[Verifying my OpenPGP key: openpgp4fpr:FED82F1C73FF53FB1EE9926336615E0FD12833CF]

  • 1 Post
  • 22 Comments
Joined 4 years ago
cake
Cake day: February 18th, 2021

help-circle









  • Yes.

    In peertube you can setup your own search-instance (needs heavy ressources) an configure, which instances are searched. Or you can just configure your instance to use https://search.joinpeertube.org

    You can set https://instances.joinpeertube.org to autofollow all this instances, or host your own instances-instance or just put in manually instances, you will follow.

    Peertube is very mature in this things. Much better than every other fediverse-service.

    But you have to know, there are so many propaganda/putin/trump/antivaxxer-instances out there, that you really have to curate your followings very well! That’s the dark side of federation and selfhosting.

    Peertube is an ActivityPub-Service. The same as Lemmy, Mastodon, Friendica, Pixelfed and so on. It federates the same way as every other AP-Service too. And you can follow an peertube-channel from Lemmy as well as from Peertube, Mastodon or friendica!


  • I run my own funkwhale. But i’m not happy with it. It has so many bugs and drawbacks. Searching for remote content does not work well. Sometimes it finds it, sometimes it needs 2, 3 or 5 tries of searching for. Sometimes it does not find it. Searching is inconsistent. The UI is also inconsistent. To find what you want to click, you have to search a lot… It’s not possible to modify metadata from already uploaded music. Change mp3-tags locally an upload it again is the way… You csn not move audios between channrls and libraries. The permissions-concept is broken.

    And the devs want to discuss about how to write about bigs, not about the bugs.

    I will drop funkwhale. It does not make me happy.




  • I publish some short videos from time to time. Watching a train, my cat or something else, the whole world should know. 😄

    So i selfhost my own peertube-instance.

    The main reason os, to know how this works to selfhost such an instance. Because i want to have the knowledge for. I believe in the future of this platform.

    And i use my peertube to make copies from youtube videos i want to have, in case they disappear from yt for some reason. Just to build my own comfortable videothek. Most of my videos are “internal” or “unlisted” in case of copyright-violences.

    Monetizing videoviews… hmmm… i know, creators get a life from ads… but i hate advertisings. I really hate them. And i think, if someone wsnt to life from creating content, they should place products. Srlfmade ad, reading a text, marked as ad… such as many creators do this. Get paid per video/ad, not per view.

    Streaming always comes from the original instance. (I know, p2p and assist hosting) so… if a creator hosts its own peertube, he gets the WHOLE amount of his sponsoring. For his work and for his hosting-costs too.

    Its another way of getting money. Creators have to learn a bit more than producing a video, upload it and so on. But hosting a peertube is not that difficult.

    Maybe is a managed service, a “one-click-hosting” the future for peertube. Just bring up a whole instance as easy as create a new YT-Channel… like hetzner do it with nextcloud (shared storage).





  • I start for every connection-group an own ssh-agent with different ssh-keys in it. And i connect from my laptop sometimes (regulary) to my desktop-machine and forward the agent to the desktop. This is a setup, i need.

    And i have a script, which chooses from ssh config, (Match section) the ssh-agent i need for this connection-group. This script starts automatically an ssh-agent and loads the identities (private-keys, hardware-token…) into this ssh-agent and per configfile it is choosen as IdentityAgent.

    When i’m connected to my desktop with my laptop and i work on my desktop, then i use the forwarded agent, because i have some keys only on my laptop, which i want to use also from my desktop. So i link the forwarded agent-socket to the IdentityAgent, which is configured in ssh-config for this connection… When there is no forwared ssh-agent, the symlink is deleted and a new agent is started with a socketfile on the same path.

    It sound’s a bit complicated… and yes, it is.

    An i don’t get it, why sometimes the socketfile is deleted and sometimes it remains. Now i tested it from home on the remote-connection. The temporary, forwarded agent-socket is a symlink to my regular socket-file. and i killed the running ssh-agent… and also the symlink is removed.

    It is strange behaviour… a process unlinks a socket-file, which does not belong to him, only the name is the same… and not every time.



  • The services should be able, to talk to each other via ssh?

    Or do you have groups of servers?

    How many we are talking about?

    They are all virtual servers?

    Where is the hub located?

    In our company we have many services and many servers. We are talking about hundrets of services and servers. Snd they are very secure.

    So we have the servers on a big esxi (more than one) in 3 datacenters.

    There is one jumphost (high available… several instances). Direct connection from our workstations to a server is not possible. We have to use this jumphost. Login on the jumphost is not possible, only for jumping (ssh option -J).

    On the jumphost is for each user the publickey from a hardwaretoken. (Yubikey, etoken, nitrokey, name it) on its user in authorized-keys file. Only one pubkey.

    So you are not able to jump over the jumphost to a server, without a valid hardwaretoken.

    A NAT-Rule gives each user a individual source-IP…

    Then you can see in auditlog on each server who did the shit… even if he made sudo su… the source-ip is individualized for each user.

    And services run in different subnets and VLAN without connection to each other. So only services can talk together, who must talk.

    Another server is an ansible machine. This can connect to every single server too and fo good and really bad things… so this ansible-machine and the jumphost are in a physically secured zone in the Datacenter.

    You need an extra permission and an extra physical key, to come to this machines…

    And if one Service gets compromized, maximum the servers in the same vlan or subnet can be affected too. And the servers, which got an extra firewall-hole.

    So… if you are afraid of using ssh in your environment…

    Use hardware-keys for the ssh privatekey. No softwarekeys! If machines need to talk together via ssh, make smallest possible jails with subnets or vlans around them. Think about allowed commands in ssh-config/authorized_keys file!!! Think about a jumphost and allow different users only machines which they need. Think about physically protection about the jumphost. Think about serverinitiated backups…

    👍