All of those are still standing on Firefox’s shoulders and the actual rendering engine on the browser isn’t really trivial thing to build. Sure, they’re not going away, and likely Firefox will be around too for quite a while, but the world wide web as we currently know it is changing and Google and Microsoft are few of the bigger players pushing the change.

If you’re old enough you’ll remember the banners ‘Best viewed with <this browser> on <that resolution>’, and it’s not too far off from the future we’ll have if the big players get their wishes. Things like google suite, whatever meta is offering and pretty much “the internet” as your Joe Average understands it wants to implement technology where it’s not possible to block ads or modify the content you’re shown in any other way. It’s not too far off from your online banking and other very much real life affecting services start to have boundaries in place where they require certain level of ‘security’ from your browser and you can bet that things which allow content modifying things, like adblocker, doesn’t qualify for the new standards.

On many places it’s already illegal to modify or tamper DRM protected content in any ways (does anyone remember libdvdcss?) and the plan is to include similar (more or less) restrictions to the whole world wide web, which would say that we’ll have things like fediverse who allow browsers like firefox and ‘the rest’ like banking, flight/ticket/hotel/whatever booking sites, big news outlets and so on who only allow the ‘secure’ version of the browser. And that of course has very little to do with actual security, they just want control over your device and what content is fed to you, regardless if you like it or not.

I have no idea about cozy.io, but just to offer another option, I’ve been running Seafile for years and it’s pretty solid piece of hardware. And while it does have other stuff than just file storage/sharing, it’s mostly about just files and nothing else. Android client isn’t the best one around, but gets the job done (background tasks at least on mine tend to freeze now and then), on desktop it just works.

It depends. I’ve ran small websites and other services on a old laptop at home. It can be done. But you need to realize the risks that come with it. If the thing I’m running for fun goes down. someone might be slightly annoyed that the thing isn’t accessible all the time, but it doesn’t harm anyones business. And if someones livelihood is depending on the thing then the stakes are a lot higher and you need to take suitable precautions.

You could of course offload the whole hardware side to amazon/hetzner/microsoft/whoever and run your services on leased hardware which simplifies things a lot, but you still run into a problem where you need to meet more or less arbitary specs for an email server so that Microsoft or Google even accept what you’re sending, you need to have monitoring and staff available to keep things running all the time, plan for backups and other disaster recovery and so on. So it’s “a bit” more than just ‘apt install dovecot postfix apache2’ on a Debian box.

Others have already mentioned about the challenges on the software/management side, but you also need to take into consideration hardware failures, power outages, network outages, acceptable downtime and so on. So, even if you could technically shoehorn all of that into a raspberry pi and run it on a windowsill, and I suppose it would run pretty well, you’ll risk losing all of the data if someone spills some coffee on the thing.

So, if you really insist doing this on your own hardware and maintenance (and want to do it properly), you’d be looking (at least):

• 2 servers for reundancy, preferably 3rd one laying around for a quick swap
• Pretty decent UPS setup, again multiple units for reundancy
• Routers, network hardware, internet uplinks and everything at least duplicated and configured correctly to keep things running
• A separate backup solution, on at least two different physical locations, so a few more servers and their network, power and other stuff taken care of
• Monitoring, alerting system in case of failures, someone being on-call for 24/7

And likely a ton of other stuff I can’t think of right now. So, 10k for hardware, two physical locations and maintenance personnel available all the time. Or you can buy a website hosting (VPS even if you like) for few bucks a month and email service for a 10/month (give or take) and have the services running, backed up and taken care of for far longer than your own hardware lifetime is for a lot cheaper than that hardware alone.

NAS stands for ‘Network Attached Storage’ and there’s dedicated hardware for that task from multiple brands. It’s a somewhat spesific thing and from what I understand you have a multi-purpose server running on your network. For discussion it’s better to use the established terminology to avoid confusion on what’s what. Your generic server can of course act like a NAS, but a 100€ Synlogy NAS can’t (for the most part) act as a generic server.

Similarly there’s a dedicated hardware for routers and they are not the same than generic servers which can run whatever. Dedicated routers do some things way better/faster than generic server, and there’s pretty much always a trade-off between the two. You can of course install hardware to your server to be as good as or even better than any consumer grade router and run a pfsense on virtual machine on top of it, but that’s going to be at least more expensive than dedicated hardware.

