I’m in France timezone so hopefully we can find a time of the day that works for both of us, but feel free to DM me here or on Matrix (@pcouy:matrix.pierre-couy.fr)

I was about to type pretty much the exact same thing, but I figured it would already be here for me to upvote :)

The ansible role I made does not cover this. If you make a server an exit node for a network, the server gets configured to forward everything that comes from the wireguard network. Since my use case does not need this, I don’t think I’ll add it, but the role could be expanded to support ACLs by taking inspiration from how it deals with port forwarding.

Do you have specific examples of the “different firewall requirements” ?

I have a custom made ansible role that does what you are asking for. I’ve wanted to clean it up a bit before putting it up on Github, and your post just gave me a motivation to stop procrastinating it :) This was initially made for my own use, and I’m not an Ansible expert so it can have some rough edges, but I tried my best to make it adhere to the Ansible way of doing things (applying the same role to a host twice should be idempotent).

Using this role, I’m able to quickly define wireguard networks, define which peer participates in which network, optionally configure a peer as a router (with NAT and port forwarding) for a given network. For Ansible-managed hosts, it installs wireguard, generates and deploys wireguard configurations, and enables IP forwarding on exit nodes. It can also generate ready-to-deploy wireguard configurations for externally managed hosts.

The repo is at https://github.com/pcouy/ansible-wireguard . I tried giving some instructions in the readme but they may not be detailed enough. If you try it, please open an issue for anything that’s not clear enough from the readme so I can improve it. (I tried making a “Quick start” section for people who never used ansible before)

I did something similar for digitizing old camcorder family videos. I hooked up a VCR through a cheap elgato RCA -> USB capture card to my home server, and did something similar to you with a preview feed available on my LAN.

I even built a (really ugly) web UI which lets me pick an audio and video source, start the preview stream and display it in the browser without actually starting the capture, then start/stop the capture, edit the ffmpeg flags, and set the output file name. I can share it with you if you are interested

My point was never about the cost anyway. It was about VPNs (commercial or hosted on a cheap VPS) still needing you to trust a third party, and also that the P in VPN does not mean “privacy”

When I said I host my own, I mean on cheap VPS that cost me way less than 6$/month.

But yeah, mullvad is pretty much the only commercial VPN provider I’d trust more than my ISP

There’s absolutely no reason my ISP needs my browsing history.

Don’t know what ISP you have or what VPN you’re using, but it’s just a transfer of trust. Whoever your VPN provider is, they now see everything your ISP previously saw. I host my own VPN servers when I need one, and even then I still have to trust the datacenter operators to not snoop on my DNS requests (almost everything else tends to be encrypted with SSL/TLS by default nowadays)

Also, the “Private” in VPN is about it being for private use, not about privacy

After trying to run postmarketos on an old phone of mine, I’m really excited for anything that improves support for android devices to mainline linux !

What’s failed about their newest release ?

I don’t know about other homeserver implementations but synapse kinda sucks. It used to randomly eat 100% of 1 or 2 CPU cores (including the database) until I tracked it down to 3 rooms having a messed up state which caused costly SQL queries. I removed the rooms from my server (using a third party admin panel because there’s no proper admin GUI built in, the documentation just mentions curl commands to hit the admin API, with placeholders to manually replace). It has been fine since I did it, but I’m the only user on my server. And I expect other issues to come up at any time…

It also eats a lot of storage, mostly the database. It grew very large quickly, but it’s more stable now

What I mean by “lower level” is that it has less abstractions built in

Systemd abstracts so much stuff away that it does not feel like learning Linux “from scratch” :/

(I like having it in my daily driver, but it’s sad LFS had to drop support for a “lower level” init system)

This thread was a fun read. The part where the author tries covering up their BS with force pushes is so messed up…

This is neat. I’ve intercepted trafic from a few apps in the past, and whenever cert pinning was enabled it was a massive pain to deal with

Blocking or allowing domains should not mess up SSL. Is there anything else filtering or intercepting the trafic ?

This would have been a (if not the only) good point to make in the article considering the title. But I guess this would have taken space away from ads

The headline is vert clickbaity : it does not affect VPN users (the law forbids age-gated websites from promoting VPNs as a circumvention), and the whole article is just an ad for VPNs

Here is a link to the adjust.h GitHub in case you don’t feel like watching a video