I use characters from whichever book I’m reading at the time. Examples:

• Arya: From ASOIAF, a small but powerful Ultrabook
• Cthulhu: From HP Lovecraft, a huge 17" laptop
• Horus: From the Horus Heresy books, A powerful laptop
• Binky: Death’s white horse from discworld, a white desktop
• Peaches: A rat that always carries a book with her. My home server

If all you care is money, then it’s even less on hertzner at 48/year. But the reason I recommended Borgbase is because it’s a bit more known and more trustworthy. $8 a year is a very small difference, sure it will be more than that because, like you said, you won’t use the full TB on B2, but still I don’t think it’ll get that different. However there are some advantages to using a Borg based solution:

• Borg can do backup to multiple places at once, so you can have the same thing do a backup to the cloud and to some secondary disk
• Borg is an open source tool, so you can run your own Borg server, which means you can have backups sent to your desktop
• Again, because Borg is open you can run a raspberry pi with a 1TB usb disk for backup, and that would be cheaper than any solution
• Or you could even pair with a friend hosting their backup on your server and he doing the same for you.

And the most important part, migrating from one to the other is simple, just changing config, so you can start with Borgbase, and in a year buy a minicomputer to leave on your parents house and having all of the config changes needed in seconds. Whereas migrating away from B2 will involve a secondary tool. Personally I think that this flexibility is worth way more than those $8/year.

Also Borg has deduplication, versioning and cryptography, I think B2 has all of that but I’m not entirely sure, because it’s my understanding that they duplicate the entire file when some changes happen so you might end up paying lots more for it.

As for the full system backup I still think it’s not worth it, how do you plan on restoring it? You would probably have to plug a liveusb and perform the steps there, which would involve formating your disks properly, connect to the remote server and get your data, chroot into it and install a bootloader. It just seems easier to install the OS and run a script, even if you could shave off 5 minutes if everything worked correctly in the other way and you were very fast doing stuff.

Also your system is constantly changing files, which means more opportunities for files to get corrupted (a similar reason why backing up the folder of a database is a worse idea than backing um a dump of it), and some files are infinite, e.g. /dev/zero or /dev/urandom, so you would need to be VERY careful around what to backup.

At the end of the day I don’t think it’s worth it, how long do you think it takes you to install Linux on a machine? Because I would guess around 20 min, restoring your 1TB backup will certainly take much longer than that (probably a couple of hours) and if you have the system up you can get critical stuff that doesn’t require the full backup early. Another reason why Borg is a good idea, you can have a small critical stuff backup to restore in seconds, and another repository for the stuff that takes longer. So Immich might take a while to come back, but authentik and Caddy can be up in seconds. Again, I’m sure B2 can also do this, but probably not as intuitively.

I figure the most bang for my buck right now is to set up off-site backups to a cloud provider.

Check out Borgbase, it’s very cheap and it’s an actual backup solution, so it offers some features you won’t get from Google drive or whatever you were considering using e.g. deduplication, recover data at different points in time and have the data be encrypted so there’s no way for them to access it.

I first decided to do a full-system backup in the hopes I could just restore it and immediately be up and running again. I’ve seen a lot of comments saying this is the wrong approach, although I haven’t seen anyone outline exactly why.

The vast majority of your system is the same as it would be if you install fresh, so you’re wasting backup space in storing data you can easily recover in other ways. You would only need to store changes you made to the system, e.g. which packages are installed (just get the list of packages then run an install on them, no need to backup the binaries) and which config changes you made. Plus if you’re using docker for services (which you really should) the services too are very easy to recover. So if you backup the compose file and config folders for those services (and obviously the data itself) you can get back in almost no time. Also even if you do a full system backup you would need to chroot into that system to install a bootloader, so it’s not as straightforward as you think (unless your backup is a dd of the disk, which is a bad idea for many other reasons).

I then decided I would instead cherry-pick my backup locations instead. Then I started reading about backing up databases, and it seems you can’t just back up the data directory (or file in the case of SQLite) and call it good. You need to dump them first and backup the dumps.

Yes and no. You can backup the file completely, but it’s not a good practice. The reason is that if the file gets corrupted you will lose all data, whereas if you dumped the database contents and backed that up is much less likely to corrupt. But in actuality there’s no reason why backing up the files themselves shouldn’t work (in fact when you launch a docker container it’s always an entirely new database pointed to the same data folder)

So, now I’m configuring a docker-db-backup container to back each one of them up, finding database containers and SQLite databases and configuring a backup job for each one. Then, I hope to drop all of those dumps into a single location and back that up to the cloud. This means that, if I need to rebuild, I’ll have to restore the containers’ volumes, restore the backups, bring up new containers, and then restore each container’s backup into the new database. It’s pretty far from my initial hope of being able to restore all the files and start using the newly restored system.

Am I going down the wrong path here, or is this just the best way to do it?

That seems like the safest approach. If you’re concerned about it being too much work I recommend you write a script to automate the process, or even better an Ansible playbook.

