Migrating from iOS to Graphene -- what to do about photos?

DeletedUser87

missing-root oh boy, here we go:

Dont host Nextcloud, that is not easy

That's nonsense. We don't live in 2010 anymore where you need to sit for 2 hours in /etc and /var/www and download 30 php modules, we have nice All-in-One solutions via docker.

Maybe it is if you are in the USA where everyone just has a static IP.

You don't need a static IP. I run my stuff on a dynamic residential IP without any issues. Sure, when it changes it takes like 10 minutes for the TTLs to run out, but I can live with that downtime. Setting up a duckdns script takes literally 20 seconds.

Just get a phone with enough storage. What does she need a cloud for?

Redundancy? Backups? Shareability? Centralized photo management? There's more than enough reasons.

The rest is debatable, depends on the user, needs and threat model. I personally would still recommend Private space over work profile (although I use both for different purposes).

missing-root

DeletedUser87

I will need to give this a try.

so duckdns and TTL is the key here?

I use Nextclound and am pretty happy with it, but I dont use it on the phone.

Apart from shareability, you can have all the benefits with Syncthing

And selfhosting on a VPS makes no sense for privacy, if you dont use at least LUKS, as the data can be read by the provider. Cryptreboot is essential here and memory is still not your own.

DeletedUser87

r134a ~~Tailscale is a subscription based service though, right?~~ I have just set up a Wireguard instance and use that. I think the only upside of Tailscale would be that you don't need to open a port?

Edit: nvm, I'm a dumbass who can't operate buttons on a website.

r134a

DeletedUser87 No it's completely free for personal use. And indeed u don't need to open any ports, but u may want to for example if u want to stream 4k video from jellyfin, so it can make a direct connection.

U can ofcourse then with firewall rules assign that port only to your jellyfin instance.
I live in a country where i have a dynamic ip, and i can trigger a ip change, which i actually do each 3 hours. So i don't care that much about that open port, but ideally no open ports would be the best.

r134a

DeletedUser87 also another benefit is that u can assign a dns server to tailscale aswell. I have 2 piholes one for home one on i assigned to tailscale. All my domains are for example: nextcloud.home, youtube.home, tar1090.home etc... on my home dns nextcloud.home points to local ip 192.168.x.x & my tailscale dns nextcloud.home points at its tailscale ip. So there's no domain needed, which i prefer.
Because i'm sure hosting 20 services, there are vulnerabilities present, and prefer them not directly accesible through the internet

DeletedUser564

missing-root easy FOSS apps:

Nice apps selection. I use many of them on my device.

missing-root

DeletedUser564

Those are (only) not apps I use but that I would recommend for people wanting something easy, with big downsides.

For example the florisboard internal keyboard is a very important security feature

DeletedUser87

r134a reasonable. Some of my services are also hiding behind my NAT. Some I need publicly accessible though, mostly for file sharing and collaboration reasons. My trust relies mostly on a good update strategy, 2FA wherever possible and Fail2Ban. I'm also thinking about implementing a network monitor somehow. But that's a project for another day.

r134a

I think u can also share and revoke specific services from your tailscale network to other tailscale users, so you could still share files with others & collaborations etc. but it's a little hassle as they need to install tailscale first then and create an account...So it's not that convenient.

I also use the same strategy with the addition of blocking all network acces by default. For example on my nextcloud instance, all incoming & outgoing traffic is blocked. Only 1 port from 1 ip is allowed from ingoing traffic from my reverse proxy. On my reverse proxy same everything blocked by default in&out. Only allowed 1 port out to nextcloud and in my specific tailscale ip & my pc and laptop fixed ip's on my home network.

Edit, only when i update the host or nextcloud itself i allow outgoing network traffic, till the updates are finished then i revoke again.

DeletedUser87

r134a install tailscale first

Yeah... that's not gonna happen hahaha. Seems like you have a pretty thorough understanding of your setup.
I'm trying to balance usability and security here like a juggler xD

