Haha. Might have slightly exaggerated. But only slightly.

The Proxmox host in question has a 1Gbit connection to the NAS. (Unfortunately. The other hosts don’t have a GPU, but SPF+… Oh well, can’t have everything.)

At some point in the last couple of months, it must have been damaged, and negotiated down to only 100Mbit. This must roughly have coincided with the Jellyfin 10.11 update, since I remember thinking that it must be the cause, due to close proximity of update and first issues.

Anyways. For basically everything in my library, 100Mbit is fine. Streaming an episode NAS->Jellyfin and Jellyfin->TV at the same time basically never saturates the link.

BUT, from what I’ve gathered by digging through Jellyfin issues and PRs, there’s a separate issue where Jellyfin will pull the episode, and if you need subtitles extracted from the episode file server-side (to transcode them in, if the clients can’t play them), it will at the same time pull the episode AGAIN, and together with the Jellyfin->TV direction, that’s frequently enough that it saturates the link.

Symptoms is (was) either a 20-30s wait before the episode would start playing, or complete freeze.

However, I believe this particular issues has been solved for a while. I’m not sure, because I instead opted for the Subtitles Extractor Plugin, which runs nightly and pre-fetches all the subtitles and stores them on the Jellyfin VM itself.

Where it was still noticeable though was if one of [Library Scan/Trick-play Extraction/Subtitle Extraction/Media Segment Scan] ran while playing an episode, the server would completely lock up.

Long story short: cable swapped, 1Gbit, all issues gone.

Sorry, but why not just fetch a single media file with multiple languages?

Domain + reverse proxy. The security issues some people here claim are significantly overblown.

Can’t speak to that, I’m not involved. All I know is that,

• Jellyfin server gets significant upgrades in subtitle capabilities and performance,
• Jellyfin AdroidTV just released an RC that finally includes direct play for ASS/SSA subtitles,
• and on Monday, I FINALLY resolved a hardware issue (faulty cable) that made my Jellyfin almost unusable whenever ASS/SSA needed to be played (and only in that situation. Fun!)

So yeah, I don’t know or really care about leadership change, I just know it’s gonna run like a rocket now 😄

Now THAT is a changelog.

Really excited about the query performance improvements, and the improvements to subtitle handling.

Yeah. Honestly it might be a good idea to start a community project that’s a “nix2everyDistro”, and then go around and open PRs on FOSS projects to wire their project up to build in nix + output “every distro”

Yes

1. Signal
2. XMPP
3. Matrix

In that order. I self-host both XMPP and Matrix, and I wouldn’t want to stop using matrix. Spaces, arbitrary amounts of self-chats, and so on are great. I use matrix every day.

But for chatting… It sooner or later fails you. It’s slow. Notifications break. Messages are shown as sent, but somehow do not appear in the recipient’s devices until TWO WEEKS LATER (yeah IDK, happened twice already, in different chats and directions. Best part is, I’m not even federated!). Encryption is great IF YOU KNOW SOME CRYPTOGRAPHY BASICS, and utterly confusing otherwise.

XMPP just works. Especially the calls, holy shit, I had to fight Matrix for so long to make voice and video calls work, and xmpp just… Works. Notifications are way more reliable (as in, have been absolutely perfect). I really like monocles as a chat app on Android. (The downside is: can’t decrypt old messages on new devices, and desktop clients are ugly.)

So why Signal above XMPP?

Because it’s not your fault should something ever break in a vital service. Also the encryption and privacy afforded by it a great.

That is actually a really interesting approach to moderation, huh.

Lol, exact same situation here.

Quick question, did the migration to continuwuity break calls for you as well?

Grew up on it. My dad set up a Ubuntu 4.10 PC for my brother and I when we were 3/5 (no internet, obv), and it stuck.

Used Windows for a brief time in highschool to be able to play online with friends.

Went right back to Linux when going to university. Will never change back, both for ideological reasons and because Linux is just better.

Next step: NixOS on a phone

TBH, it sounds like you have nothing to worry about then! Open ports aren’t really an issue in-and-on itself, they are problematic because the software listening on them might be vulnerable, and the (standard-) ports can provide knowledge about the nature pf the application, making it easier to target specific software with an exploit.

Since a bot has no way of finding out what services you are running, they could only attack caddy - which I’d put down as a negligible danger.

My ISP blocks incoming data to common ports unless you get a business account.

Oof, sorry, that sucks. I think you could still go the route I described though: For your domain example.com and example service myservice, listen on port :12345 and drop everything that isn’t requesting myservice.example.com:12345. Then forward the matching requests to your service’s actual port, e.g. 23456, which is closed to the internet.

Edit: and just to clarify, for service otherservice, you do not need to open a second port; stick with the one, but in addition to myservice.example.com:12345, also accept requests for otherservice.example.com:12345, but proxy that to the (again, closed-to-the-internet) port :34567.

The advantage here is that bots cannot guess from your ports what software you are running, and since caddy (or any of the mature reverse proxies) can be expected to be reasonably secure, I would not worry about bots being able to exploit the reverse proxy’s port. Bots also no longer have a direct line of communication to your services. In short, the routine of “let’s scan ports; ah, port x is open indicating use of service y; try automated exploit z” gets prevented.

I am scratching my head here: why open up ports at all? It it just to avoid having to pay for a domain? The usual way to go about this is to only proxy 443 traffic to the intended host/vm/port based on the (sub) domain, and just drop everything else, including requests on 443 that do not match your subdomains.

Granted, there are some services actually requiring open ports, but the majority don’t (and you mention a webserver, where we’re definitely back to: why open anything beyond 443?).

Client side, under advanced:

That’s a setting

Alright, thanks for the info, that’s good to know. Trying to make the jump becomes more enticing every day.

Thanks for sharing! Sounds about as good/bad as I was expecting. How’s the browser experience? Also, are there any features/tweaks you are aware of that you could not get through Nix, that the more “commercial” Linux device manufacturers have developed for their devices?

Holy crap! A NixOS-on-phone user in the wild! You are rocking my dream setup. How’s your experience been with it? Is it remotely daily drivable for phone things?