Homelab & Infrastructure on vo.rs

Vaultwarden: Self-Hosting a Password Manager You Actually Control

Fri, 19 Jun 2026 10:00:00 +0000

A password manager is the single most important piece of software most people never think about. It quietly holds the keys to your email, your bank, your tax account, and the embarrassing forum you joined in 2009 and forgot to delete. Handing that responsibility to a cloud service is perfectly reasonable, and the big providers do a genuinely good job. But if you would rather your encrypted vault lived on a box in your own cupboard than on someone else’s servers, Vaultwarden is the project that makes self-hosting practical without demanding you become a cryptographer first. This guide walks through what it is, how to stand one up safely, and the honest trade-offs you accept when you take the keys back.

Tailscale: A Zero-Config Mesh VPN for People Who Hate Networking

Tue, 16 Jun 2026 14:00:00 +0000

Setting up a traditional VPN is one of those tasks that looks simple in the brochure and turns into a weekend of misery in practice. You allocate subnets, open ports on a router you may not control, wrestle with NAT, distribute keys, and then discover that two clients behind the same carrier-grade NAT cannot talk to each other no matter how politely you ask. Tailscale exists because someone got tired of all that. It promises a private network where every device can reach every other device, with essentially no configuration, and for the most part it delivers.

Uptime Kuma: Self-Hosted Monitoring That Warns You Before Your Users Do

Fri, 12 Jun 2026 09:30:00 +0000

There are two ways to learn that your website is down. The first is a polite alert on your phone at the first sign of trouble, giving you time to fix it quietly. The second is an angry message from a user, a customer, or your boss, after the outage has already done its damage. Uptime Kuma exists to make sure you get the first kind. It is a self-hosted monitoring tool that watches your services and shouts the moment one stops answering — and it is genuinely pleasant to use.

The Home Lab Upgrade Trap: When Good Enough Should Be Good Enough

Mon, 08 Jun 2026 09:00:00 +0000

There’s a particular flavour of evening every home-labber knows. The lab is running fine. Everything you actually use is up. And yet you find yourself three tabs deep on a marketplace, comparing the second-hand price of a faster CPU, a bigger NAS, more RAM you do not need, against the box you already own that is, by every honest measure, sufficient. This is the upgrade trap, and it has cost me more money and more weekends than any actual technical failure.

One-Click Everything: Deploying Self-Hosted Apps with Coolify

Fri, 05 Jun 2026 08:30:00 +0000

My Heroku bill was £41 a month for three toy projects that between them served maybe two hundred requests a day. None of them made money; all of them existed because I couldn’t be bothered to run a server. That is the exact psychology the managed platforms are built on: you connect a Git repository, push a commit, and moments later your application is live with a valid HTTPS certificate, a database attached, and a URL to share. Heroku pioneered the feeling, Vercel and Netlify polished it, and a generation of us grew used to never touching a server. The catch is the meter — billed by the seat, the build minute, and the gigabyte — and the numbers add up faster than the value does.

Build Your Own Google Drive: A Practical Nextcloud Setup on Linux

Sat, 30 May 2026 15:00:00 +0000

Cloud storage is wonderfully convenient right up until you read the fine print. Your files sync everywhere, your photos back themselves up, your calendar follows you between devices, and in exchange a very large company gets a detailed map of your life and the right to change the terms whenever it likes. The number that finally pushed me was 2 terabytes: that’s what my household photo library, document archive, and assorted detritus had grown to, and renting that much storage from a big provider in perpetuity, forever, with my data as the collateral, stopped feeling like a deal. Nextcloud is the open-source answer to that bargain: a self-hosted platform that gives you file sync, calendars, contacts, and even office documents, all running on a Linux box you control. This guide gets a robust Nextcloud running with Docker, puts it behind HTTPS, connects your devices, and sets sensible expectations about how it compares to the polished giants.

Self-Hosting Is Not Free: Accounting for Your Own Time

Wed, 27 May 2026 11:00:00 +0000

We love to tell ourselves a story about self-hosting: cancel the £10/month subscription, run the open-source equivalent at home, and pocket the difference. It’s a satisfying story. It’s also, in cold accounting terms, frequently nonsense — because the one cost we never put on the spreadsheet is the most expensive one we own. Our own time.

I’m not writing this to talk you out of self-hosting. I host more than is sensible, and I’d do it again tomorrow. But I’ve watched too many builders justify a setup on pure financial grounds, then quietly spend forty hours a year keeping it alive while telling themselves they “saved money”. The electricity bill is easy to reckon with — I’ve done that sum in detail in the real cost of self-hosting — but the time bill is the one nobody writes down, and it’s usually the bigger number. Let’s be honest about the ledger.

From GitHub to Git Home: Self-Hosting Your Repositories with Gitea

Sat, 23 May 2026 13:00:00 +0000

Git was designed to be distributed. Every clone is a full copy of the history, which means no single server is special and no company holds your project hostage. Yet somewhere along the way the world decided that “git” and “GitHub” were synonyms, and a vast amount of the world’s source code now lives on infrastructure owned by a single corporation. That is convenient right up until it is not. If you have ever wanted a home for your repositories that you fully control, that runs on a Raspberry Pi or a spare VPS, and that boots in milliseconds, Gitea is the answer. This guide gets you from nothing to a running, self-hosted git forge you can push to over SSH.

eGPU via OCuLink: Adding a Desktop GPU to a Mini PC

Tue, 19 May 2026 16:00:00 +0000

For years the external GPU story was a sad one: Thunderbolt enclosures that cost as much as a mid-range card, ate a third of your bandwidth in overhead, and dropped the link if you breathed on the cable. OCuLink quietly changed that. It’s an external PCIe connector — no protocol translation, just raw PCIe lanes on a cable — and a growing number of mini PCs now ship with a port. I’ve been running a desktop GPU off a palm-sized machine for a few months, and it’s the first eGPU setup I’d actually recommend.

Borg vs Restic: Painless Encrypted Backups You'll Actually Run

Sat, 16 May 2026 08:00:00 +0000

The only backup I have ever needed in a genuine emergency was the one I almost did not have. A failing SSD, a half-corrupted home directory, and the cold realisation that the “backup” I had been meaning to set up for months did not exist. I got lucky that time. The reason I had no backup was not ignorance — I knew exactly why I needed one. It was friction. A scheme that is fiddly, slow or expensive simply does not get run, and an un-run backup is worth precisely nothing the day the disk dies.

Power Monitoring with Home Assistant: Tracking What Your Home Lab Actually Costs

Fri, 15 May 2026 07:00:00 +0000

I used to wave away questions about what my home lab cost to run with a confident “oh, not much”. Then I put a meter on it. The rack idles at 140 watts, which doesn’t sound like a lot until you do the maths: 140W is roughly 1,226 kWh a year, and at my tariff that’s about £370 just to keep the lights blinking. Measuring it didn’t make it cheaper, but it stopped me lying to myself, and it surfaced a couple of genuine surprises. The whole exercise takes an evening and one cheap smart plug, and the data it produces is the kind you can actually act on rather than the vague guilt of a quarterly bill that lumps the lab in with the kettle and the tumble dryer.

MQTT Essentials: The Protocol Behind Every Smart Home

Mon, 11 May 2026 14:00:00 +0000

If you’ve spent any time poking at a smart home, you’ve bumped into MQTT whether you meant to or not. Zigbee2MQTT, ESPHome, Tasmota, Home Assistant’s own internal bus — they all lean on it. It’s worth understanding properly, because once you do, an awful lot of “magic” stops being magic and starts being a handful of topics and a tiny broker process.

What it actually is

MQTT is a publish/subscribe messaging protocol. It was designed in 1999 by Andy Stanford-Clark of IBM and Arlen Nipper for monitoring oil pipeline telemetry over expensive, unreliable satellite links, which tells you everything about its priorities: tiny payloads, low overhead, and tolerance for flaky connections. When every byte over the satellite costs money and the connection might drop mid-sentence, you design a protocol that says as little as possible and copes gracefully when it’s cut off. Those constraints turned out to describe a battery-powered wireless sensor in a spare bedroom almost perfectly, which is why a two-decade-old industrial protocol quietly became the backbone of the consumer smart home. Devices don’t talk to each other directly. They talk to a broker — a small server that receives messages and fans them out to whoever has subscribed.

