the 70/30 principle: AI handles 70% of execution, the human provides the 30% that matters.

Never mentioned authentication

readable AND writable by anyone on Earth for 11 days

Shouldn’t you have had a human check that before going live, given the 70/30 principle?

Full writeup with forensic details, the remediation comedy, and the 70/30 framework: mpdc.dev/the-locksmiths-apprentice I document everything — wins and losses — because someone building their first self-hosted stack shouldn’t have to learn this the hard way.

I don’t think they should learn from you, either, to be fair.

Can’t you turn on Developer Mode to enable third party slicers?

I believe you set env vars on Windows through System Properties -> Advanced -> Environment Variables.

I believe you just need to set the env var OLLAMA_HOST to 0.0.0.0:11434 and then restart Ollama.

What OS is your server running? Do you have an Android phone or an iPhone?

In either case all you likely need to do is expose the port and then access your server by IP on that port with an appropriate client.

In Ollama you can expose the port to your local network by changing the bind address from 127.0.0.1 to 0.0.0.0

Regarding clients: on iOS you can use Enchanted or Apollo to connect to Ollama.

On Android there are likely comparable apps.

I think of the Bambu P1S as the inexpensive alternative to the Bambu X1C or a comparable printer from Prusa, at least in terms of print consistency and ease of use.

My Bambu was my fourth 3D printer (second FDM printer) and it took 3D printing from a frustrating, time consuming hobby to just a thing I do to enable other hobbies. I don’t have to spend time tweaking settings to get a decent print, because the default settings are already good enough. Instead, I can focus on designing models or working with finished prints.

I’ll have to check out both OpenSCAD and Code Comic. Some completely non-CAD DSLs that you might be interested in, since you mentioned GraphViz:

Mermaid.js does something very similar to Graphviz. There are a couple other similar tools like that out there, but Mermaid is supported in a lot of places natively or as an easy to use plugin, like GitHub Markdown (and other git forges like Forgejo), Hedgedoc, Obsidian, SilverBullet, etc…

I’d also argue that LaTeX counts, and to a lesser extent, Markdown - compare using them to using Word.

And reveal.js is an equivalent for slide deck creation that would normally be done with PowerPoint.

I hear more complaints about Windows from Windows users than from people who solely or primarily use other OSes. Unless you count “Okay… so why don’t you do something about it?” as a complaint, that is.

I think that makes you “the guy who really likes to talk about Linux.”

From https://wiki.servarr.com/

Welcome to the consolidated wiki for Lidarr, Prowlarr, Radarr, Readarr, Sonarr, and Whisparr. Collectively they are referred to as “*Arr”, “*Arrs”, “Starr”, or “Starrs”. They are designed to automatically grab, sort, organize, and monitor your Music, Movie, E-Book, or TV Show collections for Lidarr, Radarr, Readarr, Sonarr, and Whisparr; and to manage your indexers and keep them in sync with the aforementioned apps for Prowlarr.

See also https://wiki.ravianand.me/home-server/apps/servarr

Servarr is the name for the ecosystem of apps that help you run and automate your own home media server. This includes fetching movie and TV show releases, books and music management, indexer and UseNet/Torrent managers and downloaders.

I’m a professional software engineer and I’ve been in the industry since before Kubernetes was first released, and I still found it overwhelming when I had to use it professionally.

I also can’t think of an instance when someone self-hosting would need it. Why did you end up looking into it?

I use Docker Compose for dozens of applications that range in complexity from “just run this service, expose it via my reverse proxy, and add my authentication middleware” to “in this stack, run this service with my custom configuration, a custom service I wrote myself or forked, and another service that I wrote a Dockerfile for; make this service accessible to this other service, but not to the reverse proxy; expose these endpoints to the auth middleware and for these endpoints, allow bypassing of the auth middleware if an API key is supplied.” And I could do much more complicated things with Docker if I needed to, so even for self-hosters with more complex use cases than mine, I question whether Kubernetes is the right fit.

You can store passkeys in (and use them from) a password manager instead of the OS’s secret vault. I think most major password managers support this now - Bitwarden definitely does.

I’m not a lawyer, but I believe that if the Lemmy instance’s ToS indicates where disputes will be resolved, and either the site owner resides there or is an LLC that is registered there, that you could sue Meta in that location.

Meta is big enough that they are most likely conducting business there (even if digitally) and you could also show that the harm suffered was suffered there.

I genuinely don’t understand why people here are taking it so hard that I wish the Immich devs were using semver.

Because you didn’t say that; you said “Breaking changes in a point release? Not cool” and later “I’m basing this off the guidelines at semver.org.”

I’m paraphrasing your comments from memory, to be clear, so apologies if I misquoted you.

It certainly felt to me like you were assuming that this project was using semver and was not following it well, not that you wouldn’t want to use a project that receives this many breaking changes / that doesn’t follow semver. Those complaints both make a lot more sense to me - and I’ve seen many people say similar things about Immich in the past. In fact, it’s a big part of why I haven’t migrated from Photoprism to Immich myself - in this regard they’re complete opposites.

