So i have my setup like this

• ISP router → MikroTik ac lite used as a VLAN-aware switch.

• The ISP router goes to MikroTik port 1, The WAN travels over a single trunk (port 2), and all VLANs to a Proxmox server.

• Sophos Firewall runs as a VM on that server, with all other VMs. It’s the gateway and DHCP server for all VLANs (5 = Wi-Fi, 10 = wired LAN, 30 = servers).

• Mikrotik handles DHCP requests and sending them to Sophos using relays

• Tiny network: about 2 wired PCs and 4 to 5 phones.

• The VM already starts first on boot, and the BIOS powers on after a power loss.

Everything works perfectly but i'm annoyed (just to play a little more) and i want to separate the Sophos into a device on its own, to make the firewall independent of the main server, so that after a power cut devices don’t wait for Proxmox and then the VM to get IPs, and so the internet survives server failure or maintenance, etc

So i was thinking about two options

A) A small mini PC with one NIC running Proxmox, Sophos stays a VM with virtual NICs for WAN, LAN, and a trunk to the MikroTik.

B) A small SFF PC with one extra PCIe slot for NIC, and use it as bare metal port for WAN and port for LAN

Both options will allow me to use the firewall right after the ISP router and use the Mikrotik as switch only to handle ports traffic

BUT, does it worth it or i'm too paranoid? like i said everything actually works great i don't have any issues but i prefer sophos on its own and most likely bare metal, what do you recommend?

To give everyone time to upgrade, full details will be published as security advisories on November 15, 2026. Once published, the details will be public, so update now rather than waiting for the advisories.

Hello, I'm new to self hosting and I'm looking for some public alternatives.

I self hosted a server from my home and ran some media streams dockers. I was using Private Mesh to access my server out of the network. Then I got to know about the cloudflare tunnel and I bought a domain and hosted some of my nextcloud, vaultwarden on my domain publicly. Since I don't want to give my card details to Cloudflare Zero Trust, I use WAF protection to keep my Url blocked from access and only keep access to certain things.

I got to know about cloudflare's streaming policy that it doesn't allow that and can throttle the speed. And looked for an alternative. And found out about Caddy, tried it and liked it very much. I also found out I have a Public IPv6 address that my router gives me which I can use to expose Caddy on 443 and 80 ports and reverse proxy my docker containers.

But the main issue is security, username, password, 2FA, in app authentication, WAF for url blocking and so on. Since Cloudflare is only handling my DNS now, because I have dynamic IPv6, I think I don't have any WAF protection now.

I wanna know how you guys keep your server and containers protected on the public network. I'm new to this a little help will be appreciated thanks.

I built Smeldr to keep track of which decisions are in force, who had the right to make them, and what rests on them. It is for teams that work with AI agents, where a decision made on Monday can meet an agent working from last week's version on Thursday.

What it is

A decision is proposed, and a person with the right to do so ratifies it. After that it cannot be edited. A change is a new decision that replaces the old one in one step, and the old one stays on record as replaced. Decisions are placed where they apply (the whole organization, a Domain, or an Area that covers files in a repository), and the right to ratify is set per place. Every write records who did it and whether it was a person, an agent or a job.

An agent can propose decisions and can ask over MCP which decisions apply to the files it is about to change. A token made for an AI agent can't ratify a decision, and the server refuses it, so the limit does not depend on the agent following instructions. With the GitHub integration, a pull request that touches an Area lists the decisions in force for those paths and goes to the Area's approver. GitHub holds the merge, through a required status check you set.

Self-hosting

• One Go binary, SQLite built in (the database is a file), Postgres optional through a separate module

• Settings are environment variables, or a config file

• Release binaries for Linux, macOS and Windows

• Open source, AGPL v3

You can try it in a few minutes, with the real output, on your own machine: https://smeldr.dev/docs/getting-started. There is a tutorial where you watch an agent token get refused at ratify: https://smeldr.dev/docs/an-agent-is-refused

What it is not

It does not run agents, store what an agent remembers, or search by meaning. It does not read your code against the text of a decision either. It puts the decisions that apply in front of whoever judges, and records the answer.

Honest limits

• I run it on my own instance, and smeldr.dev is served by the same engine. I have no customers.

• The steps in the tutorial are run automatically on Linux and macOS (the bash steps) and by hand on Windows PowerShell. The Claude Code hook has been run on Windows 11 only.

