it really suffered on high latency networks.
That’s a bummer of a price difference for electricity. I think using the R320 for storage and adding some Lenovo sff units makes a lot of sense. I have one of the Lenovos in my hodgepodge virtualization cluster and it has been rock solid (as has my R320 in providing storage).
You ever see those Wired videos where they talk about a concept on five different levels ranging from beginner to expert?
The first level answer is likely that, yes, you’re reasonably secure in your current setup. That’s true, but it’s also really simplified and it skips a lot of important considerations. (For example, “secure against what?”) One of the first big realizations that hit me after I’d been running servers for a little while and trying to chase security is the idea of a threat model. What protects me from a script kiddie trying to break into one of my web servers won’t do much for me against a phishing attack.
The more you do this, though, the more I think you’ll realize that security is more of a process than an actual state you can attain.
I think it sounds like you’re doing a good job moving cautiously and picking up things at each step. If the next step is remote access, you’ve got a pretty good situation for a mesh VPN like Tailscale or Netbird or ZeroTier. They’ll help you deal with the CGNAT and each one gives you a decent growth path where you can start out with a free tier and if you need it in the future, either buy into the product or self host it.
Keep an eye on lowendbox.com’s hosting offers. There’s some junk to wade through, but it sounds like exactly what you’re after.
It sure will handle a remote VPS, it’s just not as automatic to set up as it is with PVE.
I put this off for a long time, but I finally did it this weekend.
Basically, you install the proxmox-backup-client utility and then run it via cron or a systemd timerto do the backup however often you want.
You’re responsible for getting the VPS to communicate with your backup server (like pretty much any self-hosted service), so some sort of VPN between them would be good. I used NetBird for that part and I have a policy that allows access from the client to PBS only on TCP port 8007.
I’ve been quite happy with Proxmox Backup Server. I’ve had it running for years and it’s been pretty solid for all my VMs/containers. There’s also a bare metal client, which I’m adding to a couple cloud VPS machines this weekend. We’ll see how that goes.
Also, since it’s just Debian under the hood, I also use the PBS host as a replication target for my ZFS datasets via sanoid/syncoid.
I just had to do this. Don’t skip the release notes. They’re really good at highlighting potential pitfalls, just scroll back through and look for the heading “Breaking Changes.”
In my case there were a few, but they were only for API calls I’m not using, so I just did the update in one go and it worked out great. (Of course, I made sure to take a backup first.)
Oh! Also, try posting this here: https://practicalzfs.com/. That’s a discourse forum really focused on ZFS. Jim Salter runs it and Alan Jude often contributes advice. There are some folks there who know ZFS inside and out.
Checksum errors can often mean a failing component. It could be the other drive or maybe a sata cable. Is the original pool mounting correctly? If so, you should be able to do a simple rsync to move it to the new pool.
A hybrid is probably a good way forward. I had a career as a photographer for a while and I learned from that: going through 1000 photos takes very little time, but going through 10,000 takes an eternity. If you can star or mark your obviously important photos as you go along, it’ll take very little to print them at the end of the year.
I’ve been pretty happy with NetBird. Definitely worth testing