Blog
Articles
Random notes on security, ops, NAS, and server tinkering · 45 posts
alist: I Installed It — Then Decided Not to Feed It My Cloud Accounts
A complete home-server alist deployment walkthrough: Docker Compose, reverse proxy and site_url, six hardening steps, mount strategy — and why I won't feed it my real cloud accounts.
Homelab Topology Evolution: A Half-Year Retrospective
How a single old host from February 2025 grew into a layered six-tier topology by mid-2026: what went right, the detours, and what gets dismantled next.
On My Blog Getting Scanned: Common Web Attack Patterns
Scanner fingerprints and exploit paths in a static site's access log — what's noise, what's a real alarm, and the cheap mitigations that actually matter.
Factorio Multiplayer and Mod Sync: The Server Is the Single Source of Truth
Headless deployment, whose mod list rules, version freezing, and save rotation — a practical memo on keeping six players in sync on a Factorio multiplayer server.
BorgBackup: Incremental Backups and a Restore Drill
Borg repo initialization, incremental backups, and a full restore drill from start to finish — plus how Borg and restic split the work in my homelab.
OpenResty Rate Limiting: A Thin WAF Layer for Your Site
limit_req, dropping scanner paths with 444, tightening the login endpoint, and how to keep real readers from getting 429'd.
Disk Health Monitoring: smartctl and Early-Warning Scripts
Which SMART attributes to watch, how to run patrol checks and alert, and why you should swap a drive before it goes read-only.
Headscale: Self-Hosting the Tailscale Control Plane
Self-hosted control plane, how to roll out ACLs gradually, database backups — and how to avoid locking yourself out of your own mesh.
Multi-Subnet DHCP with Relays: Turning Your Address Plan into a Table That Won't Blow Up
Centralized DHCP across multiple VLANs: relays, exclusions and reservations, lease lengths, and failover — one planning table you can copy and adapt before you touch the config.
Self-Hosting Email? The Postfix Reality Check
Deliverability, IP reputation, DNS records, and maintenance cost: why a full self-hosted mailbox is usually the wrong move for a homelab.
Palworld Dedicated Server: Deployment and Performance Tuning
SteamCMD, systemd, save backups, and how to keep 4–8 players happy on a 16 GB box — with real memory numbers from my own controlled testing.
Configuring Lab Linux Machines at Scale with Ansible
How my Ansible inventory grew from three IPs to groups, variables, and exception lists — common roles, check mode, and when not to automate.
Suricata IDS: Out-of-Band Deployment Notes
Running Suricata as a passive IDS on a switch SPAN port: cabling, HOME_NET baselines, false positives, and hand-verified alerts that become firewall rules.
Putting a Thermometer on Your Switches: SNMP Monitoring
Using SNMP to collect switch CPU, optical power, port errors, and traffic: version choice, secure community strings, and alert de-noising.
ZFS Snapshots and Scrubs: Data-Integrity Gymnastics
Monthly scrubs, how to keep snapshots, why disk space won't come back, and where snapshots stop and offsite backups begin.
Self-Hosting Vaultwarden: You're the SRE Now
HTTPS, backups, 2FA, and an emergency exit: the real obligations to think through before you self-host a password vault.
k3s on One Node: A Lightweight Kubernetes Lab
A single-node k3s install, a four-week learning path, how it coexists with Docker Compose — and what you shouldn't put in it.
Game Server DDoS Defense: Cloudflare vs. High-Protection IPs
Who friend-only VPN servers, hidden IPs, relay tunnels, and high-protection IPs are each for — plus the order of operations when your game server gets attacked.
Wired 802.1X + RADIUS: Making Wall Ports Authenticate Before They Connect
Hardening office wired ports with 802.1X: switch authentication modes, RADIUS against AD accounts, failed-auth VLANs, and a phased rollout that won't lock IT out of the building.
1Panel, One Year In: What It Actually Saves You — and Where It Bites
Certs and site scaffolding are real wins, but the panel port, update snapshots, and a near-miss directory overwrite are pitfalls worth knowing in advance.
Frigate NVR: Local Cameras and AI Detection, Without the Cloud Subscription
RTSP streams, detection resolution, notification spam, recording retention math, and where I draw the privacy line — running a local Frigate NVR with a Coral.
How I Took Over My Family's DNS with AdGuard Home
Where to run it, which upstreams and filter lists to stack, devices that hard-code DNS — and what to do when someone reports
Security Headers and CSP for This Blog: What I Actually Turned On
HSTS, CSP in report-only mode, what's worth it on a static site, and how to verify headers when Cloudflare sits in front.