Kubernetes Without the Headache: A Single-Node K3s Cluster on a Raspberry Pi

Sat, 09 May 2026 11:00:00 +0000

The first Kubernetes cluster I ran at home cost me about forty pounds and drew less power than a night light. It was a single Raspberry Pi 4 with K3s on it, and within an evening it was serving a real web app through a real ingress controller — the same building blocks that front production clusters ten thousand times its size. That is the pitch in one sentence: you can learn the thing that runs the modern internet on hardware you would happily drop from a desk.

ESPHome: Building Custom Sensors for Home Assistant

Tue, 21 Apr 2026 10:00:00 +0000

There is a particular joy in solving a problem with three quid of silicon instead of forty quid of someone else’s cloud-tethered gadget. ESPHome is the tool that makes that joy repeatable. You describe a device — its WiFi, its sensors, its outputs — in YAML, ESPHome compiles real C++ firmware, flashes it onto an ESP32 or ESP8266, and the device shows up in Home Assistant automatically with no cloud, no app, and no telemetry leaving your house. I’ve built temperature monitors, soil moisture sensors, a letterbox-open detector, and a CO₂ meter this way, and every one was easier than wiring up the equivalent off-the-shelf product.

Zigbee2MQTT vs ZHA: Home Assistant Zigbee Integrations Compared

Sun, 12 Apr 2026 09:00:00 +0000

I once spent a Sunday evening re-pairing forty-two Zigbee devices one at a time, standing on chairs to reach ceiling sensors, because I’d decided — six months too late — that I’d picked the wrong integration. That is the whole reason this article exists. The choice between ZHA and Zigbee2MQTT looks like a five-minute decision when you’re setting up your first three bulbs. It isn’t. It’s a decision you live with for years, because migrating a meshed network of fifty devices from one coordinator software to another is exactly the kind of tedious evening you only want to do once, and preferably never.

ZFS for Mortals: Snapshots, Scrubs, and Surviving a Dead Disk

Fri, 10 Apr 2026 10:00:00 +0000

Most filesystems are optimists. They write your data, assume the disk told the truth, and trust that the bytes you read back tomorrow are the bytes you wrote today. ZFS is a pessimist, and that pessimism is exactly why people who care about their data fall in love with it. It checksums everything, verifies what it reads, repairs what it can, and tells you loudly when it cannot. Born at Sun Microsystems and now thriving as OpenZFS on Linux, FreeBSD, and macOS, it folds the volume manager, the RAID layer, and the filesystem into one coherent whole. This guide walks you through the ideas and the actual commands you need to run ZFS at home without a degree in storage engineering.

Earthly: Containerized Build Pipelines That Combine Dockerfile and Makefile

Mon, 06 Apr 2026 08:00:00 +0000

Every project I’ve maintained eventually grows a Makefile full of build, test, lint, and release targets that work beautifully on my machine and nowhere else. The targets assume a particular toolchain, a particular OS, particular environment variables. Then CI does something subtly different, and you maintain two parallel descriptions of the same build forever. Earthly is the tool that finally made me delete that duplication. It’s what you get if a Makefile and a Dockerfile had a child who insisted everything run in a container.

Set It and Forget It: Automating Linux Patches with unattended-upgrades

Fri, 03 Apr 2026 08:45:00 +0000

The most common way servers get compromised is not some dazzling zero-day wielded by a nation-state. It is a known vulnerability, with a published fix that has been sitting in the distribution’s repositories for weeks, on a box where nobody ran the update. I have cleaned up after exactly this more than once — a forgotten VPS, a “temporary” test host that quietly became load-bearing, a machine everyone assumed someone else was maintaining. Every time, the fix had been available for ages. Patching is unglamorous, trivially easy to defer, and quietly catastrophic when neglected. The only reliable answer is to take human procrastination out of the loop entirely — and on Debian and Ubuntu, the tool that does it is unattended-upgrades.

Reverse Proxy Done Right: Automatic HTTPS with Caddy in Ten Minutes

Tue, 31 Mar 2026 13:00:00 +0000

The last time I set up HTTPS the old-fashioned way, I spent forty minutes on the web server config and another twenty wiring Certbot into a cron job, then forgot about it — until eleven weeks later when a certificate quietly expired at 3am and I woke up to a wall of browser warnings. The renewal timer had been silently failing for a month. That is the classic Certbot failure: it works right up until the one time it doesn’t, and you only find out when a padlock turns red in production. Caddy exists to make that entire class of problem disappear. It obtains valid HTTPS certificates for you, renews them before they expire without any timer for you to forget about, and routes traffic to your applications using a configuration file short enough to read in a single breath. By the end of this guide you will have two services sitting safely behind it with proper TLS and roughly ten minutes of effort. This is what a reverse proxy is supposed to feel like.

Pi-hole Meets Unbound: Network-Wide Ad Blocking and Truly Private DNS

Tue, 24 Mar 2026 10:00:00 +0000

Browser ad blockers are good, but they only protect the browser. Your smart TV, your phone’s apps, the various gadgets quietly phoning home across your network, none of them benefit from an extension you installed on a laptop. Pi-hole solves this at the source by blocking unwanted domains for every device on your network at once. Pair it with Unbound and you go a step further, resolving DNS yourself rather than trusting a third party with the record of every site you visit. This guide builds that combination, explains why each piece matters, and is candid about the gotchas. If you have ever cleared a DNS cache to fix a stubborn lookup, you already understand more of this than you think.

Devcontainers: Reproducible Development Environments in VS Code

Tue, 17 Mar 2026 11:00:00 +0000

I have lost enough hours to “but it works on my machine” that I treat the phrase as a personal insult. The last time it cost me a full afternoon: a teammate cloned a repo, their Node version was a major release behind, a native dependency wouldn’t compile because they were missing a system library, and we both vanished into apt-get archaeology while the actual work sat untouched. Devcontainers fix this by moving the whole development environment into a container described by a file that lives in the repo. Clone, reopen, build, work. That’s the promise, and after a couple of years of leaning on them I’ll say it mostly delivers — with some sharp edges I’ll be honest about.

The Tunnel Home: Reaching Your Homelab from Anywhere with WireGuard

Tue, 17 Mar 2026 08:00:00 +0000

Picture the scene: you are on a train, you want to check a service running at home, and your options are to expose that service to the entire internet or to go without. For years the answer to this dilemma was a clunky VPN that took an afternoon to configure and never quite behaved on mobile. WireGuard changes the calculus completely. It is a modern virtual private network so lean that its entire configuration fits in a file you can read at a glance, fast enough that you forget it is there, and secure enough that it has been merged into the Linux kernel itself. This guide builds a WireGuard tunnel from scratch so you can reach your homelab from anywhere without exposing a single service to the open web.

Proxmox 101: Turn One Old PC into a Virtualization Powerhouse

Tue, 10 Mar 2026 09:15:00 +0000

That old desktop in the cupboard, the one too slow for modern games but far too capable to bin, is a homelab waiting to happen. With Proxmox VE you can carve a single physical machine into a dozen virtual ones, each isolated, each snapshot-able, each ready to host a different service. Instead of one box doing one job, you get a flexible platform where you can spin up a test server in two minutes and throw it away just as fast. This guide explains what Proxmox is, what hardware it needs, how to install it, and how to plan a sensible first homelab that complements the self-hosted services covered elsewhere on this blog.

Pre-commit Hooks: Catching Mistakes Before They Reach the Repo

Mon, 09 Mar 2026 14:00:00 +0000

There is a particular flavour of shame that comes from pushing a commit, watching CI light up red ninety seconds later, and discovering the failure was a trailing-whitespace lint error or a file you forgot to format. Worse is the commit that ships a cloud access key in a .env you meant to gitignore, now etched into history forever. I have done both. The whitespace one wastes ten minutes; the leaked-key one cost me an afternoon of rotating credentials and grovelling in a channel. Pre-commit hooks catch all of it at the only moment it is cheap to catch: before the commit exists. Git has always supported hooks; the pre-commit framework just makes them sane to manage.

