A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
No trolling.
Resources:
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
Decryption is not related to root permission.
If the ENCRYPTED drive is mounted to the container, then the container can decrypt it.
If the DECRYPTED drive is mounted to the container, then the container never knows it was encrypted in the first place.
Second case is easier BTW. Just mount the drive on your host, type in the encryption password and you get a new, unencrypted drive. Specify this new drive in your docker compose/docker file.
Oh sorry seems i explained it poorly.
That encrypted drive drive is set to automount on boot since I added it to /etc/fstatb and /etc/crypttab.
This makes things easier. Thank you for clarifying.
That encrypted drive drive is set to automount on boot…
This makes things easier.…
But weakens your security posture. If you’re worried enough to encrypt the drive, you shouldn’t be auto mounting it.
If you’re worried enough to encrypt the drive, you shouldn’t be auto mounting it.
This really depends on your threat model. If you are only concerned about the drive getting stolen, or wanting to keep the data on it private if you need to RMA the drive, mounting it automatically on boot with a key stored on the rootfs can be perfectly fine. If you are a journalist in a hostile country and protecting your sources from state level actors is a matter of life and death, then yeah, this would be woefully insufficient.
Yes. But the main ssd where the OS is installed is also encrypted with different password. So you must first unlock the ssd anyway to automount the hdd.
The drive will be mounted by the host and you can use that to also decrypt it. This way Jellyfin in the docker container doesn’t know that the media is stored on an encrypted hard drive.
And if I make docker compose file for jellyfin and specify that path to encrypted hdd example( /media/user/sda1/jellyfin-media) will it be able to read that media?
I’m not 100% on the paths regarding the mounts and where the containing files are accessible, but it looks correct to at the moment. One way to test this is to check if the user you are using to run the Jellyfin container is able to access the files without additional input/steps.
If your user can access it, then Jellyfin will be able to do that as well as soon as you have mounted it in the container.
yes, i use this setup with linux and luks encrypted external usb hd