Trying to set tight permissions on my future NAS.
The essential on what I have:
TrueNAS NFS storage <- mounted via NFS -> Proxmox VE Host <-> Debian 12 VM
That's all fine and so on.
My little Debian VM:

NAME   FSTYPE FSVER LABEL  UUID                                 FSAVAIL FSUSE% MOUNTPOINTS
sda
├─sda1 vfat   FAT32        A5D7-88E3                             505.1M     1% /boot/efi
└─sda2 ext4   1.0          3c43a477-51fd-425b-aee8-a6e75224f781   48.5G    16% /
sdb
└─sdb1 ext4   1.0   media  e3e0eac5-806a-44e9-a0e9-07fb99a18281  933.2G     0% /srv/dev-disk-by-uuid-e3e0eac5-806a-44e9-a0e9-07fb99a18281
sdc
└─sdc1 ext4   1.0   nas    0f3a3d74-901d-4243-b20b-59210c1cee18   46.4G     0% /srv/dev-disk-by-uuid-0f3a3d74-901d-4243-b20b-59210c1cee18
sdd
└─sdd1 ext4   1.0   backup fbe21b9f-2339-4223-ac7e-00e75374fc32   46.4G     0% /srv/dev-disk-by-uuid-fbe21b9f-2339-4223-ac7e-00e75374fc32
sr0

Background:

• media = media library for Jellyfin
• nas = small (future) file server for my PC running Windows
• backup = used to store backups of various services like Firewall backups with SFTP etc.

The storage on the debian VM will be mounted by a NUC running bare metal Debian due to hardware acceleration. The proxmox host is unable to do it due to it also being a NUC. But I like the flexibility I will soon have because I can just nuke my bare-metal NUC without loosing any data.

Anyway my real problem is with permissions on my media drive.
My permissions right now are as following:

1. /srv/dev-disk-by-uuid-e3e0eac5-806a-44e9-a0e9-07fb99a18281# ls -l media
drwxrwxr-x 3 nobody nogroup 4096 Oct 12 20:45 media

2. /srv/dev-disk-by-uuid-e3e0eac5-806a-44e9-a0e9-07fb99a18281/media# ls -l data
drwxrwsr-x+ 6 mediaU serviceG 4096 Oct 13 00:21 data

3. /srv/dev-disk-by-uuid-e3e0eac5-806a-44e9-a0e9-07fb99a18281/media/data# ls -l *
drwxrwsr-x+ 7 mediaU serviceG 4096 Oct 13 00:21 media
drwxrwsr-x+ 2 mediaU serviceG 4096 Oct 13 00:21 recycle_bin
drwxrwsr-x+ 2 mediaU serviceG 4096 Oct 13 00:21 torrents
drwxrwsr-x+ 2 mediaU serviceG 4096 Oct 13 00:21 usenet

4. /srv/dev-disk-by-uuid-e3e0eac5-806a-44e9-a0e9-07fb99a18281/media/data/media# ls -l *
drwxrwsr-x+ 2 mediaU serviceG 4096 Oct 13 00:21 anime
drwxrwsr-x+ 3 mediaU serviceG 4096 Oct 13 00:22 movie
drwxrwsr-x+ 2 mediaU serviceG 4096 Oct 13 00:21 music
drwxrwsr-x+ 2 mediaU serviceG 4096 Oct 13 00:21 soundtrack
drwxrwsr-x+ 2 mediaU serviceG 4096 Oct 13 00:21 tv

Current directory tree:

srv-dev-disk-by-uuid-XXX/
└── media
    └── data
        ├── media
        │   ├── anime
        │   ├── movie
        │   ├── music
        │   ├── soundtrack
        │   └── tv
        ├── recycle_bin
        ├── torrents
        └── usenet

What I am trying is:

• Docker host mounts /srv/dev-disk-by-uuid-e3e0eac5-806a-44e9-a0e9-07fb99a18281/media via NFS
• The docker containers should only be able to access the the data directory inside it (2. ls -l) as mediaU:serviceG
• In addition I wanna access, modify and move files with my windows user without being part of the service group. Because of this I have setup SGID and ACL on the /media/data/media folder. The ACL was set recursive as follows:

/srv/dev-disk-by-uuid-e3e0eac5-806a-44e9-a0e9-07fb99a18281/media/data# getfacl media/
# file: media/
# owner: mediaU
# group: serviceG
# flags: -s-
user::rwx
group::rwx
group:extUserG:rwx
mask::rwx
other::r-x
default:user::rwx
default:group::rwx
default:group:extUserG:rwx
default:mask::rwx
default:other::r-x

So far so good. mediaU:serviceG has RWX permissions (2775).
My user is part of the group extUserG also with 775 permission.

