Author here! Indeed, it is mostly HTTPS terminated by Caddy in the server at home. Otherwise, it is SSH.

This is no longer true as of Podman 5 and Quadlet?

You can define rootless containers to run under systemd services as unprivileged users. You can use machinectl to login as said user and interact with systemctl.

Can you please link the docs for this?

This is a good intro [0], courtesy of Redhat.

This is a good example [1], cited elsewhere in this post.

Documentation for quadlet systemd units [2].

[0]: https://www.redhat.com/en/blog/quadlet-podman

[1]: https://mo8it.com/blog/quadlet/

[2]: https://docs.podman.io/en/latest/markdown/podman-systemd.uni...

You see, my issue with this is that it suggests using the quadlets with lingering users... Which is the same annoying case as with the article. It is not as with other systemd services that you just instruct systemd to take a temporary uid/gid and run the service with it.

Quadlet debuted with Podman 4.4 iirc.

Oh yes, correct!

To add a data point here, my Framework laptop is 3 years old and I have no plans to change the mainboard anytime soon.

Also, you don't change its motherboard, you change the mainboard (for my laptop, it's the CPU/integrated GPU + memory sockets); this is unlike changing the entire computer. Then, you can reuse the replaced mainboard as a server if you wish to.

This pales with my experience using a Macbook Air whose motherboard failed. I did have to replace the entire computer.

Care to share a link to the fermentation forum?

I would be interested in that as well! I've been kind of obsessed with fermentation for a couple of years now, but it's all based on research driven by my own interests (I learn best when I immerse myself in a subject, in Dutch we call this "autodidact"). It would be nice to read along with what others are doing!

Is it really brutal? Can you single out "nature" and its characteristics?

Brutal sounds like a value judgement, one that I suspect explains nothing about the fact.

Can we accept that it just is, and we're part of that, for all our vices and virtues?

Embrace nature and go live in the jungle without clothes, tools, fire, water, food, medicine. Calling it brutal after such an experience wouldn’t be dismissed as a value judgement.

A bit like PESOS (Publish elsewhere, syndicate own site). I do this when archiving my Mastodon posts in my own static site [0].

[0]: https://garrido.io/notes/archiving-and-syndicating-mastodon-...

PESOS is pretty good. I was aware of POSSE but not PESOS.

That is what I ended up doing, I wrote a blog post about it some months ago [0].

The gist of it is using private dns and exposing services only on the private network. Implementation details can vary, you decide whether to use tailscale or bare wireguard, and any reverse proxy and dns server will do. In my case, I use Tailscale, NextDNS, and Caddy.

[0]: https://garrido.io/notes/tailscale-nextdns-custom-domains/

If you don't, can you expand on how you're doing this? Is it simply backing up the Thunderbird profile?

I rsync the files in the directory that I specified Thunderbird should store all the folders and associated data. I restore it any time I rebuild my OS, also with rsync. That backup goes to a NAS which then gets backed up to multiple external SSD/NVME and one of those goes in my vehicle as a low-effort off-site backup.

Every case is different but as a baseline, you could use Ubuntu or Debian for automatic security upgrades via unattended-upgrades[0], harden ssh by allowing only pubkey authentication, disallow all public incoming connections in the firewall except for https traffic if you're serving a public service, everything else (ssh, etc) can go over wireguard (tailscale makes this easy). Use a webserver like nginx or caddy for tls termination, serving static assets, and proxying requests to an application listening on localhost or wireguard.

[0]: https://wiki.debian.org/UnattendedUpgrades

Fedora has worked flawlessly for me.

After years on Ubuntu, then Arch I also just recently discovered Fedora as a well polished alternative.

I do love the Arch community. But I feel less motivation to tinker nowdays and Fedora was a pretty nice works out of the box experience so far.

I set up Fedora for family but I still use Arch myself, because there is no good alternative to AUR on Fedora and there are more packages that I need for software development.

Sometimes Arch saves so much time, that even the infrequent necessary manual maintenance after updates makes it worth it.

And even when trying to run stuff on distros other than Arch, I frequently look up instruction on Arch Wiki and in AUR PKGBUILDs.

I'm using Nix package manager on Fedora and it's OK.

As I founnd out myself, there is almost no tinkering involved once you get the initial Arch setup done. Just update once a week. Fedora repos have considerably fewer packages than Arch or Debian. For some reason Redhat land has always been off putting for me. SELinux, dropping docker in favor of podman, CentOS debacle are just a few things that make me look elsewhere. I'm glad you found your sweetspot though. Just a friendly banter from a fellow Linux user.

Fedora was almost required on AMD framework for a while, because hardware was brand new and Debians were too old. Now with Mint updated, I'd recommend take Fedora or Mint and Cinnamon.

Beware, I just realized my AMD does not support S3 sleep. Too late to return.

Mint was the worst experience for me. The trackpad acceleration curves are bad and there's no easy configuration for it. I was willing to either toy with sliders or copy an already tuned config into a file. But the best I found was how to go into a config file and disable the acceleration entirely.