I don’t restrict music from my kids but as a parent I want to know what they are listening to so I can have open conversations with them. At the same time seeing their listening habits can also help me pick up on how they’re feeling.

Thank you. It’s just me running the site and I hope to have at least one new article a week.

The images? I’m a system admin, not a graphic designer lol

It is a fair bit of homework but for those of us who use Linux on a daily basis, we’d rather do the legwork once to have a private, predictable system than deal with the out-of-the-box bloat.

Regarding updates: that’s exactly why I focused on Group Policy tweaks rather than simple registry hacks or UI toggles. Policies are designed for enterprise environments where IT managers would be furious if an update reset their security configurations, so they tend to survive major build updates much better than standard settings, it’s not foolproof but it is the best way to stay ahead!

The UK PM has just announced an under-16 social media ban.

This is the ‘Trojan Horse’ in action. You cannot enforce a ban without an Age Verification layer, and you can’t have Age Verification without a National Digital ID or biometric database. They are using the ‘child safety’ card to build a mandatory surveillance gate for the entire internet.

Between the new taxes and the constant bans, it’s clear this government has zero respect for personal agency or digital sovereignty. If you aren’t already moving your data off the cloud and into your own home lab, start now. The gap between our current society and a total surveillance state just got a whole lot smaller.

Dedicated PC on LAN talks directly to VPS via Wireguard. The local machine acts as an exit node so when I add a local IP and port to my reverse proxy the whole thing acts like a local network.

I wrote about my setup last month; https://the.unknown-universe.co.uk/home-lab/wireguard-vpn-two-vps/

You’re right, I missed that.

I personally use a reverse proxy and Wireguard setup to access remotely.

I have a dedicated VPS with reverse proxy connected to my network via Wireguard. It acts as the front door to my network so I don’t have to port forward or rely on Cloudflare etc. I used to use Tailscale as the go between but switched to WG recently. Both work fine for streaming content whilst self-hosting all other services including my website.

My bad, GOG is absolutely the gold standard for DRM-free ownership. Personally, I buy on Steam for the convenience and the Proton support but I still collect every free titles on GOG

It’s why I treat everything cloud-based as a rental now. If I can’t install it locally and back up the data myself, I don’t really own it.

The home server is an old, low-powered mini PC running Debian. It acts as the bridge between the WireGuard tunnel and my local LAN.

I’ve just finished migrating one of my AdGuard Home instances onto it today. Its role is now twofold:

Routing: It has ip_forward enabled and a bit of NAT (iptables/nftables) so that traffic arriving from the VPN can actually “hop” onto the local network to reach my other VMs and containers.

DNS: It provides ad-blocking for the tunnel. VPN clients point to this node’s internal WireGuard IP for DNS queries.

Technically, it’s just another WireGuard peer, but with AllowedIPs configured to advertise my 192.168.x.x subnet back to the hub (VPS2). This is what allows  VPS1 and my mobile devices to resolve and reach home services without a single open port on my router.

You’re right, and for a lot of people, one VPS is the sensible choice. I actually addressed this in the post:

"VPS1 is my web-facing server. It handles the public side of things. VPS2 is the VPN hub. At first glance, that probably looks unnecessary. Strictly speaking, it is unnecessary. I could have crammed WireGuard onto VPS1 and called it done. But splitting the roles makes the whole thing cleaner.

One machine serves public traffic. The other handles VPN duties. That means fewer networking compromises, fewer chances of Docker or firewall rules becoming annoying, and a clearer separation between the public-facing stack and the private tunnel. It also means I can change one side without poking the other with a stick and hoping nothing catches fire."

It’s not that I didn’t like it, I just wanted to back to basics! A simple config file on each machine, job done

Exactly that, VPS2 handles the WireGuard port and has no domain pointing to it, so it’s basically hiding in plain sight. VPS1 holds the domain and handles the web traffic.

I keep SSH open on both, but locked down (key-based auth + restricted to my IPs).

Your idea of using the provider firewall (Ionos in my case) as a “mechanical” lock is a good one, block it at the edge and only open it when needed. I’ve thought about doing that, but I’m generally happy relying on a hardened SSH config and the provider’s KVM if everything goes sideways.

Thank you for the heads up, turns out it was the custom html code in the code blocks causing the issue. Fixed now.

dist-upgrade and full-upgrade are essentially the same command but yeah, I won’t be using apt upgrade again in the future! Like I said in my post, the joys of being self taught is that you learn by my making mistakes and that’s part of the “fun” 🤣

I self host so the data in the cloud is stored on my own equipment, yes it is still technically online but it saves a copy locally so you only need an active connection to sync new items.

I regularly use multiple devices and having that sync is vital. Even at work, I cannot install software but I can install browser extensions. This means I can use my instance for both personal and work. I have also set up most of my family with access, all for free!

Which phone and message app are you using? I also don’t see a way to view photos or files and which camera app?

Obviously GrapheneOS is the best way to go for privacy but if you do stick to OEM Android then make sure you’re using apps like the Fossify suite. I use their apps with all contacts and calendar synced via davx and self hosted on Nextcloud.

What about KeePass, where is that data backed up?

SteamOS and Proton are kind of paving the way. It’ll be interesting to see if Steam Frame can take that further, especially on mobile/ARM, and shake up the usual players.

Yes, Android is open source. But the thing is, Google’s clampdown on sideloading isn’t just about the OS code itself. It’s really about controlling the whole app ecosystem and making it harder for people to install apps outside of Google’s own channels.

Sure, folks can fork Android and make their own versions — that’s been happening for years with projects like LineageOS. But the tricky part is keeping all the apps working smoothly without Google’s proprietary stuff like Play Services. Without that, a lot of apps just don’t behave right, and the user experience takes a hit.

So basically, just having Android’s code open isn’t enough to keep it truly open and easy to use. The real control is in the ecosystem around it, and that’s what Google’s tightening grip is all about.