Hah same here, core has been on my list for a while especially for the pi but i keep getting distracted :D

Some of the acme clients do, I don’t think certbot does though. I remember using acme.sh or something and I think it calls it a delegation domain if I remember correctly!

Tools mentioned here are good suggestions but the problem you are going to run into is that CloudFlare doesn’t support second or higher level dns zones (so a record of a.b.c.com should be in a zone of b.c.com and CF only allows c.com) on most account tiers and LE/certbot is expecting a zone to create the validation record using its plugin.

Yep this right here, I have used Ubuntu LTS for servers both my own and for work for years now and it works fine. I also don’t think snaps are as big of a deal as people make them out to be, the only snap I am actually forced to use is the mass snap and that is a canonical product so whatever. I even use it on some rpi4/5 even and it works great for use with workloads suited for a pi. Now, 10 years ago this was a different story, but these days Ubuntu LTS is a great OS overall.

Debian is also great though (and if I was building some sort of appliance OS I would prob start with that since it has the fewest customizations to start with) but after you use any of the deb based distros enough they are all basically start to look the same to operate so pick one you want to learn and use that until you have a reason to change, learn the tools not the distro and you will be fine.

All of that said though, every distro has idiosyncrasies but the Linux CLI skills you learn are definitely transferable so it’s not as big of a choice as it is made out to be sometimes, especially now that containers and systemd are everywhere. That is …unless you decide to pick Solaris or one of the BSDs but those are a whole other animal 😀

Yeah this is where I am at too, it’s more about who is responsible when it breaks for me and if Plex breaks I have to fix it no matter where it runs. This community is more about learning how to do it than what specific tools to use for me as well, all tools come and go over a long enough timeframe, this is a good place to learn about the next one.

So I am pretty sure that error is happening because certbot can’t retrieve the certificate which is coming from that API no matter what type of challenge you are using (this is what ACME is).

Now when you say you are blocking inbound traffic, have you made an exception for established outbound session return traffic? If not then you your inbound rule will block all traffic because without that exception the explicit deny will typically override any session/stateful based rules your firewall might have by default (this applies to most firewall vendors I have run into).

That said, I’m not sure what your goal is but blocking outbound traffic to those ASN might be more effective for you anyway because your firewall should already be dropping any inbound traffic that isn’t otherwise allowed so I’m not sure blocking inbound traffic really gains you anything but I’m just guessing. Hope that all makes sense!

I think your bigger problem with that board is going to be that PCIe slot is a PCIe 2.0 x1 slot so it will be slow but you can just use an adapter like this:

https://www.newegg.com/startech-com-model-pex1to162-pci-express-to-pci-card/p/N82E16815158223

Flexible versions exist too! I’m also not sure you would get a lot of benefit out of a GT730 really so YMMV.

Lots of good suggestions here already but what is your upstream DNS provider and is it your ISP DNS from DHCP?

Yeah I’m curious too because I have played Cyberpunk without any issue on both the steam deck and bazzite for a long time, cyberpunk even has a graphics preset for the deck so I’m not sure what’s happening either.

EDIT: Even using both AMD and NVIDIA graphics cards (before the latest nvidia driver version debacle though)

Lots of good alternatives advice already here but I have a couple comets and they work pretty well! They don’t require cloud access except for updates if you want them, I think it has Tailscale built in as well. Their newest one has an HDMI pass through as well which is handy in some situations. I have the PoE version of the other one and it works the same way, the power control kits work too! I also have a jet KVM and it’s fine, I like the comet better I think! They have also open sourced their cloud thing so you can centrally manage them all, it’s pretty neat!

Okay lots of good info here but just to make sure it was clear that you are kinda solving two different but related problems. Connectivity with WireGuard or other VPN and split-horizon or multi-horizon DNS (Wikipedia) which also called a view sometimes (like BIND) and can also be done with two different DNS servers. You can sorta do it with AdGuard but it is tedious to maintain. If you are using a wildcard rewrite it works alright but that isn’t necessarily the same as a CNAME or subzone delegation.

The next pice I’m not sure I saw mentioned is that WireGuard is not like other VPNs in that if two nodes are on the same network they will generally communicate directly peer to peer even over WireGuard addresses so you don’t really need to worry about traffic hairpin like you described unless you configure it to do so (which is more like traditional VPN would act). Tailscale is similar in concept but it uses different terms and technologies.

Anyway not sure if that helped or made it more confusing but there are may ways to solve it so good luck! FWIW, my home network is currently set up with a public zone on a commercial provider. It has a wildcard CNAME to something like proxy.domain and that is an A record containing the WireGuard addresses. Then my local DNS overrides the one A record for the proxy internally which I only get when WG is off. I would rate this solution adequately functional but medium level of janky, 8/10 would use again :D

Okay I saw your previous post but I’m curious now. What happens if you curl your IP address on port 80? Does it send back a 30X redirect for SSL to your newly configured subdomain as the new default location for r do you get back your IP but using SSL?

Hah I am glad it was helpful! Glad to share, I always felt like half the point of learning is to share what you learned. That is one of my favorite “hidden gems” for lack of a better term that can be a real time saver.