So, your server is running pihole in a container on the same network address/hardware than the rest of your server, and I suppose you already gathered from other messages that the firewall component on it treats traffic coming from outside the server itself differently than traffic originating from the server itself. For this spesific case I’d say it’s just simpler to configure the server to use DNS server as localhost:1053 than trying to work out firewall forwarding rules for it, if possible. If not, and you absolutely insist that your pihole runs on a unprivileged port and that your server also has to use pihole as DNS sever, then you need to dig out a firewall config for outgoing traffic which redirects the destination port. Or you could set up a dns proxy on the server which uses pihole as upstream and serves addresses to localhost only or one of the other multiple ways to achieve what you’re after, but each of those have some kind of trade-off and there’s too many to go trough in a single post.

I personally don’t, but many do. But it doesn’t matter, my employer isn’t legally allowed to read my emails, unless it’s a sort of an emergency. My vacation, weekend, short sick leave and things like do not qualify. And even then, if the criteria is met, it’s illegal to read anything else than strictly work related things out of my box.

We even have a form where people leaving the company sign permission that their mailbox can be accessed by their team leader and without signature we’re not allowed to grant permissions to anyone, unless legal department is on the case and terms for privacy breach are met.

If the firewall was running on a router then you’d need to DNAT back to the same network from which they originated and that is (in general) quite a PITA to get running properly. My understanding is that the firewall doing port forwarding is running on the NAS. And we don’t have much information on what that ‘NAS’ even is, I tend to think devices like qnap or synology when talking on NAS-boxes, but that might as well be a full linux-system just running CIFS/NFS/whatever.

OP could obviously use his router as a DNS server for the network and set upstream DNS server for the router to pihole, but that’s a whole different scenario.

This is the same as complaining that my job puts a filter on my work computer that lets them know if I’m googling porn at work. You can cry big brother all you want, but I think most people are fine with the idea that the corporation I work for has a reasonable case for putting monitoring software on the computer they gave me.

European point of view: My work computer and the network in general has filters so I can’t access porn, gambling, malware and other stuff on it. It has monitoring for viruses and malware, that’s pretty normal and well understood need to have. BUT. It is straight up illegal for my work to actively monitor my email content (they’ll of course have filtering for incoming spam and such), my chats on teams/whatever and in general be intrusive of my privacy even at work.

There’s of course mechanisms in place where they can access my email if anyting work related requires that. So in case I’m laying in a hospital or something they are allowed to read work related emails from my inbox, but if there’s anything personal it’s protected by the same laws which apply to traditional letters and other communication.

Monitoring ‘every word’ is just not allowed, no matter how good your intentions are. And that’s a good thing.

As it’s only single device I’d suggest configuring DNS server for that to <ip-of-nas>:1053. Port forwarding rule on the nas firewall most likely applies only to ‘incoming’ traffic to the nas and as locally generated DNS request isn’t ‘incoming’ (you can think it as ‘incoming’ traffic is everything coming via ethernet cable into the nas) then the port redirection doesn’t trigger as you’re expecting.

Bare metal server sounds like optimal solution for you and set up a hypervisor on top of it, so it’s pretty trivial to migrate VMs to your own hardware when needed. But then for your ‘long term’ environment VPS would most likely be better and migrating a full VM from your hypervisor to VPS is a bit more work, but can be done.

I don’t know about providers in Australia, but Hetzner has both and combined billing and my personal experience with them is pretty good. But I’m in Europe, so bandwidth nor latency is not a problem.

My experiences are few years old, so I don’t remember excact models anymore, but some back-ups models (es series rings a bell, but as I said, it’s been a while) had batteries with soldered connectors and form-factor which (at least at the time) wasn’t available from anyone else than APC.

I have older 1500VA FSP UPS, I don’t think that exact model is available anymore, but it’s been solid for several years. It currently has 3rd or 4th set of batteries and they are standard bulk batteries, so replacements are easy to find from anywhere. Only problem I’ve had with that is that on display it doesn’t give out clear warnings when batteries degrade and it has crashed my system few times in a power outage, but I’ve been lazy and didn’t bother to properly monitor it nor have scheduled battery replacements, so that’s mostly on me.

