I have written a small blog post about how to Bypass CGNAT, and have also mentioned why you should not use Cloudflare if you are hosting for privacy.

deleted by creator

6th gen’s integrated GPU cannot decode HEVC.

My optiplex with i5-6500TE can transcode 4K videos easily if the codec is AVC. HEVC is different story though. Any CPU newer than 10th generation would be more than enough for your needs, I’d say.

Not sure. Will have to try it out.

All ports are forwarded. If your SMTP is running on, say, port 993, on your local machine, your-VPS-ip:993 will be your SMTP.

Get out of here, redditor.

I am not sure what you mean.

The issue is, when using Cloudflare, they will terminate your TLS, then encrypt the data again with their own certificate, which is send to the visitor. When visitor interacts, their data is decrypted on Cloudflare’s servers, which they encrypt again eith our original certificate and send it back to us.

Sure, hackers or sniffers might not be able to look at the sensitive data, but Cloudflare can. But do they, or do they not, is upto you, if you trust them or not.

If you are using the exact rules mentioned in my post, only the ports of your machine will be forwarded, not your entire local network. If you want to forward ports of more than one machine, look at the github link in the sources, it contains a detailed documentation of how to achieve that. Since, I do not know a lot about iptables, I may not be the best person to guide you, in this case. However, feel free to DM me, I’ll might be able to help.

Yes, it is fairly easy. You just have to forward the http headers. I am using HAProxy, and you can look at my configuration file in the blog. If you’re using something like Nginx Proxy, look up how to forward http heards. Some applications, like Nextcloud, require extra steps, but they also provide their own documentation.

I am not sure, actually. Look at the sources, and you’ll find the original GitHub link from where I took it. I am not very well versed with iptables.

I wrote a small blog about bypassing CGNAT using TLS-passthrough. Cloudflare uses TLS-termination, which means they can see all the data being passed through, which defeats the purpose of privacy.

https://blog.aiquiral.me/bypass-cgnat

I’ve tried hosting an nginx server. It is fun, but I wouldn’t rely on it for production use cases.

I’ve also seen some people run docker on their android devices.

Thank you for these suggestions. But I have a few questions.

How can I do the 2nd and 3rd point if I am using docker/podman containers?

Why is ClamAV useless?

Joplin can be a multi-user solution as well. I use Joplin with Nextcloud. If you don’t want to share notes just use Joplin and every user can use the same nextcloud instance, but different user accounts, to save their notes. If you want to share all the notes, all the users can synchronise with the same Nextcloud user. You can make different notebooks for different users. All the users, however, can see and edit notes. Joplin cannot be a solution if you want to share some notes. It is either all, or none.

Logseq can be another solution, with the same technique. However, you can use git to synchronise different databases, where one database is used in shared notes and personal databases for non-shared notes. I host my own Gitea (will soon shift to forgejo) to synchronise my Logseq databases.

AFAIK, Piped always proxies the videos through a server.

I am more familiar with Invidious. Find an Invidious server that lets you enable proxying. Some examples are yewtu.be, invidious.protokolla.fi and inv.nadeko.net. Then find an RSS app that lets you download the content, as well as supports cookies. Use the invidious server’s cookies in your RSS app to proxy the content you download. Invidious servers can provide RSS feeds for individual channels, as well as your complete subscription feed.

And if possible donate a dollar or two, regularly, to the invidious server that you use, since it takes up a lot of bandwidth and motivates the hoster to keep up what they are doing.

6. If you are self hosting for privacy, I recommend staying away from Cloudflare, that is, not to use their proxying service or Cloudflare tunnel.

More information here - https://blog.aiquiral.me/bypass-cgnat

Stingle Photos. It works only with S3.

Some people even use Raspberry Pis as their NAS. I use an old MacBook (5th gen i5) as a home server with 2 external hard drives as a NAS, which also runs a few docker containers like Jellyfin. Before that, I was using an old PC with 1st gen i3 for all these things.

The only thing preventing me to move from photoview to immich is the lack of sorting/viewing photos by folder hierarchy. I love the UI and the machine learning customisation options. They recently added the “external albums” feature, so I am hoping this folder hierarchy thing, too, will soon be implemented.