Threat models. I’m not going to care about an attacker both exploiting a niche app via a malformed file and also finding a 0day in the flatpak sandbox (which will be receiving continual updates). If someone can whip both of those up, while also predicting that I will open this file, or somehow feeding it to me, they are well resourced enough that it would take way, way more effort than just updating to stop them.
Flatpak sandbox is more than enough to protect the average user against an app that is no longer receiving updates.
An offline app, running unprivileged in a flatpak sandbox is the last the you should be worrying about.
Offline apps are only concerning when they give the opportunity to pivot, such as SUID apps which would let someone escalate to root.
While code execution via say, a file that is parsed incorrectly is interesting, it would be mitigated by the flatpak sandbox.
The trick is to get wordpress from debian’s repos itself. That way your wordpress is managed by debian and receives automatic security updates.
It has the “recommended” add on badge on the extension page.
ssh is probably fine for 99% of things. I use ssh exclusively mostly
The features I load cockpit up for is:
netplan try from the netplan configuration framework.)Cockpit also offers a GUI for managing virtual machines (via libvirt) or podman contaniers. So someone else might want that, although I don’t really use that. (virtual machines can be managed remotely via virt-manager over ssh by connecting to qemu+ssh://user@remote-host/system, I manage podman via the terminal).
I use cockpit, but via the client. They have a flatpak client that gives you cockpit’s features, connects over ssh (and reuses your ssh config), and doesn’t require anything to be installed on the host/server you are managing (besides ssh ofc).
Flatpak repackages binary releases as well, but only for proprietary apps (that don’t ship the source code).
Raven relicensed to gpvl3 now.
It’s really new.
It’s by the creator of Bottles btw.
I like Authentik, as I really like:
But at the same time, Authentik is very, very complex.
If you just want LDAP and OIDC in the same app, I would probably recommend KanIDM. KanIDM also does invites (although only one user at a time).
If you just want OIDC itself, pocket ID (passwordless /passkey only) and void auth both are really simple OIDC providers (that also support sign ups/invite links. EDIT: Ah, it looks like Void Auth has an experimental read only LDAP server feature. Nice.
I am also paying attention to (some less popular options):
deleted by creator
I only wish it had mock-LDAP so I could use it with things that don’t do OIDC like OpnSense
KanIDM is probably the simplest auth server that does both OIDC and LDAP in one app. Although Kanidm’s LDAP is read only.
Hmmm, games / game servers are a bit different since, they are rarely ARM and mostly x86.
You can use tools like muvm or fex to run the x86 version of wine, and then use that to run game servers: https://docs.fedoraproject.org/en-US/fedora-asahi-remix/x86-support/
People have been able to game on the M1 since it has hardware acceleration, although I never gamed.
When I had Asahi, I just used it as a daily driver laptop. It worked perfectly fine for all of the stuff I wanted to do on my M1.
For a server, it will probably work fine as well. You have to ensure that say, the apps/docker containers you use support ARM, but ARM is fairly popular and well supported nowadays.
I did have one issue with podman, where apparently the memory is organized differently on the M1, which causes some docker containers, even if they are built for ARM, to be incompatible. I had to use podman machine, which is podman’s built in virtual machine that lets you run containers in their instead. It is designed for Mac OS, which is kind of ironic since the whole point of using Linux was that I wouldn’t have to run a virtual machine just to run podman/docker containers.
You might be interested in: https://github.com/project-copacetic/copacetic
No, you can install Incus on any linux distro. I use it on a Debian server.
It’s IncusOS that is immutable.
But proxmox is actually just a set of packages on top of debian, and proxmox is not immutable either. You aren’s supposed to tinker with the host, but if you are doing things like jailbreaking consuner gpu’s to unlock the server gpu only features, then it becomes nice to have that option.
To be clear here, OP is mentioning that certain apps they are using no longer receive updates. Updating these apps are not an option. I’m not telling people not to update.
But I also think that telling people not to use apps that are no longer receiving updates is unreasonable, especially if those apps don’t touch the network and are confined within the flatpak sandbox.