• 0 Posts
  • 6 Comments
Joined 2 years ago
cake
Cake day: June 20th, 2023

help-circle


  • RE: backups, I’d recommend altering your workflow. Instead of taking an image of a box, automate the creation of that box. Create a bash script that takes a base OS, and installs everything you use fresh. Then have it apply configuration files where appropriate, and lastly figure out which applications really need backup blobs to work properly (thunderbird, for example). Once you have that, your backups become just the data itself. Photos, documents, etc. Everything else is effectively ephemeral because it can be reproduced through automation.

    Takes a lot less space, is a lot more portable. And much better in scenarios where something in your OS is broken or you get a new computer and want to replicate your setup.




  • Fail2ban and containers can be tricky, because under the hood, you’ll often have container policies automatically inserting themselves above host policies in iptables. The docker documentation has a good write-up on how to solve it for their implementation

    https://docs.docker.com/engine/network/packet-filtering-firewalls/

    For your usecase specifically: If you’re using VMs only, you could run it within any VM that is exposing traffic, but for containers you’ll have to run fail2ban on the host itself. I’m not sure how LXC handles this, but I assume it’s probably similar to docker.

    The simplest solution would be to just put something between your hypervisor and the Internet physically (a raspberry-pi-based firewall, etc)