• AI involvement: I build Smeldr with AI coding agents, and the code, the docs and this post are written with their help and reviewed by me.

I would like feedback on whether a record of decisions like this is something you would use at all, what would make it useful or not, and anything in the tutorial that does not run the way it is written.

Hi all,

I wanted to share a project I've been working on for a while: an open-source pastebin server written in Go. It started as a hastebin fork, but I slowly rewrote everything in Go and added a bunch more for features.

I started building it after hastebin fell into a state of disrepair because I wanted something with a clean UI that was easy to use and reliable. It's a single binary or Docker image, and just needs a database besides that. Everything happens server side, so it's fully functional without JavasSript. The only exception is encrypted pastes, because those are encrypted in your browser.

Features

• Syntax highlighting for most popular languages, plus raw text mode

• Password-protected encrypted pastes: AES-256-GCM in the browser, so the server never sees the plaintext or the password

• Collections: share several pastes under one link, with tabs

• Reader mode (renders Markdown, wraps text)

• Optional accounts so users can edit or delete their pastes

• Basic Auth for fully private instances

• Opt-in document expiration, configurable size limits, ratelimiting, and random-string or word-phrase IDs

• Custom named documents that never expire (handy for a "rules" or "about" page)

• QR codes

• Headless API-only mode, plus curl-friendly uploads

• SQLite, PostgreSQL, or MySQL/MariaDB

• Handles reverse proxies properly

Links

• GitHub: https://github.com/lukewhrit/spacebin

• Public instance to try: https://spaceb.in

It's published under Apache 2.0.Feedback, bug reports and feature requests are very welcome, and I'm happy to answer questions here.

I host my own email using a VPS running a build from mailinabox.email. One thing that has always been difficult is having a straightforward resource for searching over 25 years of email from my phone. Any suggestions?

On the desktop, I run Thunderbird and it works perfectly. I run Thunderbird on my phone as well, but it's more difficult to search on the server and results are unreliable.

Ideally a single purpose app (or container-based web app) would be great. Nothing I've seen quite fits the bill. Any suggestions?

I have a directory like

media/downloads/complete

media/jellyfin/shows

media/jellyfin/movies

The media directory is bind mounted into different containers, the torrent client downloads into `downloads`, and the media server reads from `jellyfin`

I am assuming a lot of people must have a pretty similar setup. What I've never solved and never really tried to solve is efficiently moving files into the media server. For years I've just ssh'd into it and moved them over when I'm done seeding.

This is fine really, but is there a better way? I know a lot of people use an Arr stack so there must be a cleaner way. Similarly if you want to seed for a long time but also want to be able to add it to the media server, do you symlink it?

A a chron job is non trivial because some downloads go to movies, some go to shows and sometimes I download ebooks which is completely different.

Hi r/selfhosted!

I've just released the 0.35 release of karakeep! This release is special in two ways: 1) We've reached 30k stars on Github. 2) We've also got https://karakeep.com (instead of .app) which I've been chasing for a while. Thanks a lot for your support over the years, it's been quite a journey.

Every time I started talking about the release, without mentioning what karakeep is, someone complains in the comments, so here you go: Karakeep (https://karakeep.com/), is a selfhosted bookmark manager that's meant to be the place where you throw things in that you might need in the future, and it aims to help you with retrieving those things easily in the future. It has a blazingly fast full text search and opt-in LLM based tagging. It's built for the data "hoarders" out there! Karakeep was born because of this subreddit in 2024, and we have a long history here together that old timers will remember.

Black October
Last month, was a crazy month in the security scene. I run karakeep in prod (for the hosted karakeep cloud), so it's been quite exhausting to keep up. And as you might guess, karakeep is not a simple service to host given the amount of untrusted content it deals with. Today's release, packs tons of security fixes (reported to us by the community) and also proactive security hardening work. So please update your instances to the last release.

The one update that I'm most excited about is the new sandboxing feature. Karakeep main functionality involves parsing untrusted HTML to extract content out of it, as well as parsing PDFs, and OCR on images. All of those is karakeep processing untrusted content in the same process that deals with user data. Similarly, the SSRF risk when fetching content from inside your trusted network. Perhaps the risk is less severe when all your users are trusted users, but this was keeping me up at night for the hosted service. This release now makes it possible to offload all untrusted content handling to a remote stateless sandbox that can run outside of your network. The workers talk to this sandbox over HTTP.

