Hello,
I took the degoogle boat in 2024 when I saw shit like gulf of murika.
So far I have no regrets, and if I have to do it again, I’ll do it again.
My actual setup : Phone : Pixel with GrapheneOS.
Mail : Proton Drive : Proton VPN : Proton Password Vault : Proton
Calendars/Contacts : radicale (selfhosted) Photo : Immich (selfhosted) Home : Home Assistant (selfhosted)
Notes : Standard notes YouTube : Newpipe/Grayjay/SmartTube Maps : CoMaps Authenticator : Aegis Wallet : Catima & (Mybank app)
Now with the last declarations from CEO of Proton, I’m seriously thinking to change some of my setup.
Did someone have recommandations for mail provider, with a private domain name? I want to be more resilient in case my mail provider turn on the dark side.
Actually I’m thinking about mailo services. 1,5€/months for 20Go with drive. If someone have some experience with them and coule advise me.
Also I need a solution for my aliases. I was thinking of Addy.io or duck.
VPN, I need a solution for Android with split tunneling, and also for linux. Maybe Amnezia, but there website don’t inspire me confidence.
And also I need a new password vault, easy to sync between my devices. Lots of articles talk about BitWarden and VaultWarden, but from US, and I don’t wan’t to feed the beast even if it’s a geniune editor focused on privacy.
TL:DR: self hosting is the way, get off site backup and a domain name.
TL: I notice you are not opposed to self hosting, I personally have a VPS that hosts my blog just something for me to write in, nothing special. This VPS does more than host my blog, it backs up my vaultwarden, immich, documents (some what still figuring that stuff out), HA, and I am sure there are other things backed up as well. I am sure I could get wireguard running on there if I wanted to hide my IP, but I have so much stuff running on my home lab that I would need to move to the VPS plus I live in Canada none of the rights holders from the US are going to spend more money than they can possibly get to come after me for sailing the high seas. If you are using the VPN for other reasons than that I have other things setup that reduces attack surfaces.
Before I mention the things, I got the VPS because I was self hosting my very simple blog but on the same vLAN I was running the rest of my homelab. But I got it from the same host that was hosting my domain name and email (easydns); I am sure you like being able to keep emails anonymous hence Proton mail easydns offers a wildcard email option so you can just create a random email anywhere anytime they have some amazing spam filtering on top of that so I rarely see things come to addresses like info@mydomain.ca.
For a Drive replacement I currently just have a smb share that I am using but I am thinking of getting back into Nextcloud, I was having difficulties with all of its other things (like contacts, calendars, and the other stuff that is not file storage but those are all sorted out now).
Depending on what you use the VPN for (shopping, streaming, etc) I do not no what to offer you, if it is for sailing the high seas you can do what I suggested above with a VPS and wireguard. If it is for security you can do what I did, or you could go way over kill and go further: I have a Flint 2 that I flashed with a vanilla install of OpenWRT I than have 5 or 6 APs, I have 8 or 9 vLANs, and 2 or 3 VPNs back to my LAN. My IoT is on its own simple IoT vLAN that is controlled by a pi 4 running HAOS controlling all of the IoT stuff I have limitting its access to the web. The VPNs are used so that I have the security of my my LAN when I am away from the LAN. I have a fairly strict firewall that I may need to modify everytime I bring a new device onto the network but that is coming less and less frequant, because I use non standard ports for almost every thing.
If your VPN is to block ads and trackers, may I strongly suggest investing time into pihole and finally funing it for your uses, no more ads and trackers! If it is for security may I suggest setting up crowdsec as a honry pot and change the ssh port for every thing else on your LAN.
For Passwords may I suggest vaultwarden than you can use the bitwarden app but with all tje paid for services for free. My ISP gives away to satic IPs with their service so I am lucky like that but I hrsr there are options to use other thing. I use caddy with easydns’s ssl crtd.
Mailbox.org for mail, probably. It allows for catch all inboxes, meaning you can send to any address and it’ll be routed properly, giving you your own sort of email alias service. It’s obviously not as refined or private as something like simplelogin, but if an address is compromised you can create an inbox rule to send it directly to trash, for example. This also gives you the flexibility of moving easily: you just update your DNS to your new mail provider that supports catch all, and you don’t need to update any email addresses anywhere.
Vaultwarden is open source and self hosted, so it being “from the US” is a bit of a strange way to put it. Bitwarden is US based though. A solution that might work for you is using KeePassXC paried with syncthing, which will sync your vault between devices.
For drive-like functionality, Nextcloud is probably one option. It can also do caldav like radicale.
VPN, I’d take a look at AirVPN, personally.
+1 for a lot of the things you said. Adding to that:
Vaultwarden may be open source, but it puts the onus of hosting it securely on you. Whenever you think about putting something on the internet (self-hosted or not): always assess the potential fallout in case of compromise. And having your password manager breached could easily be catastrophic, costing you a lot of time, nerves and potentially even money. That’s why, in my opinion, password managers do not belong on the internet, neither commercial nor self-hosted.
Thus I’d strongly advise to go the KeePassXD (PC) / KeePassDX (Android) + Syncthing route. Points speaking in favour of this solution:
- entirely offline - all of your keys are in an encrypted database file on your device, and thus inaccessible to any online attacker.
- simple, yet feature rich: KeePassXC can do a lot of what the “big guys” can - TOTP, Passkeys, built-in SSH agent, auto-fill, etc.