Oh no, a random on the internet who can’t read the list of issues to understand they are all service and not deployment related, with no qualification whatsoever and who reads like an angry teen thinks I don’t know about a technology I’ve been using since before he knew how to talk. I’m devastated.

¯\_(ツ)_/¯ what do I know, I only do this for a living plus manage a couple of home servers with dozens of services for almost a decade.

I would bet that the problem is with Plex being inside docker. Might be one of those situations where being more experienced causes issues because I’m trying to do things “right” and not run the service on my server directly or with root or on network host mode.

But being inside a container causes these many issues I can’t even begin to imagine how it would be to get it to do more complex stuff like be accessible through Tailscale or being behind authorization.

Nope, Jellyfin works directly same as always has

Even though they’re both on the same LAN? That sounds stupid, why would I need my videos to travel half across the globe to go from one room to the next?

Some of it yes, the claim for example, but the rest is still pretty bad UX (and even that is stupid, I shouldn’t need a claim to watch locally), I’m an experienced self hosing person and I’m getting frustrated every step of the way, imagine someone who doesn’t know their way around docker or is not familiar with stuff… Jellyfin might be less polished as some claim, but setting it up is a breeze, never had to look at documentation to do it.

Jellyfin has an app for fire stick, it works flawlessly

It’s curious that I’m almost in the opposite boat, have been using Jellyfin without issues for around 5 years, but recently was considering trying Plex because Jellyfin is becoming too slow on certain screens (probably because I have too much stuff, but it shouldn’t be this slow).

Edit: this made me want to check in Plex, so I’ll leave my story for people amusement:

My experience with Plex:

• Write the docket compose
• leave out the claim because it’s optional and I have no idea what it is
• launch it
• asks me to create an account
• not really comfortable creating an external account to access my local server, but okay.
• discovered I already had an account. Huh? I wonder why I don’t remember ever running Plex then.
• login to that account
• shows me a bunch of stuff
• find it weird that it already scanned everything, especially because I didn’t pointed it to my media
• proceed to try to watch something
• can’t play due to DRM
• WAT?
• go back and discover there’s a bunch of content that’s not in my library
• ok, so this must be some free content
• how do I configure my local library?
• spend 15 min navigating the UI trying to find it
• open the docs, they say to click the settings icon
• that icon is nowhere to be seen
• click a similar one
• can’t find anything the docs say I should
• maybe I’m not on the right site? site is <IP>:<port>/web/yaddayaddayadda so it seems correct
• try to go to <IP>:<port> get to the same page
• look at the docs on how to access the web app says to go to <IP>:<port>/web
• try that, get a message about not being authorized
• WAT?
• read some more docs discover I need that claim
• spend some time trying to find that in the UI
• google it up, find the link
• go to that page, grab the claim, set it up on the server and restart the server
• I’m able to get to the web app now
• Do you want to access it from the internet? If this works it would be great, so yes!
• setup my library
• let it scan and try to watch something from it
• UX sucks, video plays in a sort of popup in landscape on my phone.
• Ah, dumb of me, I probably have my browser set to desktop mode
• No, I don’t.
• Ok, so the web is maybe only expected to be used on desktop, let me install the app
• Install the app, login to my account, only have the Plex provided content
• Look around trying to find the media I scanned, find a thing saying my server is disconnected
• WAT?
• Go back to the web app via IP, try to look into settings
• “You are not connected directly to the server”
• WAT?
• everything else seems okay, I even enabled remote access there and it says it’s working
• Every few minutes the page says my server is not available for a few seconds then comes back
• It’s now been 1 hour and I haven’t been able to watch anything.

It’s now been 1 hour of trying to set this up and I give up. Jellyfin is much more easy to setup, and even if Plex was instantaneous I could have loaded my TV library hundreds of times in the 1h I just wasted trying to get this to work. Probably every other time I tried I got similar results which is why I have an account there even though I don’t remember ever using Plex.

Edit2: after some nore more fiddling managed to get it working, not sure what I changed, so now:

• Open the app, see my content there
• Try to watch something
• “You’re watching in indirect mode, quality might be bad”
• Ok, so it’s not connecting directly to my server, anyways, let’s ignore this for now, maybe it’s getting confused because it’s in a docker container
• “Activate Plex”
• Ah, ok, it’s the “pay or not now” screen, not now
• No subtitles play
• Try different subtitles
• Still nothing
• Plus quality seems shit
• Confirmed, it’s reproducing at 720x300 even though it’s a 4K video
• Look at docs, figure out the direct play is about converting the video
• Select maximum quality which according to docs should use the original file
• Still get a 300p video
• Figure out maybe it’s the android app that’s the problem, go to the TV, install Plex and connect to it
• Video takes forever to load
• Give up again after a couple of minutes waiting for the movie to load

First of all let me make this absolutely clear, docker is not expected to be secure to that level. While they try to make it hard for someone to escape a container, it’s not their main concern so expect that there are vulnerabilities that would allow an attacker to escape.