The cool thing about this feature is that beside its security benefits, and once this sandbox API is stabilized, it'll allow you to plug in custom content crawling and parsing logic replacing that of Karakeep altogether if you want.

The Polish

This release contains a major polish pass over almost all the screens of karakeep in the web, mobile and browser extension. On the web, the dark mode is now more modern (replacing the old dated bluish color scheme). The bookmark card's aspect ratio now matches the common opengraph images for more beautiful banners. The setting page got a big restructure as well. You can now hide the editor card, which for some reason, annoyed a lot of people (I still like it though!). Tons of improvements also to highlights page, the reader view, the preview page, etc. Better experience those yourself.

On the mobile app, we now have iPhone Duo support for those who already managed to acquire one (and a sidebar for tablets in portrait mode). On iOS, we have long press support for bookmark actions. We also now have card swipe support for archiving/staring. Tons of tiny UX improvements (e.g. search in manage lists, smart list builder, improved highlighting experience, etc). And lots of other fixes as well. The mobile app also gets internationalization support (a bit overdue).

Same for the extension, it also got some love which you might have seen already as i've released it a couple of weeks ago. Overall, Karakeep should feel more polished and more pleasant to use. If you have more suggestions, please keep them coming.

Others

• Text bookmarks and assets now support summarization (previously only links did).

• Smart lists now have a "builder" so that you don't need to write the query language yourself. It also shows you the matching bookmarks as you build the query.

• We're now using defuddle for content extraction which is a great library created by kepano (the creator of obsidian) and it's used in their web clipper. You should see higher accuracy in the content extracted from websites you hoard in reader view.

Thank you for being part of this journey, enjoy the release!

I started working on OpenShip in March and launched it in July. We went viral in a lot of places, #2 github ternding, now +15k stars and now we're getting close to 2K PRs from the community.

More than 110 people have helped me improve and stabilize the platform, which is honestly amazing.

We've also managed to build a lot of great features already:

• Auto scaling

• Clustering

• Regular deployments

• Self-hosted Actions

• tunneling

• And a lot more.

Still a lot to come, If anyone of you have any feedback about the platform, I'd love to hear your thoughts

I feel like there's a point where the AI stack stops being fun and just becomes another thing to maintain. I had Ollama in a container, a web UI in another, a proxy so my coding agent could reach it, and a little script to unload models when RAM got tight. Four moving parts for one chatbot.

Lately I've been leaning toward fewer moving parts. Moved to Magnitude on the Mac, which is one app that picks the model for my RAM and has a one click connect for the coding agent, and deleted the rest. The thing I noticed most was the wait on long prompts, the same small Gemma model now starts answering in about 2 seconds instead of 6.

Anyone else gone through a phase of ripping out half their setup after years of adding to it?

What self hosted projects in docker compose you guys recommend to do something like we have with Grok Bot?

I want to ask some tasks like send email when a website change some specific information, create tasks based by e-mails I get and give to me a news regarding some topics daily

Is it possible?

In my understanding it need to support connection to apps, MCPs and web search

A terminal app to run WireGuard, OpenVPN and NetBird tunnels side by side. It shows live throughput and latency, checks for IP/DNS leaks, and has a kill switch. macOS and Linux.

brew install vortix · https://github.com/Harry-kp/vortix

I, like everyone else and their mothers, would like to use proxmox. I understand the basics, what I’m not so sure on is security. I’ll have a few services I want exposed to the internet proper, not just a VPN, though most will just be exposed over wireguard. Basically my internet services would be game servers (primarily Minecraft but possibly others later) and maybe jellyfin? I do have a super cheap VPS, which I used mcrouter and Tailscale on to tunnel to my actual homelab, but as far as that and setting up my firewall I’m not sure what else I need to be considering? I haven’t used proxmox and I guess I’m just looking to do it right for the learning experience. Apologies if I sound dumb lol I just prefer written tips instead of 2 hour YouTube walkthroughs that only have 15 minutes of relative info 😭

I posted here about making this about more than a month ago and got fairly positive responses.

The goal is to convert any desktop device into a homeserver while making sure that the process is super simple and intuitive even for non-tech savvy people and must not require any money to operate.

You'll just have to connect once using qr code/6-digits code and itll stay. Now you can send files, choose folders(whatsapp,photos,etc) to backup, restore the selected folders, access pc file system, stream videos, view photos, rename, edit, etc from anywhere.

