WASTECH

I second Pocket ID. I initially set up Authentik, but after discovering Pocket ID and giving it a try, it is way easier to set up and use. Authentik is great if you want to customize everything, but for my needs it was too much. I was able to migrate everything to Pocket ID in an afternoon, whereas Authentik took me several hours over the course of a few days to get set up.

I was fortunate enough to get a .io domain with my first initial and last name (I have a very common last name), and I have stuck with that ever since. I am a bit concerned with the political stuff around it, as the domain may be going away as some territory changes hands. But I think at this point there are enough large companies using the domain that I’m hoping it would be protected if the country ends up losing the domain.

Not really. It’s Hyper-V and S2D with some Azure “magic” sprinkled on top to allow you to create and manage VM’s from the Azure portal. There are some differences in how you manage the hosts (Windows Defender Application Control is enabled as well as BitLocker, and updates must be done through the portal). There are also some Azure Local specific PowerShell modules and commands for managing the cluster. The biggest difference though is probably their Network ATC component, which is actually pretty cool.

We are a big Microsoft/Azure shop, so we went with Azure Local. Proxmox was the other option we were looking at, but we determined it wasn’t a good fit at this time. That may change in 5 years when we go to upgrade hardware again, and we already have plans to continue to evaluate it.

Our VMware costs have doubled for our last 3 renewals. We had a project this year to move to another hypervisor. Most of our hardware was old, and we were able to replace all of our hardware AND buy the license for the new hypervisor and it’s still cheaper than renewing one year of VMware.

I have just recently started messing with Authentik. And I can confirm OIDC claims and whatnot are an absolute nightmare. I have some experience setting up SAML stuff from my work, but I only do that if our main guy is out and I always struggle with it there too.

Your setup sounds the most like what I am doing now, minus the DMZ. But all of my containers are rootless. I am running everything on TrueNAS right now.

I think I will lean more on Authentik, as the provisioning of users and giving them access to services through that is very easy. I will probably stick with Cloudflare for the time being, but I will look more into Pangolin.

My ISP is charging $20/mo for static IP’s, so almost any other solution would be cheaper.

I hate Oracle with the passion of a thousand suns, so I don’t want to touch them with a 10ft pole. I would happily pay anyone else to avoid using anything affiliated with Oracle.

Thanks for the warning. My Plex server is currently behind a Cloudflare tunnel, so I probably need to look at moving that.

I mistook pangolin for netbird, so thanks for the clarification!

I use NPM internally for SSL. DuckDNS won’t work for me since I am behind CGNAT. I also already own a domain.

I would like to avoid paying for a VPS. I probably should have clarified in my post too that I am specifically looking for advise on securing public facing services. While I certainly could make everyone use a tailscale-like service, at this point I think securing an external service would be easier. Especially since most of these people would not be tech savvy and I don’t particularly want to play tech support for their VPN.

I haven’t looked into Asahi Linux in a while now, but I figured the experience would be pretty good by now. You don’t need to “hack” anything to get it to run. Last I read, there were just a few driver issues, but I haven’t looked into it in probably 2-3 years now.

Apples implementation of SMB has always been abysmal. I’ve been using Mac’s for close to 20 years now, and connecting to SMB shares has always been a pain. IMO, it’s gotten better recently (since they dumped AFP and were forced to work better with SMB). For whatever reason, it has always been slow to connect through Finder. Not sure there has been much progress on that front…

Really makes you wonder what Apple uses internally, because it must not be SMB!