I have written a small blog post about how to Bypass CGNAT, and have also mentioned why you should not use Cloudflare if you are hosting for privacy.

6th gen’s integrated GPU cannot decode HEVC.

My optiplex with i5-6500TE can transcode 4K videos easily if the codec is AVC. HEVC is different story though. Any CPU newer than 10th generation would be more than enough for your needs, I’d say.

Source of the last point?

Not sure. Will have to try it out.

All ports are forwarded. If your SMTP is running on, say, port 993, on your local machine, your-VPS-ip:993 will be your SMTP.

We can sell the games on steam?

Get out of here, redditor.

I am not sure what you mean.

The issue is, when using Cloudflare, they will terminate your TLS, then encrypt the data again with their own certificate, which is send to the visitor. When visitor interacts, their data is decrypted on Cloudflare’s servers, which they encrypt again eith our original certificate and send it back to us.

Sure, hackers or sniffers might not be able to look at the sensitive data, but Cloudflare can. But do they, or do they not, is upto you, if you trust them or not.

If you are using the exact rules mentioned in my post, only the ports of your machine will be forwarded, not your entire local network. If you want to forward ports of more than one machine, look at the github link in the sources, it contains a detailed documentation of how to achieve that. Since, I do not know a lot about iptables, I may not be the best person to guide you, in this case. However, feel free to DM me, I’ll might be able to help.

Yes, it is fairly easy. You just have to forward the http headers. I am using HAProxy, and you can look at my configuration file in the blog. If you’re using something like Nginx Proxy, look up how to forward http heards. Some applications, like Nextcloud, require extra steps, but they also provide their own documentation.

I am not sure, actually. Look at the sources, and you’ll find the original GitHub link from where I took it. I am not very well versed with iptables.

I wrote a small blog about bypassing CGNAT using TLS-passthrough. Cloudflare uses TLS-termination, which means they can see all the data being passed through, which defeats the purpose of privacy.

https://blog.aiquiral.me/bypass-cgnat

I’ve tried hosting an nginx server. It is fun, but I wouldn’t rely on it for production use cases.

I’ve also seen some people run docker on their android devices.

Thank you for these suggestions. But I have a few questions.

How can I do the 2nd and 3rd point if I am using docker/podman containers?

Why is ClamAV useless?

AFAIK, Piped always proxies the videos through a server.

I am more familiar with Invidious. Find an Invidious server that lets you enable proxying. Some examples are yewtu.be, invidious.protokolla.fi and inv.nadeko.net. Then find an RSS app that lets you download the content, as well as supports cookies. Use the invidious server’s cookies in your RSS app to proxy the content you download. Invidious servers can provide RSS feeds for individual channels, as well as your complete subscription feed.

And if possible donate a dollar or two, regularly, to the invidious server that you use, since it takes up a lot of bandwidth and motivates the hoster to keep up what they are doing.

Thanks! But I am not much of a gamer.

Half of me wants to upvote this. Half of me wants to downvote this.

6. If you are self hosting for privacy, I recommend staying away from Cloudflare, that is, not to use their proxying service or Cloudflare tunnel.

More information here - https://blog.aiquiral.me/bypass-cgnat

You could try seitan. It is basically pure gluten. People say it has a very meat like texture (I’ve never tasted meat so I cannot tell you for certain).