Ditch Plex: Building a Bulletproof Jellyfin Media Server on Linux

Tue, 03 Mar 2026 10:00:00 +0000

There was a golden age when Plex felt like magic: you pointed it at a folder of films, and suddenly your living room television displayed glossy posters, plot summaries, and trailers as if you ran a private streaming service. For a steady stream of long-time users that magic has slowly curdled into nagging account prompts, paywalled features, and the creeping sense that the software guarding your own files now answers to someone else. If you have started eyeing the monthly subscription column of your bank statement with suspicion, this guide is for you. We will build a media server that is genuinely yours, runs on a modest Linux box, transcodes video efficiently, and never once asks you to log in to a remote service to watch the films sitting on your own hard drive.

Minio: S3-Compatible Object Storage in Your Cluster

Tue, 03 Mar 2026 07:00:00 +0000

Half the software I self-host now expects an S3 bucket to throw things into. Backup tools, container registries, CI artifact stores, Loki for logs, photo libraries — they’ve all standardised on the S3 API as the lingua franca of “somewhere to put blobs”. You can hand all of them an AWS account and a credit card, or you can run Minio and have a real S3-compatible endpoint inside your own cluster, on your own disks, with no egress bills and no surprise invoices. I’ve run it for years and it has quietly become load-bearing infrastructure.

Taskfile: A Modern Task Runner That Replaces Make Without the Pain

Sat, 28 Feb 2026 09:00:00 +0000

I have a long and complicated relationship with make. It is everywhere, it is reliable, and it has been quietly running the world’s builds for nearly fifty years. It also punishes you with significant whitespace, a recipe language that is really shell-inside-make-inside-shell with three layers of escaping, and the eternal indignity of Makefile:12: *** missing separator. Stop. because you typed spaces where a literal tab was required. For most of what people actually use Make for these days — not building C, but running a handful of project commands — Taskfile is the replacement I wish I’d switched to years ago.

Snowflake and Tor: What Censorship Circumvention Looks Like in 2026

Tue, 24 Feb 2026 09:00:00 +0000

Censorship circumvention used to be a simple arms race: you’d point your traffic at a proxy, the censor would block the proxy’s address, you’d find another. By 2026 the censor has graduated. Modern national firewalls don’t just block known addresses — they fingerprint the shape of your traffic, and they’ll happily throttle or drop a connection that merely looks like Tor even if they can’t read it. The interesting story now is how Tor has evolved from “hide the destination” to “don’t even look like Tor in the first place”, and Snowflake is the most elegant piece of that puzzle.

Docker Compose Demystified: A Full Stack in a Single File

Fri, 20 Feb 2026 09:00:00 +0000

The fastest way to lose a weekend is to stand up a self-hosted app by hand, get it working at 2am, and then need to rebuild it six months later from memory. I’ve done it. The container’s exact flags — the volume path, the network name, the three environment variables it absolutely needed — lived only in my shell history and the increasingly unreliable part of my brain that thinks it remembers things. When the SD card died, so did all of it.

Act: Running GitHub Actions Locally Before You Push

Fri, 13 Feb 2026 08:00:00 +0000

We have all done the thing. You tweak a workflow file, you can’t run it locally, so you push a commit called “fix ci”, watch it fail, push “fix ci 2”, fail, “actually fix ci”, fail, and by the time it’s green your git history reads like a cry for help. The feedback loop on GitHub Actions is dreadful precisely because the only way to test it is to use the production system itself, slowly, in public. act fixes that by running your workflows locally in Docker.

Renovate Bot: Automated Dependency Updates That Don't Break Everything

Sat, 07 Feb 2026 10:00:00 +0000

Last spring I opened a side project I hadn’t touched in eighteen months and ran npm install. The lockfile resolved to 340 packages, 61 of which had known advisories, and the top-level framework was four major versions behind. Bumping it meant chasing breaking changes through a dependency tree I’d forgotten the shape of. I lost most of a Saturday, and the whole mess existed for one reason: I’d let the updates pile up until they became a project instead of a chore.

Neovim in 2026: A Practical Setup for People Who Also Have Work to Do

Tue, 20 Jan 2026 09:00:00 +0000

Neovim has a reputation, and it isn’t entirely undeserved: the editor you spend a weekend configuring instead of using. I’ve lost those weekends. I’ve stayed up until 2am chasing a plugin conflict that turned out to be a load-order problem, and I’ve rebuilt my config from scratch more times than I’ll admit in writing. I’ve also come out the other side with an editor I genuinely prefer to anything else — and the good news, the whole reason for this post, is that in 2026 you no longer have to pay that tax. The ecosystem has matured into a small set of plugins that do the heavy lifting, and a sensible config is now a few hundred lines of readable Lua rather than a haunted 3,000-line init.vim inherited from a stranger’s dotfiles. This is the setup I’d hand someone who wants a capable editor and also, crucially, has actual work to do this week.

OCR Pipelines: Tesseract, PaddleOCR, and When to Use Which

Mon, 05 Jan 2026 11:00:00 +0000

I have a filing cabinet’s worth of scanned documents — receipts, appliance manuals, the occasional important letter from an institution that still believes firmly in paper — and a stubborn refusal to feed them through a cloud OCR service that charges per page and keeps a copy of everything for its own purposes. So I run optical character recognition locally, on my own hardware, and I’ve done it long enough to have opinions. The good news is that self-hosted OCR has quietly become genuinely excellent, good enough that “just use a cloud API” is no longer the obvious answer it was five years ago. The bad news is that there are two serious contenders, they’re good at different things, and the internet is full of people insisting their favourite is universally best. It isn’t, in either direction. Let me save you the afternoon I lost finding that out the hard way.

mTLS: Mutual TLS Between Services Without a Service Mesh

Thu, 11 Dec 2025 16:00:00 +0000

The incident that made me care about mutual TLS was embarrassingly mundane. A metrics scraper on one of my hosts had been quietly hitting an internal API for months. When I finally audited what could actually reach that API, the answer was: anything on the same network segment. The service checked no identity at all. It answered a request the way a shop assistant answers a stranger — politely, completely, and with no idea who it was talking to. Nothing had gone wrong yet. But “nothing has gone wrong yet” is not a security posture, it’s a countdown.

DNS Sinkholing: Blocking Malware Domains at the Network Level

Sun, 09 Nov 2025 16:00:00 +0000

A few years ago I watched a brand-new “smart” plug on my network try to reach roughly forty different domains in its first hour of life — telemetry endpoints, a couple of ad networks, and one domain that a threat feed flagged as a known command-and-control host. I hadn’t installed anything on it; I couldn’t. It’s a sealed appliance with no SSH, no agent, no way in. The only thing standing between that plug and whatever it was trying to phone was the resolver it asked for an address. That resolver said “no”, and the connection died in the device’s own network stack before a single packet left my house.

Sigstore and Cosign: Verifying Container Images Before They Run

Fri, 17 Oct 2025 14:00:00 +0000

A container tag is a lie you’ve agreed to believe. nginx:latest today and nginx:latest next week can be entirely different bytes, and a tag tells you nothing about who built the image or whether it’s been swapped underneath you. The whole modern supply-chain panic — compromised build pipelines, typosquatted images, dependency confusion — comes down to that one weak link: we run images we can’t actually verify. Sigstore, and its CLI cosign, is the most practical fix I’ve adopted, mostly because it finally killed the part of signing that everyone hated: key management.

Kubernetes Resource Requests and Limits: The Difference Between Crashing and Thriving

Mon, 08 Sep 2025 10:00:00 +0000

I once spent the better part of a Saturday chasing a pod that vanished every few hours on my home cluster. No crash logs, no panic, nothing in the application output — the container simply wasn’t there when I looked, and its restart count kept ticking up. The describe output eventually gave it away: OOMKilled, exit code 137. The pod had a 256Mi memory limit copied from a blog post, and a nightly job inside it briefly allocated 400Mi. The kernel did exactly what it was told and shot the process. Nothing was flaky. I had told Kubernetes to kill it.

