• 0 Posts
  • 5 Comments
Joined 2 months ago
cake
Cake day: January 17th, 2026

help-circle
  • I have my Firefox configured to force HTTPS, so it’s rather inconvenient to work with any non-HTTPS sites.

    Because of that I decided to make my own CA. But since I’m running in Kubernetes and using cert-manager for certs, this was really easy. Add a resource for a self-singed issuer, issue a CA cert, then create an issuer based on that CA cert. 3 Kubernetes resources total: https://cert-manager.io/docs/configuration/ca/ and finally import the CA cert on your various devices.

    However this can also be done using LetsEncrypt, with the DNS01 challenge. That way you don’t need to expose anything to the Internet, and you don’t need to import a CA on all of your devices. Any cert you issue will however appear in certificate transparency logs. So if you don’t want anyone to know that you are running a Sonarr instance, you shouldn’t issue a certificate with that in it’s name. A way around that is a wildcard cert. Which you can then apply to all your subservices without exposing the individual service in logs. The wildcard will still be visible in the logs though…





  • Resilio wouldn’t work well for distribution…

    But archive.org seems to handle torrents pretty well. When they have a bundle they add a torrent with the same content, and set up themselves as webseed… Then everyone can download either directly or through torrent, and choose to seed what they want. If the content changes, post a new torrent… Of course that means that any old seeders get invalidated… But if they care about seeding they could update the torrent and point it at the old download to avoid redownloading everything. But also, how often does this content actually change? If a game iso/rom is ripped/dumped correctly isn’t that data kind of final? Why would the bit-perfect data need to change?