Pihole -> Great use for a network wide adblocker/DHCP server.
Wireguard VPN -> In combination with a DDNS setup and some port forwarding enables the use of a global private VPN. I think it's a prerequisite for a decent home-automation setup.
DNSCryptProxy -> Great for ensuring all DNS requests on the network via DNS over HTTPS. Kind of useful because frankly ISPs are sniffing DNS traffic. Also useful for bypassing DNS based ISP filters.
The above basically enabled me to create a 5 country wide private VPN by giving VPNs to family members. It enables me to print/scan things from abroad, access CPU resources/servers/GPUs/Webcams/automation and obviously browse as if I am in another place.
My family when they are abroad, can now work as if they aren't.
It also saves power (reducing analytics traffic), improves privacy and takes about a weekend to setup.
They also make great personal gifts too.
A lot of my stuff is ad-hoc from my personal exploration and experience on Linux.
In regards to the wireguard specific stuff, this isn't a bad guide.
https://mikkel.hoegh.org/2019/11/01/home-vpn-server-wireguar...
The harder part with the VPN stuff is the following.
1) Setting up a clear route of forwarding traffic to the pihole. To do so, you would need to setup netplan/systemd-networkd so your pi gets a static private IP. (Not that easy if you are doing a full ipv6 route too.)
2) Setup a DDNS mechanism (as you most likely are getting a dynamic IP). My suggestion for this was to get a domain name (8 quid a year) and use cloudflare as a DDNS host. You also need to punch a UDP port through your router to forward to your pi.
3) Then setup the rest of the wireguard stuff.
4) Setup the pihole and ensure all interfaces are covered so your VPN has a DNS server.
Part 2 is the hardest bit as I kind of needed some custom scripting to ensure cloudflare had working routes to my networks. e.g. https://gist.github.com/Kedstar99/2d8ab0e9bec3a5629562b4ab01...
The above script obviously running as a systemd service that restarts automatically.
Obviously you can use something else like noip or some other DDNS solution.
https://www.freedesktop.org/software/systemd/man/systemd.net...
Then choose your firewall of choice to setup NAT and forwarding. I used firewalld, but not sure I'd recommend it. It's just the first solution I got working.
Once you have the base OS ready to go, it will take you less than 30 minutes if you know how to muck with your DHCP/firewall settings in your router.
https://github.com/pi-hole/pi-hole/#one-step-automated-insta...
Install Pi-Hole, then edit your DHCP server to hand out the Pi-Hole as the DNS server.
After installing Pi-hole, install this. Choose Wireguard, not OpenVPN. port-forward the Wireguard UDP port to your VPN server. use the "pivpn" command to create client configs and the "qr" subcommand to scan the config into your phone.
The community around WG has gotten much easier for noobs to get into, and the porcelain around the tool itself has made it quite easy to use, IMO.
By specifying the namespace in a systemd service file, I can let a service use a specific VPN.
Pihole pretty much installs itself (it even has a pre-made image). WireGuard will take reading, testing and failing.
I recommend doing these things one thing at a time, and doing the Pihole first.
If you're using PiHole, you can just use cloudflared to do DoH. https://docs.pi-hole.net/guides/dns/cloudflared/
On a different note, biggest reason I've never installed a VPN at home is because I just prefer a deny-everything home network and worry I'll misconfigure something and cause a security issue.
It also picks from 140 or so anonymous DoH relays, with specifics for nologs and dnscrypt support.
Why would I go for just 1 arbitrary provider rather than the lowest latency choice out of 140?
I also think the latter point is a bit overblown. So long as you keep your kernel updated and you only expose a single high UDP port, it should all be fine. I have ufw enabled on each pi, along with various logging mechanisms in place to see if things seem reasonable. That and 2fa for actual ssh access.
Because a ISP that can compromise any one of those 140 different single points of failure can now make that one have the lowest latency and give you malicious DNS results just like you never secured anything.
This is the same problem as allowing 140 different CAs to issue certificates for subdomains of com, rather than forcing the fucking registry to do it when you get a domain name in the first place.
>minisign_key is a public key, used to verify that the content is legitimate. Lists can thus be served from any location, even from an untrusted ISP: dnscrypt-proxy will immediately detect and reject something that has been tampered with.
>https://dnscrypt.info/stamps-specifications/ >https://dnscrypt.info/faq
An ISP will not be able to spoof the sources or these stamps. They wouldn't put the effort in. Even if they did, it is factored and thought about.
More harmful would be a malicious DoH relay but I trust the devs.That I think is fixed by mandating the use of DNSSec too for my relays.
OTOH, I'm beginning to migrate to pfsense and pfblockerng at home. So, it is possible that I may retire my pi-hole at some point. Currently I'm running both as I transition and test.
The added benefit is that I can force all devices to use PiHole while connected to Tailscale and have DNS-adblocking on the go!
I find it super useful!
Even if just for remoting into various boxes; the kids for instance often tether their PCs off their phones or I'm tethered and want to remote to my LAN.
(I have terrible internet)
I run pihole with 256MB version(which is $1 less) for two years fanlessly, and this includes enclosure too, load the software and hook it to my wireless router's ethernet port and just forgot about it.
What I've heard is a crashing Pi is usually due to sagging voltage on an inadequate power supply, and that's probably even more an issue on the more demanding/powerful Pi4. On my cameras I just use the wall warts adafruit sells for the Pi, and haven't had any power problems.
As far as the SD card goes you can boot off an external hard drive or SSD via USB and that should guarantee longevity.