Distroless Container Images: Smaller, Safer, and More Annoying to Debug

Thu, 21 Aug 2025 11:00:00 +0000

The first time you run a vulnerability scanner against a node:20 image and it reports two hundred CVEs, you have a small crisis of faith. None of those flaws are in your code. They’re in bash, curl, apt, coreutils, the Debian base — an entire operating system you shipped just to run one process. Distroless images are the reaction to that absurdity: a container image containing your application, its runtime dependencies, and nothing else. No shell. No package manager. No ls. The CVE count drops because the attack surface drops, and that’s not a coincidence — it’s the whole point.

ArgoCD: GitOps with a Dashboard You Might Actually Use

Mon, 11 Aug 2025 09:00:00 +0000

I came to GitOps grudgingly. The pitch — “Git is the single source of truth, the cluster reconciles itself to match” — sounded like the kind of slogan that survives precisely one production incident. Then I tried to debug a drifting Kubernetes cluster the old way, kubectl apply-ing manifests by hand and trying to remember which of three engineers had hotfixed what, and I came round. ArgoCD is the tool that converted me, mostly because of one thing the others don’t do nearly as well: it shows you the state of the world.

Container Networking Debugging: tcpdump, nsenter, and What Packets Are Actually Doing

Thu, 17 Jul 2025 16:00:00 +0000

I once spent the better part of an evening convinced a node in my home lab had a broken bridge. An app container kept logging connection refused against its database, the database was clearly up, and I’d restarted both more times than I’d like to admit. Three layers of NAT, a Docker bridge and a stack of iptables rules all insisted they were innocent, and I had no way to call their bluff — because the app image was a stripped-down distroless thing with no ping, no curl, no tcpdump, nothing you’d actually use to look. So I guessed. Eventually it “fixed itself” after a redeploy, which is the worst possible outcome: the problem was gone and I still didn’t know what it had been.

Dagger: CI/CD Pipelines as Code That Run Anywhere

Mon, 07 Jul 2025 11:00:00 +0000

The single most demoralising thing about CI is the feedback loop. You edit a YAML file, push, wait three minutes for a runner to spin up, watch it fail on a typo, fix the typo, push again. Repeat until either the pipeline goes green or you go home. I once burned an entire afternoon — eleven pushes, I counted — chasing a pipeline failure that turned out to be a misindented with: block, because the only way to run the pipeline was to push and pray. The pipeline existed only inside the CI provider, so the provider was the only thing that could execute it. Dagger’s whole pitch is that this is daft, and they’re right.

Voice Assistants Without the Cloud: Whisper, Piper, and Home Assistant

Sun, 22 Jun 2025 09:00:00 +0000

I have always found something faintly insulting about commercial smart speakers. You buy a microphone, put it on your kitchen counter, and then pay a subscription to a company that would dearly love to know what brand of coffee you argue about at breakfast. The convenience is real, but the bargain is rotten. So a couple of years ago I tore the cloud out of my voice setup entirely, and the technology has matured to the point where I can finally recommend it without a disclaimer the length of a mortgage agreement.

Beyond VPNs: Leveraging Secure Access Service Edge (SASE) for Remote Workforces

Sat, 17 May 2025 17:25:00 +0000

The clearest sign your remote-access VPN has outgrown its design is the tromboning. A salesperson in the same city as your cloud provider opens their laptop, connects to a SaaS app that lives twenty miles away, and their traffic first flies several hundred miles to the corporate VPN concentrator, gets inspected, then flies several hundred miles back out to the cloud. Round trip: a thousand miles to reach something next door. Everyone blames “the internet being slow.” The internet is fine. The architecture is the problem.

Digital Sovereignty in the EU: Navigating Schrems II, GDPR, and Local Hosting Mandates

Thu, 08 May 2025 14:50:00 +0000

On 16 July 2020 the Court of Justice of the European Union threw out the EU-US Privacy Shield, and an awful lot of European companies discovered overnight that the legal basis for storing their users’ data in an American cloud had evaporated. The case is known as Schrems II, after the Austrian lawyer Maximilian Schrems who spent the better part of a decade dragging Facebook’s data transfers through the courts. The ruling did not say “you may never send data to the US.” It said something more awkward: that you, the data exporter, are now personally on the hook for proving that the country you ship data to protects it to an EU standard — and that for the US specifically, given what the NSA was doing, that protection was inadequate.

Automated Chaos: Using Fault Injection to Build Resilience Before Your Users Notice

Mon, 28 Apr 2025 10:40:00 +0000

The first time a single dead Redis container took down my entire homelab dashboard stack, it was 11pm on a Sunday and I had no idea why. Grafana was throwing 502s, the reverse proxy was timing out, and the actual fault — one cache container that had OOM-killed itself — was three layers down from anything I was looking at. I spent forty minutes chasing the symptom before I found the cause. The annoying part is that I could have found that fragility on a Tuesday afternoon, in daylight, with a coffee, if I had simply killed that container on purpose and watched what happened.

Edge Computing vs. Cloud: Choosing the Right Architecture for Mission-Critical IoT

Fri, 18 Apr 2025 12:10:00 +0000

The first time I sent every sensor reading from a home-lab project straight to a cloud endpoint, the architecture looked clean on a whiteboard and fell apart in a week. The broadband had a thirty-second wobble one evening, a dozen sensors queued their readings, the reconnect storm hammered the endpoint, and an automation that was supposed to cut power to a load when a temperature crossed a threshold simply didn’t fire — because the decision lived in the cloud, and the cloud wasn’t reachable. Nobody got hurt; it was a hobby rig. But it taught me the single most important question in IoT architecture, which has nothing to do with which cloud you like: where does the decision get made, and what happens to that decision when the network is gone?

Beszel: Lightweight Server Monitoring Without the Grafana Overhead

Tue, 08 Apr 2025 09:00:00 +0000

I will defend the Grafana-and-Prometheus stack to anyone who’ll listen. But I have to be honest about something: it is a lot of machinery to answer the question “is my little VPS okay?” For a serious homelab with a dozen nodes and real alerting needs, the weight is justified. For three boxes and a Raspberry Pi, standing up Prometheus, exporters, Grafana, and a pile of YAML to find out whether a disk is filling up feels like hiring a structural engineer to hang a picture.

Why Your Kubernetes Cluster Crashes at 2 a.m. and How to Stop It

Wed, 02 Apr 2025 13:00:00 +0000

The first time my home cluster fell over at 02:14, I assumed it was a fluke. The second time, three nights later, at almost exactly the same hour, I stopped believing in coincidence and started believing in cron. Because that is what a 2 a.m. crash almost always is: not random cosmic bad luck, but a scheduled job — a backup, a log rotation, a certificate renewal, a docker image prune you set up and forgot — colliding with a cluster that has no headroom to absorb it. The outage feels mysterious because you are asleep and the trigger fires on a timer you no longer remember writing.

Stalwart: Self-Hosting Your Own Email Server (and Why You Probably Shouldn't)

Tue, 04 Mar 2025 09:00:00 +0000

Every couple of years I get the itch to run my own mail server. I quash it, because every couple of years I remember what running a mail server is actually like: a Postfix config you don’t dare touch, a Dovecot setup nobody documented, Rspamd bolted on the side, and a Sunday afternoon vanished into SASL authentication errors. And then, the first time you email someone at a big provider, you land in spam anyway.

IPv6 at Home: Why It Matters Now and How to Stop Ignoring It

Tue, 11 Feb 2025 09:00:00 +0000

Most of us have spent two decades treating IPv6 as someone else’s problem — a thing that exists, that we’ll get round to, that the internet seems to run fine without. Meanwhile it quietly crept onto your network anyway. Your phone is probably using it right now. A large slice of traffic to Google, Netflix and the big CDNs is already IPv6 over your home connection, and you never lifted a finger. The question stopped being “should I enable IPv6” some time ago. It’s now “should I keep pretending the IPv6 that’s already running is something I understand.”

Building in Public: What Running a Blog on Your Own Infrastructure Teaches You

Wed, 05 Feb 2025 09:00:00 +0000

It is one thing to read about infrastructure. It is another to be woken by an email — or worse, a stranger on the internet politely telling you your site is down — and realise that the thing that’s broken is yours, the page is yours, and the only person who’s going to fix it is also, regrettably, yours. Running a blog on your own infrastructure is the cheapest, most effective infrastructure course I know, because every lesson arrives attached to genuine embarrassment.