Eaton seems to be pretty solid too, but I don’t have a ton of experience on any of their models. Local suppliers had dirt cheap PowerWalker UPS’s a few years ago, but one of them didn’t survive when battery died, so maybe I got what I paid for. Those worked fine too, but apparently they cooked the carging circuit when battery degraded.

This is of course just my own experience over a few models, but personally I wouldn’t spend my money on APC. Propietary batteries and multiple failures after battery replacement at work few years back were enough to choose something else.

I recommend Hetzner too. I’ve been a happy customer for a decade. Support, should you need it, works well and services are rock solid.

My ecotank died just like all the other inkjets. It went few weeks without printing and blue nozzle dried completely up and on the pipes I can see dried up ink on other colors as well. So I had to dig up old Brother HL3040 back to the duty which I retired after print quality started to drop (it needs new fuse unit or something similar, so not that big of a deal) and I thought having an option to print nice color pictures would be nice.

So, if you plan to run ecotank (which does have pretty good printing quality when it works) set up a scheduled task on your computer to print something, in color, quite frequently even if it wastes some ink and paper. I think the main issue with mine was that even if I print stuff somewhat often there was a period where I only needed b&w documents so color nozzles went unused for a while.

I might get a new set of nozzles and ink tanks for my unit as it’s a ton cheaper than a whole new printer, but if you’re looking for a printer this is something to take into consideration, regardless of their marketing material.

Edit: Mine is Epson, didn’t know that ecotank term is used by other manufacturers.

more specific to a subset of people who have time to bother

And that subset of people needs to have at least some kind of mindset to learn the viable minimum skills to even start with and a will to learn more and more and more. I’ve done various kinds of hosting as a career for couple of decades and as things change I’m fighting myself if it’s worth my time and effort to keep my home services running or should I just throw money to google/apple/microsoft/whoever to store my stuff and manage my IOT stuff and throw the hardware into recycling bin.

I have the skill set required for whatever my home network might need up to a point that I could somewhat easily host a small village from my home (money is of course a barrier after a certain point), but I find myself more and more often thinking if it’s worth the effort. My Z-wave setup needs some TLC as something isn’t playing nicely and it causes all kinds of problems with my automations, my wifi network could use a couple of sockets on the walls to work better, I should replace my NVR with something open source to include couple of more cameras around the yard and have better movement recognition and cameras should go to their own VLAN and so on.

Most of that stuff is pretty basic to set up and configure (well, that z-wave network is a bit of it’s own thing to manage) and it would actually be pretty nice to have all the things working as they should and expand on what I have to make my everyday life even more simpler than it already is. But as there’s a ton of things going on in life I just rather spend few hours gaming from my sofa than tinker with something.

That’s of course just me, if you get your reward and enjoyement on your network then good for you. Personally I think I’ll keep various things running around, but right now in this place I’m at, the self hosting, home network and automation and all that is more of a chore than a hobby. And I’m pretty sure I don’t like it.

I agree with you, nuclear response would make things very difficult with China and their allies, but there’s plenty of traditional firepower available directed to Russia if things escalate to that point and should Russia attack with nukes I don’t think they’ll have a lot of support for their actions from the east. And triggering nuclear response would likely end up in a MAD scenario which is something I think (and hope) no one really wants to see trough.

But that still leaves a pretty big field to work with traditional ammunition and a skilled pilot from Sweden could still reach Moscow in 20 minutes or so to turn multiple military targets within the city into a rubble. And there’s plenty of airfields closer than Stockholm with equally capable fighter jets. For the ground force, Finns and Estonians could at least in theory reach Moscow in 10-12 hours since majority of troops defending it are already down on some field in Ukraine and our artillery forces move pretty damn fast.

The amount of destruction Russia could cause is of course still an enormous humanitarian crisis, but even if they could turn Kiyv to wasteland (and kill millions while doing it), it still wouldn’t change the outcome of full Nato response without any bullshit politics limiting on actions if anyone is allowed to strike on the Russian soil.

