ligma.pro is one of the many independent Mastodon servers you can use to participate in the fediverse.
"pissed everyone off in literally record time" - Recommended by 10 out of 10 people who, for some sad reason, have a dedicated column up to watch #fediblock.

Administered by:

Server stats:

2
active users

:p:
Public
:rorshach: FSE went down on February 1.
:manhattan: ...
:rorshach2: SPC's been down all day. No explanation.
:manhattan2: ...
:rorshach: Someone's taking out fedi instances.
:manhattan2: I wish you could perceive time as I perceive it.
:rorshach: ...
:manhattan3:
BSD/r000t
Public

@p
The fuck happened to "we were here before you we will be here when you leave"?
@graf

Dr. NEETzsche, GED
Quiet public

What is the issue, exactly, that led to FSE going down?

:p:
Public
@NEETzsche @r000t @graf Box blew up, have replaced a large number of parts. Gonna get some new hardware, just bring it back as Revolver instead of trying to acquire another machine with enough RAM to handle FSE with Pleroma.
Dr. NEETzsche, GED
Quiet public

I don't want to maintain hardware for this reason. But I also don't want to cuck to VPS hosts, since if they ban me I lose my data. I found the ideal compromise: daily backups.

I have a cron job that runs every day to pull all the shit updated since the last time it ran. I specify this because sometimes the computer running that cron job is off for whatever reason and so a day or three are skipped. But it pulls the changed data from all those days.

So if the VPS host jannies me I'll either make a new account on it or just find another VPS host, and do the same thing. I keep all my data and they have to maintain the hardware to make my shit run.

BSD/r000t
Quiet public

@NEETzsche
You're over thinking this.

You have your app server on one VPS or dedi host, and then have an el cheapo VPS actually talk to the internet.

So you can only get a cheap front janny'd. If you have two or more of them, zero downtime.

This is the setup we run on an imageboard I do the tech for. Port 443 is only even opened up for the reverse proxies, *and* we require client certs for them. So you can't scan the (IPv6 good luck) internet for it.

No host on the planet is going to inspect your disks. They'd sooner just get rid of you, if someone told them something terrible was present.
@p @graf

Public
@r000t @NEETzsche @p @graf >Port 443 is only even opened up for the reverse proxies, *and* we require client certs for them
Any particular reason for doing this instead of just setting up something like Wireguard and reverse proxying the plain HTTP port inside it?
BSD/r000t
Public

@mint
Additional complexity. More things to go wrong. The actual owner of the imageboard is using it to learn hosting/IT stuff.

In theory we don't even need the client certs. If you're not coming from one of like 4 IPs, the firewall drops the traffic.
@p @NEETzsche @graf

Public
@r000t @p @NEETzsche @graf Setting up certs and additional firewall rules sounds more complex to me than just slapping WG, binding nginx to a port inside the tunnel and calling it a day. Probably has less overhead, too, since it doesn't need to verify the certificate for each connection.
BSD/r000t
Public

@mint
Any reason why wireguard specifically? I'm an OpenVPN autist. My internal network uses OpenVPN for site-to-site links.
@p @NEETzsche @graf

Public
@r000t @p @NEETzsche @graf It's very lightweight and also fast thanks to being kernel-level, the whole config on both sides of the tunnel takes less than 10 lines.
Public
@r000t @p @NEETzsche @graf Userspace wireguard-go still exists and is still pretty fast.