Wazuh: A Self-Hosted SIEM for the Home Lab (Is It Worth the RAM?)

Tue, 28 Jan 2025 09:00:00 +0000

A SIEM — Security Information and Event Management — is the thing big companies pay six figures a year for so that a roomful of analysts can stare at dashboards and catch the moment something goes wrong. The pitch is simple: pull logs from everything you own into one place, correlate them, and raise an alert when the pattern smells like an attack. The reality, for most of those companies, is a very expensive log bucket nobody reads.

Tandoor: When Your Recipe Collection Outgrows Browser Bookmarks

Wed, 15 Jan 2025 09:00:00 +0000

My recipe “system” used to be a browser folder with 240-odd bookmarks, a Notes app full of half-typed ingredient lists, and a recurring Sunday-evening ritual of squinting at my phone in the supermarket trying to remember whether I needed one tin of chickpeas or three. It worked, in the sense that a shopping trolley with a wonky wheel works. It got me there, mostly, with some swearing.

Tandoor is what I replaced all of that with, and a year in I’m not going back.

Kubernetes Secrets Management: SOPS, Sealed Secrets, or External Secrets

Thu, 19 Dec 2024 10:00:00 +0000

Kubernetes Secrets are not secret. That’s the first thing nobody tells you. A Secret object is base64-encoded YAML sitting in etcd, and base64 is encoding, not encryption — anyone with get secrets on the namespace can read it back in plaintext with a single command. If you doubt it, kubectl get secret db-creds -o jsonpath='{.data.password}' | base64 -d will happily print your database password to the terminal of anyone with the right RBAC. Encryption at rest in etcd helps a little, but the real problem turns up the moment you adopt GitOps: now you want everything in a repo, and committing a base64 blob of your database password to Git is the kind of decision that ends careers. It doesn’t even need a breach — a public mirror, a fork, a laptop backup that syncs to someone’s personal cloud, and the credential is loose forever, because Git never forgets. So you reach for tooling. There are three serious contenders, and I’ve run all of them in anger on my own cluster.

The SaaS Trap: How Per-Seat Pricing Pushes You Toward Self-Hosting

Tue, 03 Dec 2024 09:00:00 +0000

There is a particular moment, familiar to anyone who has run a small team, where you log into a tool you’ve happily paid for for years, go to add a new colleague, and watch the price quietly leap by another tenner a month. Do it five times and the friendly little subscription has become a line on the budget that someone, eventually, is going to question. That moment is when otherwise sensible people start googling “self-hosted alternative to” — and per-seat pricing is the reason.

Linkwarden: Self-Hosted Bookmarking for the Tab Hoarder

Tue, 26 Nov 2024 09:00:00 +0000

I have a confession that will surprise nobody who has ever borrowed my laptop: my browser at any given moment is holding somewhere north of two hundred open tabs. Each one is a promise to myself — “I’ll read this later” — and each one is a lie. Worse, the tabs I do eventually bookmark have a nasty habit of rotting. I click through six months later and find a 404, a parked domain, or a “this article has been removed” notice. The thing I wanted to keep is gone, and all my bookmark preserved was the gravestone.

Kaniko: Building Container Images Inside Kubernetes

Thu, 21 Nov 2024 14:00:00 +0000

There is an awkward chicken-and-egg problem at the heart of running CI inside Kubernetes: you want to build container images, but the traditional way to build a container image is to run docker build, and docker build needs a Docker daemon, and a Docker daemon needs root and a bunch of kernel features that you really, really should not be handing to a CI pod. The old hack — mounting the host’s Docker socket into the build pod — is the security equivalent of leaving your front door open because the lock is fiddly. Anything that can talk to that socket effectively owns the node: it can launch a privileged container, mount the host filesystem, and walk straight out of your cluster’s security boundary. That’s not a theoretical risk; it’s a standard step in real cluster-escape write-ups.

Proxmox vs Kubernetes for the Home Lab: Pick the Right Tool for the Mess

Tue, 19 Nov 2024 09:00:00 +0000

“Should I run Proxmox or Kubernetes in my home lab?” is one of those questions that’s wrong in a subtle, expensive way. It sounds like a versus, and the internet loves a versus, so people pick a side and defend it with the energy of a football derby. But the two tools answer different questions. One asks “how do I carve this physical machine into several virtual ones?” The other asks “how do I run my workloads across machines and keep them running when one dies?” You can — and many of us do — run the second on top of the first.

Supply Chain Attacks: From npm Typosquatting to Poisoned Container Images

Tue, 12 Nov 2024 09:00:00 +0000

The most effective way to attack a company isn’t to break down its front door. It’s to stand inside the delivery van the company waves through the gate every morning. Supply chain attacks work because they exploit the one thing every developer does without thinking: pull in code and images they didn’t write, from people they’ve never met, and run them with full trust.

You did it an hour ago. npm install. docker pull. pip install. Each one is an act of faith that the thing at the other end is what it claims to be and hasn’t been tampered with since you last looked. Mostly that faith is rewarded. The supply chain attacker’s entire business is the times it isn’t — and those times are getting more frequent. The 2024 backdoor slipped into xz-utils (CVE-2024-3094) nearly made it into every mainstream Linux distribution, planted patiently over years by an attacker who social-engineered their way into becoming a co-maintainer. That is the shape of the modern threat: not a smash-and-grab, but a slow poisoning of the things you trust by default.

Keel: Automated Kubernetes Deployments Without GitOps Overhead

Thu, 24 Oct 2024 10:00:00 +0000

The orthodox answer to “how should my Kubernetes cluster deploy updates” is GitOps: Argo CD or Flux watching a Git repository, reconciling the cluster to match declared state, the whole pull-based pipeline. It is genuinely the right answer for a team shipping a product. For a homelab cluster running Sonarr, a couple of dashboards, and the odd hobby project, it is also a small mountain of YAML, a controller to babysit, and a Git workflow you have to actually follow. Sometimes you just want third-party images to update themselves when a new tag lands, without standing up a GitOps engine to do it.

Proton vs Tuta vs Self-Hosted: Email Privacy, Practically Assessed

Tue, 22 Oct 2024 09:00:00 +0000

“Private email” is one of those phrases that sounds like a single product and is in fact three completely different bargains. You can pay an encrypted provider to hold your mailbox in a way they can’t read. You can pay a different encrypted provider with a different idea of how that should work. Or you can host the lot yourself and own the whole problem. I’ve run all three at various points, and the right answer depends entirely on which trade-off you can live with — so let’s be specific about what each one actually costs you.

Let's Encrypt Rate Limits: What to Do When You Hit the Wall

Wed, 09 Oct 2024 08:00:00 +0000

Let’s Encrypt is one of the genuinely great things to happen to the open web. Free, automated, universally trusted TLS certificates — the whole reason your homelab services have padlocks now instead of a wall of browser warnings. It is also a free service handling staggering volume, and it protects itself with rate limits. The trouble is you only ever learn those limits exist at the precise moment you slam into one, usually at 2am, usually while debugging something else, usually with a renewal cron job hammering away making everything worse.

Calico vs Cilium: Kubernetes CNI for a Home Cluster

Tue, 08 Oct 2024 09:00:00 +0000

Set up a fresh Kubernetes cluster and one of the first decisions you’re handed is also one of the least explained: which CNI? Your nodes sit there in NotReady, the docs wave vaguely at a list, and you pick whatever the tutorial used. Months later you’re trying to write a NetworkPolicy or debug a packet that vanishes, and you finally wish you’d understood the choice.

The Container Network Interface is the plugin that gives every pod an IP and makes pods on different nodes able to talk to each other. Without one, your cluster is a collection of isolated boxes. For self-hosters, two names dominate the conversation: Calico and Cilium. They reach the same destination by very different roads.