My issue and how I tested it under the root user executing commands via su:

• Works:
  root@NAS01:/srv/dev-disk-by-uuid-e3e0eac5-806a-44e9-a0e9-07fb99a18281/media/data# su mediaU -c 'mkdir dir-mediaU'
• Doesn't work:
  root@NAS01:/srv/dev-disk-by-uuid-e3e0eac5-806a-44e9-a0e9-07fb99a18281/media/data# su appoxo -c 'mkdir dir-extUserG' mkdir: cannot create directory ‘dir-extUserG’: Permission denied

BUT if I enter one level deeper inside the freshly created dir-mediaU folder I am able to create files with my personal account:

root@NAS01:/srv/dev-disk-by-uuid-e3e0eac5-806a-44e9-a0e9-07fb99a18281/media/data# cd dir-mediaU/
root@NAS01:/srv/dev-disk-by-uuid-e3e0eac5-806a-44e9-a0e9-07fb99a18281/media/data/dir-mediaU# su appoxo -c 'mkdir dir-extUserG'
root@NAS01:/srv/dev-disk-by-uuid-e3e0eac5-806a-44e9-a0e9-07fb99a18281/media/data/dir-mediaU# ls -l
total 4
drwxrwsr-x+ 2 appoxo serviceG 4096 Oct 13 00:45 dir-extUserG
root@NAS01:/srv/dev-disk-by-uuid-e3e0eac5-806a-44e9-a0e9-07fb99a18281/media/data/dir-mediaU# getfacl dir-extUserG/
# file: dir-extUserG/
# owner: appoxo
# group: serviceG
# flags: -s-
user::rwx
group::rwx
group:extUserG:rwx
mask::rwx
other::r-x
default:user::rwx
default:group::rwx
default:group:extUserG:rwx
default:mask::rwx
default:other::r-x  

So dear Lemmy Community:
Have I done something wrong in my setup or thinking? I have no problem as it is right now but I am sure it will be annoying to troubleshoot in the future so might as well fix it while still setting it up.

Thanks in advance for helping slowly escaping the windows world :)

Background

Hello fellow self-hosters and homelabbers, A few weeks ago I was able to fill my new NAS with the proper hardware I needed to expand on my earlier setup.
Due to the new capabilities I also wanted a fresh restart. But the more I think about doing one thing, the more I hit other road blocks amd think about doing Y.
So I wanted to ask how you would solve my goal.

My current (main) setup:

• Hardware: 11th Gen i5 Nuc with a 8TB HDD attached via USB
• OS: Debian 11
• Software: OMV6 for management and Docker for a diverse set of containers
• Current containers: HortusFox + MongoDB, *arrs-stack, Jellyfin, uptime kuma, unifi network application + mariaDB, traefik, wallos

Current available hardware for use:

1x 13th gen i3 NUC running Proxmox 8.2
1x 11th gen i5 NUC
1x uGreen DXP4800+ NAS with 4x15TB HDDs in Raidz2. The OS is TrueNAS scale

My plans:

• NAS storage made accessible via NFS to the proxmox VE.
• NAS storage mainly planned as mass-storage for Jellyfin.
• Reimage my 11th gen NUC with a bare-metal Debian install for Docker.
  (I will not virtualize on the 11th Gen NUC because I can't pass the iGPU to the VM and not really interested in LXC containers)

Problems and questions I have at this moment:

1: Should I do a media-storage VM only utilized for serving media and do the computing on another VM or do a general VM for both?