I don’t think there’s any room to argue that announcing a 1.x with a change the developers say is a breaking change, which is what Immich have done, fits within the semver.org guidelines.

That wasn’t the argument.

Following semver is optional. If a project doesn’t explicitly state it is following semver, it shouldn’t be assumed that it is. With regard to Immich in particular, a cursory review of their documentation makes it clear that they are not following semver. Literally, go to https://immich.app/ and read the text at the very top of the page:

⚠️ The project is under very active development. Expect bugs and changes.

Go to the repo and you’ll see the README, which states at the very top:

• ⚠️ The project is under very activedevelopment.
• ⚠️ Expect bugs and breaking changes.

If you can read that, see that they’re on major version 1 with a minor version over 100, and you still think they’re using semver, then that’s on you.

The devs have stated they won’t be using semver until they consider Immich production ready, and that moving to a 1.x version from 0.x was a mistake made some time ago. If you want to think about it as though it is semver, consider the major version to still be 0. See https://github.com/immich-app/immich/discussions/5086#discussioncomment-7593227 for example.

As this project is clearly not following semver, the semver guidelines aren’t applicable and haven’t been violated.

I don’t think there’s any room to argue

Even if semver were applicable, in this case, I would still disagree. The text from semver.org states:

8. Major version X (X.y.z | X > 0) MUST be incremented if any backward incompatible changes are introduced to the public API.

It doesn’t state that any backward incompatible changes, period, require a major version increase, only changes to the public API. I would personally argue that the deployment configuration is part of the public API, but not all project owners agree with me. Even if they do agree, they might say that this was not a documented deployment configuration and thus not part of the public API, and that it therefore doesn’t necessitate an increase to the major version, but as they knew that people were using that configuration, anyway, they included a note about a potentially breaking change as a courtesy to those users.

Immich isn’t a library (the main use case for semver is dependencies that will be pulled into other projects) and as far as I know they don’t state that they use semver.

This is what I would try first. It looks like 1337 is the exposed port, per https://github.com/nightscout/cgm-remote-monitor/blob/master/Dockerfile

x-logging:
  &default-logging
  options:
    max-size: '10m'
    max-file: '5'
  driver: json-file

services:
  mongo:
    image: mongo:4.4
    volumes:
      - ${NS_MONGO_DATA_DIR:-./mongo-data}:/data/db:cached
    logging: *default-logging

  nightscout:
    image: nightscout/cgm-remote-monitor:latest
    container_name: nightscout
    restart: always
    depends_on:
      - mongo
    logging: *default-logging
    ports:
      - 1337:1337
    environment:
      ### Variables for the container
      NODE_ENV: production
      TZ: [removed]

      ### Overridden variables for Docker Compose setup
      # The `nightscout` service can use HTTP, because we use `nginx` to serve the HTTPS
      # and manage TLS certificates
      INSECURE_USE_HTTP: 'true'

      # For all other settings, please refer to the Environment section of the README
      ### Required variables
      # MONGO_CONNECTION - The connection string for your Mongo database.
      # Something like mongodb://sally:sallypass@ds099999.mongolab.com:99999/nightscout
      # The default connects to the `mongo` included in this docker-compose file.
      # If you change it, you probably also want to comment out the entire `mongo` service block
      # and `depends_on` block above.
      MONGO_CONNECTION: mongodb://mongo:27017/nightscout

      # API_SECRET - A secret passphrase that must be at least 12 characters long.
      API_SECRET: [removed]

      ### Features
      # ENABLE - Used to enable optional features, expects a space delimited list, such as: careportal rawbg iob
      # See https://github.com/nightscout/cgm-remote-monitor#plugins for details
      ENABLE: careportal rawbg iob

      # AUTH_DEFAULT_ROLES (readable) - possible values readable, denied, or any valid role name.
      # When readable, anyone can view Nightscout without a token. Setting it to denied will require
      # a token from every visit, using status-only will enable api-secret based login.
      AUTH_DEFAULT_ROLES: denied

      # For all other settings, please refer to the Environment section of the README
      # https://github.com/nightscout/cgm-remote-monitor#environment

To run it with Nginx instead of Traefik, you need to figure out what port Nightscout’s web server runs on, then expose that port, e.g.,

services:
  nightscout:
    ports:
      - 3000:3000

You can remove the labels as those are used by Traefik, as well as the Traefik service itself.

Then just point Nginx to that port (e.g., 3000) on your local machine.

—-

Traefik has to know the port, too, but it will auto detect the port that a local Docker service is running on. It looks like your config is relying on that feature as I don’t see the label that explicitly specifies the port.

I thought Hue bulbs used Zigbee?

The up arrow moves through the letters, e.g., A->B->C. The down arrow moves to the next character in the sequence, e.g., C->CA->CAA. If you click past the correct letter, you’ll have to click all the way through again. And if you submit the wrong letter, you have to start all over (after it takes twenty seconds attempting to connect with the wrong password and then alerts you that it didn’t work, of course).