Authelia vs Authentik: Choosing a Self-Hosted SSO You Won't Regret

Wed, 18 Sep 2024 09:00:00 +0000

There comes a moment in every homelab’s life when you realise you have a dozen logins. Grafana wants a password. So does Sonarr, and Radarr, and that Nextcloud instance, and the thing you spun up at 2am and have already forgotten the credentials for. Each one is its own little island of authentication, half of them reusing the same password because you’re only human, and exactly none of them have multi-factor authentication because configuring it twelve times sounded like a Tuesday you’d rather not have.

eBPF: The Linux Kernel Feature That's Changing Security (and Attack Surfaces)

Tue, 10 Sep 2024 09:00:00 +0000

For most of Linux’s life there was a hard wall between code you wrote and the kernel that ran underneath it. If you wanted the kernel to do something new, you wrote a kernel module — which is to say, you wrote code with the power to crash, corrupt, or backdoor the entire machine, loaded it with your fingers crossed, and hoped. eBPF tore a window in that wall. And like any window, it lets the light in and gives someone a way to look out.

Just and Task: Modern Alternatives to Make That Don't Make You Cry

Tue, 03 Sep 2024 09:00:00 +0000

Almost every project I touch accumulates a pile of little commands: build the thing, run the tests, regenerate the assets, deploy to staging. For decades the reflex answer was a Makefile, and for decades a Makefile has been quietly torturing everyone who isn’t compiling C. Tab-versus-space errors that print nothing useful. Recipes that fail silently because each line runs in its own shell. Variable expansion that fights you because Make has its own $ and the shell has another. Make is a brilliant build tool wearing a task-runner costume, and the costume doesn’t fit. This article is about two tools — just and Task — that fit much better.

Kubernetes CronJobs: Scheduled Tasks That Don't Silently Fail

Tue, 27 Aug 2024 09:00:00 +0000

Every cluster ends up with a graveyard of scheduled tasks. Backups, certificate renewals, cache warmers, the nightly script that reconciles a database with some upstream nonsense. On a single box you’d reach for crontab -e and move on with your life. In Kubernetes you reach for a CronJob, and if you’re not careful you reach for a thing that fails quietly at 3am and tells nobody.

I have lost data to silently failing cron tasks. Not a CronJob specifically — an old-fashioned line in a crontab that had been emailing its errors into the void for eight months, because the mail relay it wrote to had been decommissioned and nobody noticed the bounce. The nightly backup had been failing since roughly the spring; I found out in the autumn, the hard way, when I needed to restore. The lesson stuck. A scheduled task you don’t monitor isn’t automation, it’s a slow-motion incident waiting for a calendar invite. Kubernetes gives you better tooling for this than a plain crontab ever did, but only if you opt in.

VictoriaMetrics: When Prometheus Gets Too Hungry for Your Hardware

Tue, 13 Aug 2024 09:00:00 +0000

I love Prometheus. I’ve said as much before. But there’s a moment in the life of a growing homelab where the love turns slightly conditional, and that moment usually arrives when you check htop and find Prometheus quietly chewing through two gigabytes of RAM to remember some numbers about your fridge thermometer. It’s not that Prometheus is badly written — it’s that it was designed for ephemeral, short-retention monitoring of large fleets, and it makes memory and disk trade-offs that suit a data centre better than a fanless box in a cupboard.

Technical Debt in a Home Lab: When to Refactor and When to Let It Rot

Tue, 06 Aug 2024 09:00:00 +0000

Somewhere in my homelab there is a service running in a container I built by hand in 2021, configured by SSH-ing in and editing files directly, with no Compose file, no documentation, and a startup command that lives only in my shell history. It has not gone down once. I am terrified of it, and I have decided to leave it exactly where it is.

This is the dirty secret of running infrastructure for fun: technical debt is real here too, but the economics are completely different from a workplace. At work, debt compounds across a team and a roadmap. At home, it compounds across exactly one person — you — and the only deadline is your own patience. That changes the calculus enormously, and it means the professional instinct to “do it properly” is sometimes the wrong instinct.

CoreDNS and Kubernetes DNS: What Actually Happens When a Pod Looks Up a Name

Tue, 30 Jul 2024 09:00:00 +0000

At 1am one Tuesday I watched a pod intermittently fail to reach a service it had been talking to happily for months. nslookup returned SERVFAIL maybe one query in five. No deploy, no config change, nothing in the obvious logs. It took me two hours and a fair amount of swearing to discover that one of the two CoreDNS replicas had been quietly OOM-killed and rescheduled onto a node a NetworkPolicy was blocking on UDP 53. Every query that load-balanced onto that pod died. I had been treating cluster DNS as a magic black box for years, and the black box had finally bitten me.

mDNS and Avahi: Local Service Discovery That Works Until It Doesn't

Wed, 03 Jul 2024 16:00:00 +0000

You have done this a hundred times without thinking about it. You plug a Raspberry Pi into the network, type ssh pi@mylab.local, and it just works — no DNS server, no editing /etc/hosts, no hunting for an IP that DHCP handed out semi-randomly ten minutes ago. That .local resolution is multicast DNS (mDNS), and on Linux the daemon doing the heavy lifting is almost always Avahi. It is genuinely brilliant when it works, and genuinely maddening on the days it doesn’t — mostly because nobody ever explains what it’s actually doing under the surface, so when it breaks you’re left poking at it blind. This is the explanation I wish I’d had the first time a Chromecast vanished the day after I segmented my network.

Trivy and Container Scanning: Finding Vulnerabilities Before They Find You

Tue, 25 Jun 2024 09:00:00 +0000

Every Docker image you pull is a tarball of someone else’s decisions. That base image you chose two years ago because the tutorial used it? It’s carrying an OpenSSL with a known hole, a libc with a CVE, and three system packages you’ve never heard of, one of which has a remote code execution bug filed against it. You didn’t write any of that. You’re still running it.

Container scanning is the unglamorous practice of finding out what’s actually inside your images before an attacker does. And the tool I reach for first, every time, is Trivy — partly because it’s genuinely good, and partly because it’s free, fast, and doesn’t try to drag me into a sales call.

Cloudflare Tunnels: Exposing Services Without Opening Ports (and the Trade-Offs)

Tue, 11 Jun 2024 09:00:00 +0000

There’s a particular dread that comes with port-forwarding something on your home router. You log into a web interface that hasn’t changed since the Blair government, you punch a hole through to a box on your LAN, and then you spend the next week wondering whether you’ve just invited the entire internet to find that one unpatched service. Carrier-grade NAT might mean you can’t forward ports at all, and a dynamic IP means you’re chasing DDNS updates on top of everything else. I have done all of this. I have also been the person discovering, via a logfile full of probes from a dozen countries, that an exposed service was rather more interesting to the internet than I’d hoped.

Longhorn vs OpenEBS: Persistent Storage for Kubernetes That Isn't a Nightmare

Tue, 04 Jun 2024 09:00:00 +0000

Kubernetes storage has a reputation, and the reputation is “here be dragons.” I earned my own scar early: a Postgres pod that rescheduled onto a different node during a routine reboot and came up staring at an empty disk, because its data had politely stayed behind on the node it left. That is the persistent-volume problem in one sentence. The moment you move past stateless web apps and want to run a database, a wiki, or anything that remembers things across a restart, you hit it. In the cloud you’d shrug and attach an EBS volume that follows the pod around. In a homelab or on-prem cluster, you have a pile of machines with local disks and nothing shared binding them together, so a pod that lands on a new node finds its data marooned on the old one.

Matrix and Element: Self-Hosted Messaging That Federates

Tue, 28 May 2024 09:00:00 +0000

Three years ago a group chat I’d relied on for the best part of a decade evaporated overnight when the company behind the app got acquired and shut the service down. No export, no migration, a curt email and a dead login screen. That was the afternoon I decided the next messaging platform I trusted with my family’s conversations would be one I actually controlled. The pitch for Matrix is the same one email made fifty years ago and instant messaging has spent its entire existence refusing to make: you run your server, I run mine, and we talk anyway. No walled garden, no single company holding the keys, no app that gets bought and switched off while you’re mid-conversation. After running a Matrix homeserver for my family and a handful of friends for a couple of years, I’m convinced it’s the only self-hosted messaging story that actually delivers federation rather than just promising it. It’s also fiddly in ways worth being honest about before you commit a weekend to it.

cert-manager: Automated TLS Certificates That Actually Renew

Tue, 14 May 2024 09:00:00 +0000

I once let a certificate expire on a Sunday morning. Not a test box — the box that mattered. The expiry email had arrived eleven days earlier with the subject line containing the word “expires,” and I had archived it the way you archive everything that isn’t on fire yet. By the time visitors started seeing browser interstitials, I was SSH’d into a server trying to remember which flags certbot wanted while my coffee went cold and the clock ran. TLS certificates expire on a schedule precisely engineered to be longer than your memory and shorter than your attention span, and the manual-renewal model fails in exactly this way: silently, then all at once.