DeletedUser87

missing-root duckdns is the most precious tool in my setup. I created an account and installed the script. Then I set a CNAME record to point my duckdns domain to my root/@ and it fetches A records perfectly. Adjusting TTLs is a no brainer, set the TTL to like 300 (seconds) and it will fetch new records constantly, just in case the IP changes.
Regarding Nextcloud, it has turned into bloated s***. I only really use it for uploading my weekly Molly backups and to sync contacts, calendar and reminders via DAVx5. The app is slow, feels outdated and is generally buggy. I don't know how they're able to sell that to enterprise customers; they must really have no standards at all.
Immich has a lot of benefits compared to Syncthing. The best of which is the centralization. I can use the phone app, I can also use any browser to manage my files. I can share folders (which I do, for example pictures from a recent birthday party) with others who don't know me personally and I can also use Immich as my gallery to manage photos on device. Meaning, it deletes photos from the device and from the cloud. Or just from the device and leaves them in the cloud. Or delete them from the cloud and leave them on device, you get the idea. The search is also getting really good. It's powered by a local AI and can search for almost anything.
The main problem with all the FOSS gallery apps out there, is that they suck for the most part. Immich is like a Google Photos clone in most aspects which has saved my sanity.

r134a

DeletedUser87 i like to pretend i have a thorough understanding, however the more i learn, the more i realize i'm still a noob :(.

manugraph

DeletedUser87 I can share folders (which I do, for example pictures from a recent birthday party) with others who don't know me personally and I can also use Immich as my gallery to manage photos on device

How do you open Immich to the web when you're actually using all other services via VPN?

I've thought about this already but am a bit unsure if I should really open ports to the Immich container. Rest of my services lies behind Wireguard and the currently only open VPN port on my Router.

r134a

I might look into immich aswell, as nextcloud android app is indeed becoming sh*t. A recent update enabled 2-way sync by default and 2-way synced all your files on your server to your phone in a constant loop lol. I have like 4tb and luckily became aware relatively quickly as my phone almost burned a hole in my pants. I went over 15gb of my monthly data plan and had to pay accordingly :(

https://github.com/nextcloud/android/issues/13738

DeletedUser87

r134a https://github.com/nextcloud/android/issues/13738

Geez, I didn't even know that... Now I feel lucky. Just two months ago I wanted to offload most of my data (like 300 gigs) to Nextcloud. It was too buggy on the desktop, so I said "screw it". Dodged a bullet right there, I guess.
And yeah, I can't praise Immich enough. The development is very active (thank you, FUTO) and it seems to constantly get better.

lcalamar

tilion_silverbow
Your best and easiest solution would be to migrate to Ente - then whatever 'platform' you are using becomes moot... besides - it is a great product.

perhaps you can dumb-down your Proton account - to save the $$$ needed for Ente photos... also watch for a black friday deal - they had a great one last year.

Don't attempt to compare protondrive to any other photo app (ente, apple, google) - it just isn't in the same category. At least with Ente you partner won't be adding ANY inconvenience/friction in her life...

outside that if you try to go with a 'free' solution - then you are going to get that lack of features and added friction... I'd say find a way to pony up to Ente

lcalamar

lcalamar Ente IS having a really strong Black Friday Sale:

https://ente.io/blackfriday/

DeletedUser235

tilion_silverbow

Anyway, she can already jump to GrapheneOS and figure this out later. Don't do everything at once.
If you can't afford paying another subscription and don't want to use Proton, then the only option I see is a 3-2-1 local backup strategy. Store to a computer, which is backed up somewhere (hard disk, cloud). Or Syncthing, but I don't know if it will be frictionless. Or self hosting, but damn, lazyness -_-

For now, stay with Google Photos on GrapheneOS and migrate when you find a solution !

lcalamar dumb-down your Proton account - to save the $$$ needed for Ente photos

This is what I would do. Honestly ente is very worth the price. If you do it tell me and I give you a code to have 10Gb more for free.
Can't you use a cheaper VPN (Windscribe on sales or with Build a plan), live without drive, use Bitwarden free and Addy Lite or free and use Mail and Calendar free or Mail+ ?

DeletedUser87

manugraph I never said I use all other services via VPN. The VPN is for the services that I won't expose like NGINX Proxy Manager, SSH, etc. Immich runs in the open wild, I just have to trust the devs on this one.

lcalamar

DeletedUser235 Yes - this exactly - I have a minimal 'plan' with Proton. There are really no other 'features' that Proton offers that can't be got for free or close to free - that work better.

I'd start by not paying for VPN... unless you are using it to access your home network when external - VPN is mostly a waste of money and a lot of hassle (banks, streaming, etc...) I do use my 1 connection of ProtonVPN that comes free - and that suffices just fine, but I rarely use it.

VPN really doesn't provide any privacy protection anyway

DeletedUser69

lcalamar your last statement is not accurate and it shouldn't be presented as a general advice. VPN can provide a data privacy layer from your ISP, disable services from tracking users based on their IP and to access geo-fenced content to name a few. Many find this of value.

« Previous Page Next Page »