Branch Site-to-Site VPN: Address Planning Beats Tunnel Algorithms
HQ-to-branch IPsec and route-based tunnels: overlapping subnets, interesting traffic, dual-WAN drift, and a sane troubleshooting order.
restic, Done the 3-2-1 Way: Local and Offsite Backups
Making 3-2-1 concrete: local disk plus B2/S3, restic init, scheduling, retention policy, and restore drills.
Home Network Segmentation: VLANs for Cameras and IoT
Segmenting home networks into trusted, IoT, and guest VLANs: firewall principles, the rollout order, and why printers and screen mirroring fought back.
Running a Terraria Multiplayer Server with systemd
A complete guide to running the official Terraria dedicated server under systemd: install, serverconfig, unit breakdown, and how to back up world files safely.
Private Git with Gitea: Deployment, Backups, and Permission Habits
A full Gitea deployment record: container setup with Postgres, what to back up, permission habits, and why important repos still get mirrored off-site.
Dual WAN Egress: Policy Routing and Active/Standby Failover in Practice
Telecom + Unicom dual uplinks: an active/standby default route, policy routing that pins critical services to a specific line, and how to handle sessions during switchovers and drills.
Proxmox VE: LXC or a Full VM?
What belongs in an LXC container and what deserves a full VM on your Proxmox box — plus how storage and backups follow that choice.
Reading an SSH Brute-Force Log: Starting with fail2ban
Rebuilding the attack profile from auth.log, checking whether your current controls are enough, and shrinking the listening surface.
Traefik Reverse Proxy with Automatic HTTPS Certificates
Unify port 80/443 with Traefik: Docker labels, ACME, security-header middleware, and why the dashboard must never be exposed naked.
Immich on the NAS: Ditching the iCloud Photos Subscription
Deploying Immich on my NAS: how to split the volumes, back up the phone, and coordinate ZFS snapshots with off-site restic copies.
Office VLANs and L3 ACLs: A Segmentation Map You Can Explain to Your Boss
Splitting a small office out of one flat /24: VLAN/SVI planning, a minimal ACL set, a safe change order, and why printers and scanners cry afterward.
OpenWrt on N100: Flashing My Router, Splitting My Traffic
Bridge-mode ONT plus an N100 OpenWrt gateway: a field report on my home network rebuild — motivation, the switch-over, VLANs, and safe upgrades.
Prometheus + Grafana: Keeping an Eye on the Machines at Home
A usage log, not an install guide: the four panels I actually open every morning, what's worth alerting on, and how monitoring once ate its own disk.
Minecraft Java Server Setup and a Curated Plugin List
An ops handbook for a small five-or-six-player Minecraft server: an install checklist, daily start/stop, lag troubleshooting, and backup & upgrade checklists.
Cloudflare Tunnel: The Safe Way to Expose Internal Services
One person's migration from flaky port forwarding to Cloudflare Tunnel + Access, and the security habits that came with it.
Building Our Company's AD Domain: From Workgroup to a Manageable Identity Base
Moving a small business from workgroups to Active Directory: DC sizing, the OU/GPO skeleton, DNS coupling, and how to sequence the go-live window.
Managing My Home Server Stack with Docker Compose
A walk down the /opt/stack directory tree: the proxy network, volumes and .env, the update cadence, and one full move-to-a-new-machine drill.
SSH Keys and fail2ban: The Minimal Host-Hardening Checklist
Harden a public-facing SSH server with a minimal checklist: ed25519 keys, an annotated sshd drop-in, fail2ban, and ufw — and how I locked myself out.
Computer Lab Screen Broadcast: From Slideshow to Multicast Tuning
A full investigation of laggy classroom screen broadcasting: broadcast storms, IGMP snooping, switch queues, and the software settings to change together.
TrueNAS SCALE: Installing It Is Easy, Planning the Pool Is the Hard Part
Four 4TB drives, three layouts: the capacity and fault-tolerance math of mirrors vs. RAIDZ, dataset splitting by pain level, and a snapshot calendar.
Building Your Own WireGuard VPN: Tying Home and Cloud Together
Standing up a WireGuard hub on a VPS: draw the address table and AllowedIPs policy before touching any conf file, then sort out forwarding, keepalives, and the return path.
Homelab Kickoff: Building My First Linux Server from an Old PC
Turning a dusty 2018 mini PC into an always-on Ubuntu Server: a seven-day diary from power math to key-only SSH and a first service that survives a reboot.