Kustomize: Kubernetes Configuration Without the Template Sprawl of Helm

Tue, 07 May 2024 09:00:00 +0000

There’s a moment, somewhere around your third environment, when a Helm chart stops being a convenience and starts being a small programming language you didn’t ask to learn. You’re staring at {{- if .Values.ingress.enabled }} nested four levels deep, whitespace-sensitive, debugged by squinting at helm template output. The thing you wanted was “the same manifests as production, but with a different replica count and hostname.” The thing you got was Go templating wrapped around YAML, which is a syntax wrapped around a syntax, and your editor can’t help you with either.

Firefly III: Self-Hosted Personal Finance Without the Bank Watching

Tue, 23 Apr 2024 09:00:00 +0000

Every budgeting app I have ever tried eventually wanted three things: my bank login, a monthly subscription, and the right to “anonymise” my spending and sell it to whoever buys that sort of thing. I gave up on all of them and put Firefly III on a box in the corner of my flat instead. It has been quietly tracking every penny I move for years now, and the only entity studying my coffee habit is me.

Nix: Reproducible Development Environments (Once You Survive the Learning Curve)

Tue, 16 Apr 2024 09:00:00 +0000

Every developer has lived the same small tragedy. A new colleague clones the repo, follows the README to the letter, and nothing works. The wrong version of Node. A missing system library. A make step that needs a tool nobody documented because it’s been on the lead’s laptop since 2019 and they forgot it wasn’t standard. Half a day vanishes into “what version of what do you have installed”, and the answer, always, is different from mine. Nix exists to make this entire category of misery go away — and it does, eventually, after putting you through a learning curve I will not pretend is gentle. This post is both the pitch and the warning, because I think the pitch is real and the warning is earned.

Keepalived and Virtual IPs: High Availability Without a Load Balancer

Tue, 02 Apr 2024 10:00:00 +0000

There is a particular flavour of homelab anxiety that arrives the moment a single box becomes load-bearing. Your reverse proxy, your DNS resolver, your little MQTT broker that the whole house now depends on — all of it pinned to one IP address on one machine that will, one day, want a kernel update at the worst possible time. The cloud answer to this is a managed load balancer, and it is a fine answer if you enjoy paying monthly for a TCP forwarder. The self-hosted answer, and a remarkably good one, is keepalived.

Ntfy: Self-Hosted Push Notifications That Replace Twelve SaaS Webhooks

Tue, 02 Apr 2024 09:00:00 +0000

Count the ways your homelab currently tries to get your attention. The backup script emails you, which means you now check email for alerts, which means you’ve made email worse. Prometheus pages through some webhook you configured eighteen months ago and no longer remember the shape of. One app posts to a Discord server you joined only for its notifications, another insists on Telegram, a third wants a Pushover token you bought once and can’t find. Each new tool arrives with its own notification mechanism bolted on, and pretty soon your phone is being prodded by half a dozen different SaaS middlemen — several of which you’re quietly trusting with messages like “the front door sensor opened at 3am.” That is a lot of third parties in the loop for the crime of telling you a disk is full.

The Real Cost of Self-Hosting: Electricity, Time, and What You Actually Save

Thu, 28 Mar 2024 09:00:00 +0000

There is a story self-hosters tell themselves, usually at about 1am while staring at a rack of blinking lights, and it goes like this: “I’m saving so much money by not paying for all these subscriptions.” It is a lovely story. It is also, in my experience, mostly fiction — or at least a great deal more complicated than the version we like to repeat at dinner parties to justify the noise coming from the cupboard.

Traefik vs Nginx Proxy Manager: Reverse Proxies for the Rest of Us

Tue, 19 Mar 2024 09:00:00 +0000

Sooner or later, every homelab outgrows the colon. You start with 192.168.1.40:8989 for Sonarr, :3000 for Grafana, :8080 for the thing you can no longer remember, and you keep a sticky note of port numbers like it’s 2003. Then you want HTTPS, because typing passwords over plain HTTP makes your skin crawl, and suddenly you need a reverse proxy: one thing on ports 80 and 443 that looks at the hostname and routes the request to the right backend, terminating TLS on the way through.

GitOps with Flux: Letting Git Be Your Cluster's Source of Truth

Tue, 12 Mar 2024 09:00:00 +0000

The worst hour I ever spent on my home cluster was the one where I tried to reconstruct what was actually running on it. I’d applied a manifest months earlier, hot-patched something live during an outage, edited a config map by hand, and then forgotten all three. The YAML in my repo and the reality in the cluster had quietly diverged, and I couldn’t say with confidence what was deployed — which meant I couldn’t rebuild it if the node died. That gap between “what’s in Git” and “what’s running” is configuration drift, and it’s the single failure mode GitOps exists to kill.

TOTP and WebAuthn: Two-Factor Authentication Without Authy

Tue, 05 Mar 2024 09:00:00 +0000

There was a moment, somewhere around the third time Authy decided my desktop app should no longer exist, that I realised I had handed the keys to my entire digital life to a company whose roadmap I had no say in. The desktop client was deprecated, the cloud backup was a black box, and exporting my tokens turned out to be deliberately awkward. That’s the wrong feeling to have about the thing standing between an attacker and every account I own.

MetalLB and Kubernetes Bare-Metal Networking: LoadBalancers Without a Cloud

Tue, 20 Feb 2024 09:00:00 +0000

The first thing that goes wrong when you build a Kubernetes cluster on your own hardware is the most anticlimactic possible failure. You deploy something, set its Service type to LoadBalancer the way every tutorial told you to, and then… nothing. kubectl get svc shows EXTERNAL-IP stuck on <pending>, forever, with the quiet patience of a thing that is never going to happen.

This is not a bug. On a cloud provider, type: LoadBalancer is a request that the cloud’s controller fulfils by provisioning an actual load balancer and handing you a public IP. On bare metal there is no cloud controller listening, so the request just sits there. MetalLB is the missing piece: it implements that controller for your own network, so a homelab or on-prem cluster can finally do the thing the cloud does for free.

Writing CLI Tools in Go: From Zero to Useful in an Afternoon

Tue, 13 Feb 2024 09:00:00 +0000

I write a lot of little command-line tools. Glue that wires two APIs together, a thing that munges a CSV the way I actually need it, a daemon that watches a directory and pokes something when a file lands. For years my reflex was a Bash script that grew tentacles, or a Python file that worked fine on my machine and nowhere else. These days I reach for Go, and I keep reaching for it because the gap between “idea” and “a binary I can hand to someone” is genuinely about an afternoon. Here’s why, and how.

Paperless-ngx: A Paperless Office That Actually Works

Mon, 12 Feb 2024 09:00:00 +0000

I have owned three filing cabinets in my life. Each one followed the same arc: pristine and hopeful for a fortnight, then a graveyard of bank statements I will never read, slowly fossilising under a pile of takeaway menus. The promise of the “paperless office” was sold to me decades ago and never delivered, because the missing piece was never the scanner. It was knowing where anything went afterwards. A scanned PDF named scan_0047.pdf sitting in a folder is not filed; it’s just lost in a tidier way.

Podman: Running Containers Without Docker (and Without Losing Your Mind)

Tue, 06 Feb 2024 09:00:00 +0000

For about a decade, “containers” and “Docker” were synonyms in most people’s heads, mine included. You installed Docker, you ran docker run, a daemon somewhere did the work, and you didn’t think too hard about the fact that the daemon ran as root and you were talking to it through a socket that was, functionally, a key to the whole machine. Podman is what you get when someone looks at that arrangement and asks why it has to be like that. The answer, it turns out, is that it doesn’t.