Bonus just for more fun: you can use cd - to switch back to the directory you were last in after changing directories, it toggles the top two paths in the stack. It is similar to how pushd/popd work if you have you used those. I use that one a ton, there are fancier tools now but that one works everywhere.

Oh also, anyone on a Mac needs to know about pbcopy, Linux has xclip and I don’t remember what the Wayland analog is.

To add to this one, it also supports more than just the previous command (which is what !! means), you can do like sudo !453 to run command 453 from your history, also supports relative like !-5. You can also use without sudo if you want which is handy to do things like !ls for the last ls command etc. Okay one more, you can add :p to the end to print the command before running it just in case like !systemctl:p which can be handy!

In contrast, and I say this as someone who has used various types of Unix and Linux for a long time, I think this is an excellent use for AI, just be sure to use it to teach you things not just to solve your problems for you.

What I mean by this is I have found (mostly Claude) to be great at explaining concepts, especially if you use it to make analogies to something you know. It is absolutely not right every single time but I have had great luck with questions like “explain to me how to X in Y tool, I know how to have the same outcome by doing A in B tool” or “explain to me how docker works using a rocket as a metaphor” or things like that. Also I use it a lot for new subjects where I don’t know what to search for quite yet and I can just give it a long rambling explanation and example and ask it for 3 suggestions to research further or things to check. It is kind of useful as an expensive search engine but if you use it like a research engineer to get you started it can be really helpful in my experience.

As others have said though, I have been doing it forever both personally and professionally and I am definitely still learning. Linux knowledge is more of a skill to develop over time not something that is easy to master because it continually changes. Learning how to find or figure out the answers is the most valuable skill though, it’s impossible to remember everything. That and often there is no single right or correct answer for every situation but there are a lot of options and opinions and often more of the latter than the former. That said though usually the best answer is the one that I forget about because it functions forever and doesn’t blow up in my face hah.

Anyway, hope at least some of that is helpful, best of luck!

:wq

I think you already decided what I would have recommended (just write to a log file in your python script) but I wanted to hopefully help with the rest of the question hah.

So the first thing to remember is that a pipe (|) in Linux is a unidirectional data channel that passes stdout from the left command the right command’s stdin and this is its only function. Also notable is that exit status of a pipeline is the exit status of the last command in the pipeline (unless the pipefail option is enabled but this isn’t the behavior you wanted either), this is what is available in $? as well immediately after the pipe exits in a script, problem with that is that tee can exit successfully while the previous command failed because it did its job redirecting output.

To get the behavior you are after you would probably need to write a script that does the signal handling or it might work if you use exec to wrap your python+tee command in your dockerfile because then the bash process will get replaced by python or tee, I’m not sure which or how tee will interact with exec without testing though.

Anyway, hope that helps, here are the docs on pipe which are worth a read. In fact when double checking something just now, I learned I can do |& today instead of 2>&1 | which is neat hah!

Edit: I forgot to mention, signal handing in docker is a whole other animal so depending on how you are specifically running it the behavior and signals might not be what is expected or the same as running the commands outside of docker.

Great article about it: https://medium.com/@gchudnov/trapping-signals-in-docker-containers-7a57fdda7d86

Repost if you can’t read it on medium: https://www.cloudbees.com/blog/trapping-signals-in-docker-containers

I had a few ideas, I’m suspicious that handbrake is falling back to CPU, maybe check the logs of the container to make sure it isn’t falling back to CPU decoding. Otherwise here are a few things I would check next:

• If you are not using docker locally so you are already doing this, you will need to configure the docker container to pass through the GPU for quicksync to work inside the container.
• If you are already doing that then I would make sure the device is the same name on the synology, it probably is but just to be sure.
• you will likely need to add your user to the video and/or render group on the synology if you haven’t, especially if you are running the container as your user instead of root
• make sure you are reading and writing to volumes that use bind mounts and not docker volumes, overlayfs is not what I would call fast and writing especially.

So I had a few thoughts. I’m not sure that you can use the docker device flag with a directory as you have there, I think it expects a device node, you can pass that directory as a volume (-v) though.

If that doesn’t work you might also try running the VM with host-passthrough mode set on the CPU as well if it isn’t set that way already, sometimes that is also required for pass through to work from my experience. Also, make sure you passed through the whole device node, sometimes there are audio devices you have to pass through with the GPU device or you will get odd errors like those initialization ones you had. I’m not sure if this is the case for Intel iGPU though offhand though. Are you able to use intel_gpu_top on the VM to access the GPU? None of that is necessarily specific to proxmox though (but probably applies to anything libvirt powered) so YMMV.

Edit: I realized you may not know what a “device node” is, that is the full path to the device, like /dev/dri/renderD128 vs /dev/dri which is actually a directory.

I do on some of mine because it makes some of the automation i have for them simpler to maintain when it is also applied to x86 hardware or virtual machines. It used to be a huge pain to use on a pi but it works pretty well these days, especially since about 24.04 I want to say.

Oh it is certainly not just you, I am sometimes confused reading them even for commands I have used for years and I know what flag I am looking for but don’t remember the exact syntax or something hah! I am glad they are there but they are definitely not a complete guide to any command, especially built-ins.

Interestingly, this is something AI has been very useful for to me, less searching because I can describe the outcome I want and it figures out what I am talking about generally.