No idea at all, but I am highly interested in your experience. So it would be great if you could came here back to share it with us

This is the answer

Yes, it will be enough if your services are not exposed via port forwarding , tailscale / zerotier are super convenient for this.

Honestly, if I were you I would start thinking in having a small computer just to act like a proxy / firewall of you synology, or even better, just run the applications on that computer and let the nas only serve files and data.

It is much easier to support, maintain and hardening a debain with a minimal intallation than nay synology box just because the amount of resources available to do so. In this easy way you could extent the life of your nas far beyond the end of life of the Sw

Don’t make it available from internet. This will solve the issue.

If it is not possible, once the cve is published and properly described, perhaps there is another way to secure it via an external proxy or even a waf.

If you have unsupported Sw, it is always a pain in the ass to keep them secure so try to figure out always the first point

Can someone be so kind to explain me what I am seeing?

Because it seems like I am not celvee enough to get it

The answer is mTLS.

But you will run into the key distribution problem. But if your number of devices is manageable, it could be the solution

This thing reduces the attack surface of the inmich installation.

If it is good, or bad or fitting to your security model can only be said by you. But honestly it sounds like a sensible thing to do

OK, thanks for the feedback. Perhaps I am doing something terrible wrong with it.

I will recheck the system again.

Thanks

Would you mind to elaborate a bit more about your experience witht he sophos?

I got a reused xgs115 a few months ago and I found the experience not so pleasant. The device lags a lot with the web page interface, the learning curve is steep in my opinion and I have problems to setup some services in a reliable way (they tends to hangs up, but this is perhaps my own problem)

Do you know by chance if they are able to have the Ds-lite tunnel for an ipv6 to ipv4 working?

How the average quality from those IKEA plugs?

In my experience Ikea quality in electronics range from ok to a big ball of crap without any apparent way to distinguish in which side they are.

Thank for the suggestions, I will take a look because it is true that I focused myself on the link manager but perhaps a link sync tool could do the job.

Thanks again

I didn’t know floccus, I will take a look.

Thanks for the suggestion

Thanks for the suggestion, but as far as I know there is not any plugin for the browser available, right?

Where do they get the water from?

The learning curve is a bit steep but his guide is awesome https://trash-guides.info/Radarr/Tips/How-to-setup-language-custom-formats/

In the other hand, the public trackers are dominated by English and, at least I, I couldn’t find a lot of Spanish dual movies better than the 720p

In any case, if you can gain access for a Spanish private tracker with radarr support, let me know

Thx, I will keep in mind, but I have consumer grade hw and I am afraid that vlan in my switch is not possible.

I any case thanks for the bunch of tips

The you recommend to mount them via the hypervisor?

I was certainly planning to use it in the vm itself…

Thanks for the comment, I will try to check but performance should not be an issue. In the end it is personal selfhosted service.

If you think something similar to Instagram could solve your problem, check this: https://docs.pixelfed.org/running-pixelfed/installation/

Also, it should be trivial to expand it to the rest of the family

Super good, it is increíble useful and the ability to find any document in almost any place in seconds in awesome.

Once this is said, you need to stick to a process and it is time consuming, and of course, you need to manually review the automatics tagging feature.

So, It is not a set and forget like most of the people expect