Medvedev found keys for the booze cabinet again? They seem to happily forget the fact that Moscow is well within reach of multiple Nato countries by now. Obviously a ton of things need to change before anyone with a gun is standing on a red square, but Finland, Sweden, Estonia and Poland (among others) are quite capable of hitting the Kreml (in theory, and in practise if needed) with fighter jets in less than 30 minutes. Additionally their ports opening to gulf of Finland are in reach of both Finns and Estonians with traditional artillely, and at least we in Finland are pretty capable and accurate with our hardware.

So, even if they find some old soviet relic still functional, Nato has multiple options to level multiple cities at Russia before their missile hits the ground. Nuclear attack against Ukraine would of course be a humongous tragedy with terrible price on civil casualties, but I’m pretty confident that it would be the last thing the Russia we currently know would do as a country.

As far as I know it is the default way of handling multiple DNS servers. I’d guess that at least some of the firmware running around treats them as primary/secondary, but based on my (limited) understanding at least majority of linux/bsd based software uses one or the other more or less randomly without any preference. So, it’s not always like that, but I’d say it’s less comon to treat dns entries with any kind of preference instead of picking one out randomly.

But as there’s a ton of various hardware/firmware around this of course isn’t conclusive, for your spesific case you need to dig out pretty deep to get the actual answer in your situation.

have an additional external DNS server

While I agree with you that additional DNS server is without a question a good thing, on this you need to understand that if you set up two nameservers on your laptop (or whatever) they don’t have any preference. So, if you have a pihole as one nameserver and google on another you will occasionally see ads on things and your pihole gets overrided every now and then.

There’s multiple ways of solving this, but people often seem to have a misinformed idea that the first item on your dns server list would be preferred and that is very much not the case.

Personally I’m running a pihole for my network on a VM and if that’s down for a longer time then I’ll just switch DNS servers from DHCP and reboot my access points (as family hardware is 99% on wifi) and the rest of the family has working internet while I’m working to bring rest of the infrastructure back on line, but that’s just my scenario, yours will most likely be more or less different.

A part of it is because technology, specially a decade or so ago, had restrictions. Like with ADSL which often/always couldn’t support higher upload speeds due to the end user hardware, and the same goes with 4/5G today, your cellphone just doesn’t have the power to transmit as fast/far as the tower access point.

But with wired connections, specially with fibre/coax, that doesn’t apply and money comes in to play. ISPs pay for the bandwidth to the ‘next step’ on the network. Your ‘last mile’ ISP buys some amount of traffic from the ‘state wide operator’ (kind-of, depends heavily on where you live, but the analogy should work anyways) and that’s where the “upload” and “download” traffic starts to play a part. I’m not an expert by any stretch here, so take this with a spoonful of salt, but the traffic inside your ISP’s network and going trough their hardware doesn’t cost ‘anything’ (electricity for the switches/routers and their maintenance is excluded as a cost of doing business) but once you push additional 10Gbps to the neighboring ISP it requires resources to manage that.

And that (at least in here) where the asymmetric connections plays a part. Let’s say that you have a 1Gbps connection to youtube/netflix/whatever. The original source needs to pay for the network for the bandwidth for your stream to go trough in order to get a decent user experience. But the traffic from your ISP to the network is far less, a blunt analogy would be that your computer sends a request to the network ‘show me the latest Me. Beast video’ and youtube server says ‘sure, here’s a few gigabits of video’.

Now, when everyone pays for the ‘next step’ connection by the actual amount of data consumed (as their hardware needs to have the capacity to take the load). On your generic home user profile, the amount downloaded (and going trough your network) is vastly bigger than the traffic going out of your network. That way your last mile ISP can negotiate with the ‘upstream’ operator to have capacity to take 10Gbps in (which is essentially free once the hardware is purchased) and that you only send 1Gbps out, so ‘upstream’ operator needs to have a lot less capacity going trough their network to ‘the other way’.

So, as the link speeds and amount of traffic is billed separately, it’s way more profitable to offer 1Gbps down and 100Mbps up for the home user. This all is of course a gross simplification of everything and in real world things are vastly more complex with caching servers, multiple connections to the other networks and so on, but at the end every bit you transfer has a price and if you mostly offer to sink in the data your users want and it’s significantly less than the data your users push trough to the upstream there’s money to be made in this imbalance and that’s why your connection might be asymmetric.