However, connection behind CG-NAT is very tricky, ive find solutions to make it reliable i.e using drive as tunnel(we can replace it with nextcloud, VPS, relays, etc), nostr relays and tor servers. But dont worry, my every decision is taken keeping privacy and encryption in mind.

Now, the application is ready and functioning but i do not have the resources to conduct testing for every scenerio. So if you really find the application useful or interesting, you can text me or mail me and i can add u as beta user and i can perfect the application in next few weeks and we can even discuss potential upgrades.

my email: [email protected]

https://github.com/saqibsiddiq/QurbSpace

Hey everyone!

I ran into an annoying issue with my ISP: direct file downloads from overseas and distant servers were consistently throttled down to around 15 to 20 Mbps (2 to 3 MB/s), even though running a test on cloudflare speed test easily hit my full line rate of 100 Mbps.

To bridge this gap, I built CDNFlare — an open-source, lightweight Cloudflare Workers edge download accelerator and streaming reverse proxy.

How the "Speed Jump" Works: Instead of your client establishing a high-latency, throttled connection directly to a slow international host, the Cloudflare Worker fetches the file across Cloudflare's datacenter backbone and streams it to your client through your closest Cloudflare edge server at full peering speeds.

Key Features:

• Full HTTP 206 Partial Content (Range Support): Works seamlessly with IDM, Aria2, and FDM for 8 to 16 simultaneous parallel connections and pause/resume.

• Zero-Buffer Streaming: Passes the stream directly without buffering in Worker RAM, so multi-gigabyte files stream smoothly.

• Smart Filename Detection: Sets proper filename headers if the origin server omits them.

• Anti-Hotlink Bypass: Automatically forwards origin referers and browser user-agents.

• Optional Access Token: Protect your personal deployment with a secret token if you want it private.

• Built-in Web Dashboard: Clean dark-mode interface with one-click command generators for Aria2, cURL, and Wget.

100% Free and Self-Hosted: It runs completely within Cloudflare's free tier of 100,000 requests per day. You can easily deploy it to your own Cloudflare account in under 2 minutes.

The GitHub repository link is in the comments below!

I would love to hear your thoughts, feedback, and any edge-case suggestions!

so... since their "little oopsie" from a few days ago, i've apparently been blocked by microsoft.
had 0 issues before in the last 2 decades, my dkim & spf records are fine, signing is all fine,
and IP is not blacklisted anywhere.

and yet, i get this when mailing to an outlook address (sending to o365 DOES get delivered):

    outlook-com.olc.protection.outlook.com[52.101.68.11] said: 550 5.7.1
    Unfortunately, messages from [<IP>] weren't sent. Please contact
    your Internet service provider since part of their network is on our block
    list (S3150). You can also refer your provider to
    http://mail.live.com/mail/troubleshooting.aspx#errors. [Name=Protocol
    Filter Agent][AGT=PFA][MxId=11BE835A3507C0D1]
    [DB1PEPF000509E5.eurprd03.prod.outlook.com 2026-11-15T12:47:51.595Z
    08DF41AD1C013CF8] (in reply to MAIL FROM command)  

i've also checked the IP on SNDS, but there's nothing available there, either,
got neutral sender rep on talos and the entire /24 consists either out of neutral or good email rep,
so i have no clue why microsoft is suddenly blocking the IP from sending to them

It just occurred to me I'm two months into running my own AI instead of paying for one. I started off with Ollama in Docker with a web UI in front of it, then moved everything to Magnitude on my Mac mini after a few weeks because the wait on long prompts was driving me nuts. At the beginning I had no clue what quantization even meant, and I still don't fully.

I'll admit most of the setup help came from Claude, which is a bit ironic.

There's a lot of models I tried and dropped, these are the ones that stayed. Qwen 3.6 35B for coding questions, a small Gemma for summaries, and a tiny one for titles and commit messages. On the M4 Pro the 35B does about 120 tok/s which still feels unreal to me for something sitting on my desk.

Curious what the next two months bring.

That browser certificate warning doesn't have to be part of your homelab experience.

I documented how to use mkcert for trusted local HTTPS, with nginx, local DNS, and Synology examples.

No public domain needed.

Full guide: https://igprod.net/mkcert-local-https

Do you use your own local CA, or prefer Let's Encrypt with DNS-01?