Now the second thing, the Overseer login screen might be secure enough for your case, the problem is that login is hard to do right, and Overseer are doing several other stuff as well, so they might not give it enough emphasis, and even if they do, maybe Immich devs don’t, or any one of the dozens of other services, so there are dozen of possible points of failure. Things like Authelia or Google OAuth are focused on authentication, so they do that absolutely right, and then they become the only point of failure for authentication.

To be fair, if you keep things updated it’s unlikely not having auth would be a problem. Mostly because most hackers won’t even know of your server to begin with. And most systems are secure enough for most casual hacks. But it’s an investment worth the time if you plan on making something available to the internet.

O have a very similar setup but have a couple of questions if you don’t mind me asking, what did you used for OAuth? and where is it running? I tried athelia on the VPS but had some problems I can’t remember now and decided it wasn’t worth the time at the time, but probably should set it up.

I’ll try to ELI5, if there’s something you don’t understand ask me.

Op has a home server where he’s running immich, that’s only accessible when he’s at home via the IP, so something like http://192.168.0.3:3000/, so he installed Tailscale on that server. Tailscale is a VPN (Virtual Private Network) that allows you to connect to your stuff remotely, it’s a nice way to do it because it is P2P (peer-to-peer) which means that in theory only he can access that network, whereas if he were using one of the many VPNs people use for other reasons, other people on the same VPN could access his server.

Ok, so now he can access his immich instance away from home, all he has to do is connect to the VPN on his phone or laptop and he’ll be able to access it with something like http://my_server:3000 since Tailscale adds a DNS (Domain Name System) which resolves the hostnames to whatever IP they have on the Tailscale network.

But if you want to give your family access it’s hard to explain to them that they need to connect to this VPN, so he rented a VPS (Virtual Private Server) on some company like DigitalOcean or Vultr and connected that machine to the Tailscale network. He probably also got a domain name from somewhere like namecheap, and pointed that domain name to his VPS. Só now he can access his VPS by using ssh user@myserver.com. Now all he needs to do is have something on the VPS which redirects everything that comes to a certain address into the Tailscale machine, Caddy is a nice way to do this, but the more traditional approach is ngnix, so if he puts Caddy on that VPS a config like this:

immich.myserver.com {
    handle {
        reverse_proxy my_server.tailscale.network.name:3000
    }
}

Then any requests that come to https://immich.myserver.com/ will get redirected to the home server via Tailscale.

It is a really nice setup, plus OP also added authentication and some other stuff to make it a bit more secure against attacks directly on immich.

It’s not required, but probably OP has a home server with Immich and a VPS which exposes it to the internet. In that setup you need Tailscale for the VPS to access your home server. Sometimes you can’t directly expose your home server for different reasons, e.g. ISP doesn’t give you an external IP directly (I’ve had this, where my router would get a 10.x IP so I couldn’t port forward because the internet IP was being shared between multiple houses), or the ISP gives you a dynamic IP so there’s no guarantee that your IP won’t change next time you reset the router, etc.

Also it provides an extra layer of separation, so for example a DDOS would hit the VPS which probably has automatic countermeasures, and even if someone were to gain access to the VPS they still need an extra jump to get to the home server (obviously if they exploit something on immich they would get direct access to the home server).

Thanks, this looks awesome, last one I tried was tandoor but didn’t really liked it, the import/export capabilities of this one make it a lot more interesting for me, to ensure I can recover the recipes or build them into markdown files if I ever want to migrate away from it.

In that sense it is a bit of scripting, it’s a templating language similar to Jinja, so you put things you want to display between {{ }}, for example {{name}} will get rendered as the content of the name variable. [[ ]] is the way Silverbullet habgles links, so [[Something]] is a link to the file Something.md, so [[ {{ name }} ]] is a link to the file with the name from the variable.

Also that’s because I wanted a custom view, a very similar thing could be done with:

\```query
recipe
\```

BTW, you can have a table of contents on Silverbullet by just putting a block named toc, i.e. ```toc and closing it on the next line.

No scripting involved in the above example though.

Let me give you an example, I have a page with this:

 ```template
 | Name | Keywords |
 |-----------|-----------------|
 {{#each {recipe}}}
 | [[{{name}}]] | {{keywords}} |
 {{/each}}
\ ```

Then each recipe page has a header, so for example if I have a file named Recipes/Steak.md with the content:

---
tags: recipe
keywords: beef easy
---

# Ingredients 

Yadda yadda yadda...

So that table gets populated with all of the recipes wherever they are and I can add other columns or info there. It’s very neat and customizable.

Silverbullet is open source and has a very simple architecture with slightly extended markdown files which are easy to sync using whatever you use for syncing files. Plus it syncs files locally and allows you to edit offline and sync later (with a basic sync conflict resolution to avoid losing changes) and a very cool feature is that it allows you to write your own scripts to get whatever feature you want.