My biggest problem with headless Pis was that they would randomly disconnect from the wifi network and disappear, turning off power saving on wifi didn't solve it. In the end the real solution ended up being to just create a 2.4ghz-only network and connect them to that. Somehow they just don't play well with networks that have the same SSID for 2.4 and 5ghz on my Ubiquiti gear.
This is anecdata from my part, but I’ve got eight or 10 Pis running (Flightaware/ADSBexchange, PiHole/Influx/Grafana/Wireguard, a couple of Octoprint, Home Assistant - with a relay HAT for triggering dampers, Showmewebcam, and a handful of other things). Once I switched to good power supplies and good SDHC cards, my problems went away. My most heavily loaded machine is the PiHole machine which also has influx running and writing to the SDHC card - it’s probably a ticking time bomb, but it’ll celebrate it’s fourth birthday on the same card in two months.
My Pi 4 running 2 instances of Octoprint kept crashing until I switched to their official power supply. On previous models I always got away with whatever power supply I had around but the 4 doesn't play around when it comes to power consumption.
I've got a web server, a SAN, a couple pi-holes, and a home automation controller. I plan to spin out my databases and Prometheus onto their own Raspberry Pi's. All of them are configured using Ansible. I can recreate one in a hurry if it dies and data backed up to a ZFS partition on the SAN pi. I have a couple additional Raspberry Pi's that I temporarily hook up to the network and run a script to sync the latest ZFS snapshots over for backup purposes.
I'm sure you could find SOME use for them :)
Nextcloud is an absolute dog. Even on a server with loads of power and an SSD-based database over a local connection with all the caching options turned on… it’s still not snappy. I wish we had better FOSS options in this space.
I loved Pydio but it was simply too slow.
Friday I was trying to figure out if I could remotely read realtime usage off my power meter. I've tried using a SDR for it but it uses some proprietary frequency hopping system that is difficult to understand and I don't have enough domain knowledge to reliably implement. But it had a debug port on it with what looked like an IR transmitter in it, and some reading online indicated that it might be flashing at a rate that indicates usage. It was too weak (and it was too bright outside) to see it with my phone, so I decided ot just try it out.
30 minutes later I had a Raspi with a IR receiver and lirc and I could confirm that it was pulsing at a rate of 1 pulse per watt-hour (1000 pulses per kWh).
The actual reader implementation I will probably do on esp32 because Raspi is overkill for this, it just needs to read the pulses and broadcast messages to MQTT, and I'll 3D print an enclosure so it's not just taped to the side of the meter. But the Raspi made it really easy to just try this idea out without making any commitments to it. That alone is worth keeping a few around.
I also checked the local municipal code (my utility is city-owned) and there doesn't seem to be anything in the code that says I can't do it.
That said, I intend to put a notice next to it that says something along the lines of "This is a non-contact measuring device that counts IR pulses. Please call XXX with any questions."
I basically deployed a nodejs app and configured FullPageOS to load that local page. The clock itself is just HTML and JavaScript (jQuery, bootstrap, moment.js) - there is no servers side code beyond basically the "connect+serve-static to server the index.html file.
Oh, and it plays the comet from Star Trek Deep Space Nine's Title Credits on the hour in the background.
For a temporary workaround I set up a VPN endpoint on a VPS and configured a disused Pi3 to route through to the VPN endpoint, then turned it into an AP and had everybody connect through the Pi instead. It bypassed the breakage for the day so I could leave the connection off overnight to force my ISP to reallocate that IP.
It is this kind of Swiss Army Knife type job where the Pi is a perfect solution.
Other commentators mentioned pihole/DNS, WireGuard, and music streaming, but you can also use them for a (slow) NFS server, persistent Syncthing node, Maestral host[1] (third-party Dropbox client written in Python (that can actually run on the Raspberry Pi, unlike the official Dropbox client)), or device that maintains a connection to a distributed network (e.g. Hyporborea/cjdns).
- The obligatory PiHole.
- An ssh server, which I use to access my internal network.
- A script that scrapes a website daily.
- A database to support a web development project.
- A web server to support a web development project.
- An NFS server, for data backups.
While it is probably underpowered to serve the needs of some people, it serves my needs. Since I don't fiddle around with it very much, it has proven to be very reliable.
What language, frameworks, modules and how do you store and present it?
Another use was running HomeAssistant, but I migrated that to my real server.
Another use is having an external InfluxDB + Grafana monitoring setup so I can view stats even if the server goes down.
Lastly, you can take X amount of raspberry pis and run a kubernetes cluster with k3s. [1]
Since I don't play with my cluster much, most of my pis just sit around gathering dust...
The second use-case I have is as an Octopi server to run my 3D printer. I have found this interface to be significantly more user friendly than uploading new designs to an SD card.
Each issue is full of projects with step-by-step instructions on creating the project.
Each issue of the magazine can be downloaded for free as a PDF (or alternatively purchased as a print magazine):
The MagPi Magazine: https://magpi.raspberrypi.com/issues
The other two pis are sitting in a project crate, ready to use if I ever find myself with extra free time again.
We mostly play SNES games but I sometimes play stuff from my childhood when they're not awake.
https://techcrunch.com/2021/09/21/raspberry-pi-gets-45m-to-m...
they are primarily funded by government, ngo's, and other foundations.
I can see the appeal.
But I have come to the sensible conclusion that an Intel NUC is far more useful, to me, as a general purpose computing device, media server, file server, linux dev box and occasional casual Minecraft gaming device for the kids!
Seemingly once I've specced up a RPI, they are not exactly super cheap at that point!
I also tell myself I'm supporting the manufacturer, though it would appear they don't need my help.