Bots everywhere. They scan my site for weak spots, then hackers come. I trust nobody.

I made 5 WAF rules for Cloudflare's Free Plan to help protect self-hosted websites.I use a Zero Trust approach for crawlers. The rules block known AI bots, scanners, and suspicious requests. They also protect sensitive paths and challenge traffic from some networks.I allow selected search bots like Google and Bing. https://github.com/buybitart/cloudflare-security-art

Why let AI bots scrape your content and waste server resources?

Do you block AI bots on your self-hosted sites? What works best for you?

Running Searxng, I've been trying to get the config working, and searching properly but it keeps returning absolutely nothing related to my query and content time outs and rate limiting.

I'm getting mighty pissed and looking at better options

Suggestions

I would like to host a 26.3 Minecraft server with the Fabric loader and around ~180 mods. BetterX, Macaw’s mods, Biomes O’ Plenty, and TaCZ are the main ones, with other smaller content/QoL mods along with a bucketload of optimizations. I plan for there to be a maximum of 10 people at a time.

I also plan to use Ubuntu, since it’s much lighter than Windows.

My top priority besides lag-free hosting is low power usage. I found a used Dell Optiplex 9020M that seems perfect for the job, but I want to check with y’all just to make sure.

Specs:
CPU: Intel i7-4785T (2.2GHz)
RAM: 8GB 1600MHz DDR3
SSD: 500GB NVMe

Upgrades are a possibility in the future since the sockets are standardized, but I’m looking for a good base configuration.

As a side note, what small monitor would you guys recommend? I want something I can stick to the side of the case to reduce the space needed.

Hey everyone,

For the past few months, there has been a massive push in the indie hacking and self-hosted communities toward simplifying the database stack. Instead of spinning up an external managed PostgreSQL instance that costs $30 to $80 per month and adds 20-40ms of network hop latency on every single query, I decided to benchmark a single-binary PocketBase + SQLite setup under heavy load on a cheap $4/mo Hetzner CX22 instance (2 vCPU, 4GB RAM, Ubuntu 24.04).

Here is the exact setup, the benchmarks, and the production configs to run this safely with continuous disaster recovery.

The Concurrency Reality: Reads vs Writes in SaaS

The number one objection developers have to SQLite is that it locks the database on writes.

While true, SQLite in Write-Ahead Logging (WAL) mode allows concurrent readers while a write is occurring. Because typical SaaS products exhibit a 95:5 read-to-write ratio, tuning SQLite PRAGMAs handles immense concurrency without breaking a sweat:

PRAGMA journal_mode = WAL; PRAGMA synchronous = NORMAL; PRAGMA busy_timeout = 5000; PRAGMA cache_size = -64000; -- 64MB dedicated RAM page cache PRAGMA mmap_size = 268435456; -- 256MB memory-mapped file I/O PRAGMA temp_store = MEMORY;

With synchronous = NORMAL and busy_timeout = 5000, writer threads wait up to 5 seconds during transactions rather than throwing immediate SQLITE_BUSY errors.

Benchmarking Under Load (k6)

Running a 200 concurrent user load test hitting authenticated read endpoints:

status is 200: 100% latency < 10ms: 100%

http_req_duration: avg=2.84ms med=2.1ms p(95)=5.2ms p(99)=7.8ms http_reqs: 170,400 (1,420 rps)

P99 latency was under 8 milliseconds. Because SQLite is embedded inside the Go binary via in-process memory mapping (mmap), there is zero TCP serialization or network round-trip overhead.

Solving the Disaster Recovery Problem: Litestream + Cloudflare R2

The second objection is: What happens if the VPS drive physically dies?

We use Litestream to stream every SQLite WAL frame in real-time to Cloudflare R2 (which has zero egress fees).