• Upside to an all-in-one VM: Less problems with serving storage between many different nodes and keeping it organized.
  Upside to specialized VMs (storage & compute VM): Better focus on ressources like CPU and RAM.
  2: Should I place my whole docker stack again on the 11th Gen NUC or place the stacks in their own VM(s)? Example:
  service stack in service-focused VM
  media-focused stack in media VM (which also serves the files for jellyfin)
  Jellyfin bare-metal/dockerized on NUC 11th Gen

I hope someone can maybe help me untangle my grown mess and plans. My skills with Linux are not very deep and very beginner level. If you are willing to help please be patient with stupid questions.

If you have any better solutions, pointers to research, (blog) articles on architecting such solutions, examples how you solved storage/management or just willing to help me, I'd be very grateful :)

So often they go end of sale. Once gone and restocked I will hoard it.

This was a guided tour of the future main station in Stuttgart called Stuttgart21.

More pictures: https://imgur.com/a/8QnDQrO
(Disclaimer: The descriptions could be wrong for the east/west orientation :P)

cross-posted from: https://lemmy.dbzer0.com/post/20923434

Was grown from seed.
Last time I posted about it: https://lemmy.dbzer0.com/post/5241154

Was grown from seed.
Last time I posted about it: https://lemmy.dbzer0.com/post/5241154

Plant is a Yuzu Tree

The tree is declared as a "Citrus Ichangensis x Citrus reticula" but the buldge looks suspiciously like something after a grafting process.
I don't have a problem with it but the seller didn't mention any grafting being done.
I am also cautious because I live in a zone 7a area and don't wanna kill my first attempt.

Any help is appreciated :)

More pictures:

Hello fellow selfhosters, I tried to find a piece of software that could achieve my goal but maybe I am not searching in the correct areas. So I thought of asking here for suggestions or directions I could take.

What I am looking for:

I am looking for software that could fill a purpose of tracking like a helpdesk ticketing portal but not be a full blown ticketing portal.
For example I want to track current tasks like an RMA I am doing right now with Logitech (currently organized in my email inbox/folders) or keep track of shipments (currently tracked in Google Keep in this format: Shop | MM YYYY | Order-ID | Contents | Tracking:<Shipping Number>)

Features I am specifically looking for:

• Tracking items (like shipments)
• Keep track of issues (fix light bulb), Tasks (go to citizen office to renew ID),
  • Optionally: Keeping communication like E-Mails (like go back and see the communication history with Logitech concerning the RMA#999999)

Platforms I use:

Android and Windows.

What I have found so far and seemed to fit:

• Kanban Boards: https://kanboard.org, https://wekan.github.io
• Ticketing Boards: Zammad, glpi, freescout
• Whatever that can be classified as: Leantime

How I am coming to the conclusion I need something like that

• As mentioned earlier, I keep track of some stuff like shipments, overtime todo, money I am owing or someone does owe me in Google Keep. It kinda works but I feel like I am straining the borders of it's use case. And I fear Googles Graveyard
• I keep track of my e-mails via folders (to some extent). But I will probably not find the email of communication I had 5 months ago with that system.
  At work we use a classic ticket helpdesk system. I can more or less find the ticket of an issue a customer had on the phone and correlate it with the problem I have right now.
• Some of my knowledge base is in Obsidian.md for technical stuff or minor stuff like "find x here", while the stuff related for real life (e.g. recipes) are stored in OneNote.
  It's not necessary to consolidate it but maybe I can remove some of each into the new system?

What I would like to avoid:

Things like creating companies to track tickets with. I would rather just keep track of the issue (maybe with some form of history to go back in time?) and not be lost in endless classification of company number, telephone, contacts etc.

Maybe I am in search of a unicorn-glitter edition^tm^ and just need someone to tell me that doesn't exist or I am not looking for the correct thing or term.
The help is highly appreciated :)

PS: While preferred it doesn't need to be selfhosted. It should be accessible via smartphone (app or web doesnt really matter) and on desktop (program or web).

Update:

Currently in consideration are (thanks for the suggestions so far!):

• OpenProject
• Focalboard
• Vikunja
• Tarallo

cross-posted from: https://lemmy.dbzer0.com/post/5519216

Species: Aeshna cyanea

Yes, it was alive at the time and left alone (outside of taking a picture)