- independence: unlike Bitwarden (which keeps you reliant on a subscription with a for-profit company) and Vaultwarden (which is maintained by only a handful of guys on Github), KeePass is a reasonably large project that is both impossible to enshittify and maintained by a large base of contributors.
- Syncthing still allows you to keep all of your devices in sync, in spite of the data being “offline” technically.
+1 for Nextcloud with calDAV and cardDAV for contact sync. Bonus points for self-hosting it (but again, think carefully which files you put on there).
As for the VPN, I’m currently still on Mullvad, but considering the switch to IVPN or Nym.
I’m looking into self hosting but I’m pretty new to all of this networking stuff. I’m going to be setting up an old laptop and try to self host a few things like immich and looking at syncthing. I set up KeePass yesterday and it works great, but without a server I’ve just been replacing the file per device as I make changes.
If I understand, with syncthing installed on each device I can point KeePass from each of my PCs/laptops/phone to the directory on my laptop server? This will also work remotely?
I set up KeePass yesterday and it works great, but without a server I’ve just been replacing the file per device as I make changes.
If I understand, with syncthing installed on each device I can point KeePass from each of my PCs/laptops/phone to the directory on my laptop server? This will also work remotely?
There are several misunderstandings here. Let me clear this up:
While there is a server-based version of Syncthing, you need no server to get all the syncthing goodness! Syncthing is designed to work peer-to-peer. Just hook up, say, your mobile phone and your PC and the folder(s) you’ve shared will be in sync - no server needed.
As for “working remotely”: while Syncthing can do that, I’d advise sticking to the default configuration, which means “LAN only”. As soon as both devices are on the same network and “see” each other, they’ll sync. This will cover most use cases anyhow. If you’re out and about, make changes to your database on your phone and then return home, your phone will talk to your stationary PC in the background and update the DB. For the odd case where changes are made on both devices, Syncthing will create a conflict file, i.e. you’ll have both changed databases and can merge them so you won’t lose either change. (Syncthing even supports versioning files, but that is for later.)
This makes sense, thank you.
Now with the last declarations from CEO of Proton, I’m seriously thinking to change some of my setup.
again? what’s it about this time?
email, you have https://tuta.com/
I spent hours yesterday doing exactly this. Years ago I went full Proton to get away from Google. I knew putting all my eggs in one basket wasn’t smart, but it was a big task so I did what I could at the time. I’ve learned a lot since, and in migrating this time I’m using custom domains to make it easier the next time.
I started with Proton Pass, arguably the most important of the Proton Suite. I went with KeePass, and was really concerned about the difficulty in switching but it was shockingly easy. It’s certainly less polished and has some hiccups and is a bit slower, but it works great.
2FA is with Aegis.
Drive. I looked into a lot of options and decided to go with Filen.io . I’ll be testing it this week (I use it for freelance work) but it seems solid so far. A year was around $35 CAD.
Still looking into a calendar (I’m new to self hosting so it’s a huge learning curve for me).
VPN. I need port forwarding so the only other option I’ve found is AirVPN, which seems pretty good, but it’s based out of Italy which is an eyes country. For now, I’m staying with Proton VPN.
Standard Notes was acquired by Proton, so I’ve switched to Obsidian but haven’t pulled the trigger on paying for a sub yet.
The big one, mail. I’ve gone full custom domain (Cloudflare for now) and have been switching my emails on all my accounts. I decided to go with Thundermail, and so far it’s working great. I’ll be looking into self hosting a server soon to try to sync settings between devices (no idea if I can get that to work lol). Once everything is migrated, if Thunderbird goes tits up like Proton is doing the switch will be really easy with domains.
I just moved from Tuta to mailo for their free account. So far, it looks fine and simple. The custom domain config was not so straightforward, but finally ok. I find that their documentation could be improved, honestly.
Just curious why you moved from Tuta?… we are just trying it out, but it appears the NHS in the UK blocks all Tuta mails… so we trying to decide between an alternative or complementary provider.
I moved from Tuta because encryption makes it real slow, but the biggest reason was that searching in mails is very painful, ineffective, in addition to slow. So I decided to ditch the whole end-to-end encryption thing for mail considering all I’ve read about that recently.
Since I’ve moved, I could re-browse all my emails and realized 80 % of them are very un-sensitive data like order confirmations etc Since I selfhost paperless, which is awesome, I really don’t need to keep a record of more important stuff in my mails anymore
Ah that makes sense, we’ve not used it enough for search to be relevant, but it will be eventually. I’m a big user of folders so my inbox is often sorted enough to find things quickly without search but after a couple of years search becomes essential.
With with trust in Proton steadily declining it’s difficult to know who to trust with Mail and VPN and Passwords.
Same here re: Tuta. I started with a tuta account however search is simply so terrible as to be pointless in practice. I switched to mailbox, which also allows me to use my domain name.
I use Surfshark as VPN, happy enough with it.
I previously self-hosted vaultwarden but have started trying out KeePassXC. I don’t really need instant always online password management so it’s fine so far being local to my machine.
I’ve not taken the plunge yet, but I’m looking to move the last of google and the stuff that I had moved to Proton to https://www.infomaniak.com/en/ksuite/ksuite-pro
Not every thing you may need but I think its a start
I used to work with a company who have VPC hosted at infomaniak, and it was chaotic.
The company IT management wasn’t flawless, but Infomaniak management was way more worst.
Unsollicited restart without any notification. And when we create ticket to ask what happen. ‘Whoopsy my bad we forgot to inform you’.
