Set up a reverse tunnel to the outside box that you want to get in from.

For example, from the inside machine:

ssh outsidemachine -R 2222:localhost:22

Then on your outsidemachine:

ssh -p 2222 localhost

Maybe run top or something just to keep traffic going across so that firewalls don’t drop your connection.

For billing purposes, I’ve been using invoiceninja by adding the mileage rate as a line item and adding the number of miles for quantity. I haven’t been able to figure out a better way to do mileage on there.

I’m doing something similar except now I’m running out of space on my 1 TB volume. Now I need to upgrade and/or figure out a long term solution to convert to H265. Some of my files have file size differences on the scale of 400 MB vs 2 GB.

I’m using a raspberry pi 4 8 GB. It’s not a problem until someone transcodes, and that usually happens with H265 HEVC media when the person is on a browser that doesn’t support it which is most browsers these days. If the person is doing directplay (click the gear during play and click on Playback Info). If it’s forced to transcode, it will tell you why.

Direct-play in native resolution and codec should give you perfect performance and consume almost no resources since it’s essentially just a file transfer. I find performance works best when I use the Jellyfin Media Player app on my computer or the Android app.

If you can’t turn your secondary router into an AP, you can connect the LAN side of your secondary router to the main router so that they can be in a single network. also turn off any DHCP servers on there. Don’t connect the WAN. That’s the simplest fix.

I have fail2ban for SSH but I haven’t tuned it for nginx yet. I’ve worked with OSSEC which has a fork called Wazuh which I’ve been wanting to set up.

You’ll be fine. It’s exactly what I do. Just keep any exposed services up to date. NPM also has a very rudimentary blocker that mostly relies on UA and bad strings getting passed through. You can turn that on. Open up only services that need to be exposed e.g. don’t expose sonarr/radarr unless there’s a good reason for it. Make sure anything you expose that doesn’t have any sort of authentication can have it implemented in nginx or you can use an SSO solution.

I expose strictly needed services while everything else is just internal. Exposed services include jellyfin, jellyseer (jellyfin version of overseerr), and nextcloud.