This will get you started and give you a idea of the requirements.

https://www.youtube.com/watch?v=XvbVePuP7NY

What could get you started is a old laptop (or a pi) where you install home assistant and the necessary plugins. Then installing the Home assistant app on your phone for voice control.

Could you provide some more information on how you perform a vuln scan, or what services/softwares you use to perform the scan?

Lines F and E don’t exists in your diagram, all your VMs inside of Proxmox are accessible and sharing port eth3. Except Opensense, as its not bridged to eth3, but instead is assigned to the NIC card you have.

OPNSense inside Proxmox is the only VM that will see the NIC card and be the only VM that uses that NIC with those interfaces.

One interface would be for WAN in like you drew, and the other is the LAN port like on any other router. This LAN port needs to connect to a switch as this is where your OPENsence will communication with the rest of the home network and handout DHCP addresses. It’s also how you would reach your OPENsense GUI through a browser. (Outside of managing it within Proxmoxs GUI, accessible on eth3)

If your OpenSense VM goes down your home network won’t have a router which means no PCs would be able to communicate as they would have no DHCP addresses, so even if all your communication is “inside of Proxmox” your VM still would not get a DHCP addresses.

What you may want to do is use something like Tailscale (or a VPN) to connect the two sites (homes) together.

Run your Tailscale setup in home A, and then in home B connected to your tailnet. You can install Tailscale on the home router of home B, or install it on any device that needs to connect to home A.

Then in home B you just connect to your Jellyfin server like you normally would if you were in home A. This could be a android box or smart tv for example or accessing it through a browser on a pc. (If those devices have Tailscale installed and are connected to your tailnet in home A)

Using a VPN like Tailscale would also mean you don’t expose your Jellyfin to the internet.

Honestly I don’t know enough to answer that question fully.

From what I understand PCI addresses (01:00.0) are dynamically assigned by the motherboard’s BIOS at boot. Adding or removing PCIe devices, enabling M.2 drives, or adjusting BIOS settings often shifts your device addresses up or down which can prevent a VM from starting up.

Reading online though, there now seems to be a workaround to this issue. I might need to give it a shot on my Proxmox machine.

“PCI ID overrides” is the term in this document to search for.

https://pve.proxmox.com/wiki/PCI(e)_Passthrough

I have been running PfSense on Proxmox for ages now.

What I do is the following.

1. Pass the NIC card through to PfSense.
2. Your motherboards ethernet port is plugged into your network switch (think of proxmox as just another pc on your network)
3. In PfSense your NIC can now be seen and all ports can be assigned as needed. Assign one as WAN and the others as LAN.

Set your pfSense /OPNsense to start at boot when you power on proxmox.

FYI, you might occasionally run into issues where the NIC “GUID” changes so your VM won’t be able to start.

When this happens your pfSense/OPNsense VM won’t start so your network will be in a “down state”. This means DHCP won’t be working either, and any PC that were not assigned a static IP won’t be able to access the Proxmox GUI to quickly fix the issue.

You might occasionally need to hook up a temporary router between a PC and your Proxmox host to access the web GUI as a result. At least this is what I do when my outrage is longer then a hour.

What you are looking for is something called NAT Reflection/HairPin NAT/NAT loopback.

When you search for a “domain.example.com” your router loops you back at your reverse proxy and all the traffic remains “internal”. Your website will still be externally accessible (the ones you setup to be).

Here’s a example of how to set this up on PfSense router.

https://www.youtube.com/watch?v=ngwae1UvS-Q

Great app, I have been using this for a few weeks now on my home network and have noticed a difference in the ads popping up.

I too would like to know more. Jellyfin has been something that I am still hesitating to expose online without a VPN.

I have Plex behind a reverse proxy (HAproxy) with Crowdsec and firewall rules all behind Cloudflare. My firewall rules in HAproxy block access a few different ways, like if request are higher then 60 requests a second, or if there is strange path traversal. Used the following guide as a start.

https://www.archy.net/building-a-native-fail2ban-with-haproxy-stick-tables/

https://homebox.software/en/

Honebox a simple home inventory management software

One option is to use a older version of TrueNAS until some alternatives start to show up.

I would probably keep my NAS offline so it does not phone home.

That can be installed on any hardware, as opposed to just a TV directly. That I could get behind.

Gemini is a hot pile of garbage.

When I ask Gemini for directions it starts to give me a definition, as opposed to opening maps and showing me the way. If I ask to turn off the lights I get a conversation and I end up walking to the light switch myself.

Try mixarr

https://github.com/aquantumofdonuts/mixarr

Fuck that, I want to own my shit and will build my own fucking server before renting space in a corporate owned server.

Thank you, your comment here helped me sort my issue out.

For anyone if you want to access this without the built-in proxy/caddy server set your ports in your docker compose like so.

• 3010:3000
• 3443:443 (this is the caddy port inside the container)

Understood, though it’s still kicking my butt TBH.

Exposing port 3010:3010 seems to get me a connection refused. But I can still connect to port 3443:443. Both ports are set to TCP.

Guess I’m just exhausted, will play around with it more tomorrow. Thanks for your help.

I am running in docker, I got 443 pointed at 3443.

I saw the 3010 setting in the docs, i just can’t figure out if 3010 is pointed at 80?

I am trying to put this behind Haproxy but not having much luck, I keep getting “client sent an HTTP request to an HTTPS server”.

Anyone have a clue how to resolve this?

I understand this image has its own caddy reverse proxy, not sure how to bypass that at the moment.

There goes my RAM