juriansluiman

My personal website [0] is -afaik- GDPR compliant. I have access logs disabled, as I don't care about them. It's a static site (Hugo) deployed as container with an nginx server behind Traefik.

I don't use comment forms, as they are a headache to maintain over the years. I used to have comments but removed them and discussions move to other media (HN, Twitter, Reddit). For analytics I use Plausible [1], self-hosted, and that's fully GDPR compliant.

I live in the EU (NL) and the server is located in AMS3 for DO. This setup runs perfectly fine for me for several years now.

  [0] https://jurian.slui.mn/
  [1] https://plausible.io/

Actually it's the process how I (DIY) deploy several static sites from my local machine. I build the Docker image (hugo sites with nginx, expose a single port for HTTP traffic) and save it as tar. Ironically the base images do come from a registry, but I can't deploy to a public registry and don't want to host my own.

On the server where I need to run that site, I just transfer the tar, load the image and run the docker image. It's so straightforward I much more prefer this way than being dependant on external registry sites for deployments.

The biggest missing feature on Masked Email by Fastmail is they don't remove trackers, as far as I know.

Masked Email gives you more privacy (the identity behind the receiver is unknown) and with data breaches, there's is no login data leaked.

Duck's Email Protection does also remove trackers from the forwarded mails. So senders can't trace back whether you have opened the mail. I hope they also remove click trackers, but I am unsure how they would implement that technology with the referral codes in the URL.

As my Traefik setup is affected, I cleared the `acme.json` and let Traefik get new certificates for all services.

Seems LE is pretty busy right now, got time outs flying around every where.

As stated by others already, there's Plausible (plausible.io) and Matomo (matomo.org).

I have used both and stuck at Plausible. A few reasons (subjective):

1. Plausible is GDPR compliant by default, it has an effective way to measure analytics throughout the day without cookies

2. It is simple and that's key. I don't need to know much, Plausible just gives me that

3. It's fairly lightweight. Matomo is quite heavy and as my VPS'es are pretty much scaled down, less is just more

4. The Plausible self-hosting doc is centered around Docker, which is the architecture I use myself and is set up in literally a few minutes

> Autofill is relatively poor (it fails even on HN!).

Autofill is much more customizable than LastPass afaik. You can both define how (domain)name matching should occur as you can have multiple entries to match.

This means you can have instagram.com (as website) and androidapp://com.instagram.android (as app) which will use the same autofill entry.

If you configure name matching correctly, any site should be able to provide autofill. My HN entry does match with news.ycombinator.com with default matching settings. But matching settings include hostname / domain name / starts with and even regex!

> Also, Lastpass has a convenient timed expiry that doesn't work (well) on Bitwarden (BW will expire the login when the browser is closed).

You can specify BW timeout settings. Even further, you can define if BW should lock the session (only a password is required to unlock) or if a sign-out is required. With a sign-out, you also need to provide your MFA if applicable.

Time outs can happen directly (after autofill), after an amount of time (1/5/15/30 minutes or 1/4 hours) or upon closing the browser.

So tbh, there is plenty to configure Bitwarden to suit your needs.

> The real reason most websites disappear is a much more human one.

So true.

I have had a blog running since 2006, all was php based back then with (html) posts inside a database. The tooling shouldn't be a problem, I switched systems several times (once every few years).

Currently on Hugo with markdown posts. As long as you treat your migration carefully and take some time to migrate, every tool should suffice. It's mostly about human effort and human error when things get lost.

(Author here)

I run it to communicate with much more applications. It just depends on your own preferences. For example, some tools provide an API (local or cloud based) and you can directly plug in into that API. In The Netherlands you can read your electricity meter yourself by a "Dutch Smart Meter Readings" and DSMR integrates into Home Assistant with MQTT. I use Z-Wave as wireless mesh technology for lights and switches, the Z-Wave controller integrates into Home Assistant with MQTT.

MQTT is so easy to setup and configure, you can use it for any messaging you want. As an example, I run Home Assistant locally to run my home automations, but also check the status of my local devices and online servers (Digital Ocean droplets). One use case is my backup script which publishes the backup results to an online MQTT server, my Home Assistant checks the topics at that server to display backup stats locally. If something went wrong, Home Assistant notifies my directly. PS. The backup script also sends out e-mails which I filter in Fastmail, the success mails are trashed and only error messages are kept in the inbox ;)

You're totally right. Although in my experience this is much easier to maintain with "upstream root certificates" (not sure how you'd call them) then self-signed certs. Applications like Home Assistant are already TLS aware and simply trust all root certs which are available on the host. With self signed certs, you have to distribute them all by yourself.

Besides this trade-off, you have to check all clients to be TLS aware on beforehand. In my setup, all clients were capable of TLS. The only hassle are my NodeMCU devices which need to swap the WifiClient to a WifiSSLClient and you need to embed the public DST Root CA X3 yourselves.

Author here:

That's exactly what this post does only with Traefik instead of haproxy. The TLS of Mosquitto is just too much of a maintenance burden.

A cross post from what I replied at a Reddit topic:

> Mosquitto does have TLS support by itself, but the manual only deals with self-signed certificates. Self-signed certificates do involve a maintenance burden I don't want to deal with. All my applications/devices which expose a HTTP frontend (or other TCP stream) are encrypted via Let's Enncrypt certificates. They are automatically trusted by a lot of platforms (pc's, phones and other devices).

> I was using acme.sh before and the post-install hook can refresh every service, but it just wasn't working properly on every occasion. You also have to reload all your applications for loading the new certs (that is, Home Assistant, Unifi, Pi-hole, mosquitto, my smart meter readings platform and so on). Just reloading everything for a cert renew felt cumbersome, and Traefik dealing with TLS termination decouples the TLS part from the application itself.

> Since I used Traefik already, it was really straightforward to put Mosquitto behind Traefik too. Of course every situation is different, this post is mainly geared towards users which do not authenticate or encrypt Mosquitto at all.