Here is the /etc/litestream.yml config:

dbs:

• path: /var/www/pocketbase/pb_data/data.db replicas:

  • type: s3 bucket: my-pocketbase-backups path: production/data.db endpoint: https://<ACCOUNT_ID>.r2.cloudflarestorage.com access-key-id: <R2_ACCESS_KEY> secret-access-key: <R2_SECRET_KEY> retention: 720h # 30 days point-in-time recovery sync-interval: 1s

With this, your Recovery Point Objective (RPO) is under 1 second. If the server vanishes, restoring on a brand new box takes 1 command: litestream restore -config /etc/litestream.yml /var/www/pocketbase/pb_data/data.db

Edge Proxying & Automated SSL with Caddy

Put Caddy in front of PocketBase on 127.0.0.1:8090 to handle automatic certificates, HTTP/3, and real-time SSE buffer flushing:

api.yourdomain.com { encode zstd gzip header { Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY } reverse_proxy 127.0.0.1:8090 { header_up Host {host} header_up X-Real-IP {remote_host} flush_interval -1 } }

Cost Breakdown:

• Hetzner CX22 VPS: $4.15/month

• Cloudflare R2 Storage (Backups): $0.00/month (Free tier covers 10GB storage + $0 egress)

• Caddy SSL: $0.00/month

• Total: $4.15/month (vs $50+/month for managed Postgres + serverless compute).

Hope this breakdown helps anyone looking to escape managed database pricing.

Drop any questions below about WAL concurrency, schema migrations, or backup restoration tests—happy to share our benchmark scripts or systemd service templates!

I'm using unbound dns with oisd.nll blocklists to prevent tracking and seeing advertisements. Sometimes I'll get a 'we detect an ad blocker' banner.

I'm curious if projects like pixelserv-tls where a locally hosted 1px x 1px image is loaded in place of the ad still work in 2026. AI chat sessions say this approach doesn't work so well these days as adblock detection has gotten better.

Any other tips on a network wide adblock method would be appreciated. Thanks.

Hey, I'm trying to set up Jellyglance. I feel like I'm banging my head against the wall because I can't get it to start properly. It seems to be an issue with the password, but I've checked and double checked, and the password is accurate. I've changed the password and secret for the sake of security in this post. Not sure what I could do differently to get this app to launch... I'm setting this up with Portainer on a Raspberry Pi 4 running Raspberry Pi OS. I changed the port from 3000 to 6000 because I'm already running a different app on port 3000. If you have advice, I'd really appreciate it.

Docker Compose

services:
  jellyglance-db:
    image: postgres:16-alpine
    container_name: jellyglance-db
    restart: unless-stopped
    shm_size: "1gb"
    environment:
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: Z4vQLPL92dGqL2fBZatvHx1SgiP1JYtE
      POSTGRES_DB: jellyglance
    volumes:
      - postgres-data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready --dbname=jellyglance --username=postgres"]
      interval: 10s
      timeout: 5s
      retries: 5

  jellyglance:
    image: ghcr.io/nerdy-technician/jellyglance:latest
    container_name: jellyglance
    restart: unless-stopped
    depends_on:
      jellyglance-db:
        condition: service_healthy
    ports:
      - "6000:6000"
    environment:
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: Z4vQLPL92dGqL2fBZatvHx1SgiP1JYtE
      POSTGRES_IP: jellyglance-db
      POSTGRES_PORT: 5432
      POSTGRES_DB: jellyglance
      JWT_SECRET: cac0c70d9fde982b
      TZ: Europe/London
      CONFIG_DIR: /app/config
      BACKUP_DIR: /app/backups
    volumes:
      - ./config:/app/config
      - ./backups:/app/backups

volumes:
  postgres-data:

Error from logs

[MIGRATIONS] Waiting for database (27/30): password authentication failed for user "postgres"
Acquire connection error: error: password authentication failed for user "postgres"
    at parseErrorMessage (/app/node_modules/pg-protocol/dist/parser.js:306:11)
    at Parser.handlePacket (/app/node_modules/pg-protocol/dist/parser.js:143:27)
    at Parser.parse (/app/node_modules/pg-protocol/dist/parser.js:37:38)
    at Socket.<anonymous> (/app/node_modules/pg-protocol/dist/index.js:12:42)
    at Socket.emit (node:events:514:28)
    at addChunk (node:internal/streams/readable:568:12)
    at readableAddChunkPushByteMode (node:internal/streams/readable:519:3)
    at Readable.push (node:internal/streams/readable:399:5)
    at TCP.onStreamRead (node:internal/stream_base_commons:189:23)

From postgres

admin@xanthtastic:/etc/postgresql/17/main $ sudo -u postgres psql
psql (17.12 (Debian 17.12-0+deb13u1))
Type "help" for help.

postgres=# ALTER USER postgres PASSWORD 'Z4vQLPL92dGqL2fBZatvHx1SgiP1JYtE';
ALTER ROLE
postgres-# \q