De-Googling Your Life: A Realistic, Step-by-Step Migration Plan

Tue, 30 Jan 2024 09:00:00 +0000

Every so often someone announces, with the zeal of the newly converted, that they have “deleted Google” — and then quietly admits three weeks later that they still use Maps, still use the Play Store, and have a Gmail address forwarding to their new account because everything they ever signed up for points at it. I’ve watched this fail enough times — and done a version of it myself — to be deeply suspicious of the all-or-nothing approach. De-Googling is not a single heroic act; it’s a migration project, and migration projects succeed when you sequence them properly and let nothing break in production.

Loki: Log Aggregation for People Who Can't Afford Splunk

Tue, 23 Jan 2024 09:00:00 +0000

There are two kinds of homelabber: the ones who SSH into each box and run journalctl when something breaks, and the ones who got tired of doing that around the fourth machine. I crossed that line a while ago, and I remember the exact incident that pushed me over it — a service falling over at 11pm, and me hopping between four terminals trying to work out which of them held the log line that mattered. Once you have a handful of hosts and a stack of Docker containers, “which log, on which box, from which container?” becomes a small archaeological dig every single time, invariably conducted in a hurry while something is actively on fire.

K3s Multi-Node: Adding a Second Machine to Your Cluster

Tue, 16 Jan 2024 09:00:00 +0000

A single-node K3s install is a wonderful thing. It’s Kubernetes that fits in a few hundred megabytes of RAM, it boots in seconds, and it lets you learn the whole ecosystem on one spare machine. But a cluster of one is a contradiction in terms. The day a sensible person finally gives in and orders a second mini PC — or rescues an old laptop from the cupboard — is the day K3s starts being genuinely useful. Pods can be rescheduled, you can drain a node to do maintenance, and a single dead disk stops being the end of the world.

Wake-on-LAN Automation: Powering Servers On and Off with Home Assistant

Fri, 05 Jan 2024 09:00:00 +0000

I have a beefy machine in the cupboard that exists to do exactly one thing: transcode media and crunch the occasional batch job. It pulls something like 90 watts at idle, which over a year is a meaningful slice of the electricity bill for a box that is genuinely busy maybe two hours a day. For ages I left it running because the alternative — getting up and pressing the power button when I wanted to watch something — was worse. Then I wired it into Home Assistant, and now it sleeps until it is needed and shuts itself down when it is idle. The savings paid for the effort in a couple of months.

Container Image Housekeeping: Pruning, Pinning, and Not Running latest in Production

Tue, 19 Dec 2023 09:00:00 +0000

Container hosts have a way of quietly filling up. You pull images, you rebuild, you redeploy, and every iteration leaves a sediment of old layers behind. Then one ordinary morning a deploy fails with no space left on device, you go looking, and /var/lib/docker has eaten thirty gigabytes of disk you didn’t know you’d given it. I have had this exact morning, on a box I thought I was looking after, and the indignity of discovering that nothing was wrong — no leak, no runaway log, just months of orphaned layers nobody pruned — is a particular flavour of self-inflicted. Container image housekeeping is the least glamorous topic in this entire field, and it’s the one that’ll wake you at 3am if you ignore it.

QNAP NAS as a Kubernetes Storage Backend: iSCSI, NFS, or Just Don't

Mon, 11 Dec 2023 10:00:00 +0000

Everyone who builds a homelab Kubernetes cluster hits the same wall about a week in: stateful workloads. Your pods are stateless and beautiful until you want to run Postgres, or a media server, or anything that remembers things between restarts. Then you need persistent volumes, and you look around your house, and your eyes land on the QNAP NAS humming away in the corner with several terabytes of perfectly good storage. Surely you can just point the cluster at that?

UniFi for the Home Lab: Where It Shines and Where It Doesn't

Tue, 05 Dec 2023 09:00:00 +0000

UniFi is the gateway drug of home networking. You buy one access point because your ISP router’s Wi-Fi is a disgrace, you marvel at the clean app and the pretty graphs, and eighteen months later you own a gateway, a couple of switches, a rack-mount UPS you didn’t strictly need, and you refer to your hallway cupboard as “the rack.” Ubiquiti has built something genuinely good here — prosumer gear with an enterprise feel at a price that doesn’t require a purchase order. But it is not the right answer for everyone, and the places it falls down are worth knowing before you spend the money.

Healthchecks.io (Self-Hosted): Making Sure Your Cron Jobs Actually Ran

Tue, 21 Nov 2023 09:00:00 +0000

Here is a story that has happened to almost everyone who has ever written a cron job. You set up a nightly backup. You test it once, it works, you feel responsible and adult. Eight months later you actually need that backup, and you discover it stopped running in March because of a full disk, an expired token, or a typo you made while “tidying up.” The cron job didn’t fail loudly. It failed silently, which is the worst way for anything to fail, and nobody told you because there was nobody to tell.

SQLite: The Database You Already Have and Probably Underuse

Tue, 14 Nov 2023 09:00:00 +0000

There is a reflex, the moment a project needs to store anything, to stand up Postgres. A container, a connection string, a user, a password, a port, a backup strategy, a thing to keep running and patched. And for an enormous number of projects, all of that ceremony is in service of a workload a single file on disk could handle without breaking a sweat. That file is SQLite, it is almost certainly already installed on whatever you are reading this on, and it is one of the most underused tools in the business.

Mealie: A Self-Hosted Recipe Manager for People Who Actually Cook

Tue, 07 Nov 2023 09:00:00 +0000

I have a confession. For years my recipe collection was a chaotic sprawl of browser bookmarks, phone screenshots, a Google Doc nobody could ever find, and three different paper notebooks written in the handwriting of a doctor having a stroke. Every single time I wanted to cook something I’d dig up the original blog post, scroll past 1,400 words about the author’s grandmother in Tuscany, dodge a video ad that started playing on its own with the sound on, dismiss a newsletter pop-up, and then — finally — reach the one line telling me how much flour to use. I once measured it: forty seconds of scrolling and ad-swatting to find a quantity I needed in two.

Helm Charts Demystified: What They Actually Do and When to Skip Them

Tue, 31 Oct 2023 09:00:00 +0000

Everybody installs things on Kubernetes the same way. You find the project, you scroll to the README, and there it is: helm repo add, helm install, done. Three commands and a workload appears, fully wired with services, config maps, secrets and a horizontal pod autoscaler you didn’t ask for. Helm has become the default, and like most defaults it’s reached for without much thought about what it actually is or whether you need it.

Grafana and Prometheus: A Monitoring Stack That Scales Down

Tue, 17 Oct 2023 09:00:00 +0000

There is a particular flavour of homelab anxiety that strikes at 3am: is the NAS still alive? Did the disk fill up while I slept? Is that container restarting in a loop, quietly burning through SD-card writes? You can answer these questions by SSHing in and squinting at df and top, or you can answer them with a graph. I am firmly in the graph camp, and for the better part of a decade the graph has come from Grafana fed by Prometheus.

Why Every Side Project Should Have a Backup Plan (And How to Build One)

Tue, 10 Oct 2023 09:00:00 +0000

Every side project starts the same way: a burst of enthusiasm, a database, and absolutely no backups. This is fine, right up until the moment it is catastrophically not fine — the disk fills, the migration goes sideways, you rm -rf the wrong directory at midnight, or the VPS provider has a bad week and your droplet evaporates with it.

I have lost data this way. Not recently, because losing data once is an education you only need to pay for the once. The lesson was not “back things up more” — everyone knows that. The lesson was that a vague intention to back things up is worth precisely nothing, and only an automated, tested, restorable backup counts. So let’s build one that actually works for a small project, without enterprise budgets or enterprise faff.

VLAN Segmentation at Home: Keeping Your Smart Toaster Away from Your NAS

Tue, 26 Sep 2023 09:00:00 +0000

Here is an uncomfortable fact about most home networks: every device on them can talk to every other device. Your laptop, your phone, your NAS full of irreplaceable photos, and that £25 smart plug running firmware last updated when it left the factory in Shenzhen — they’re all sitting on the same flat subnet, able to reach each other freely. The smart plug has a hardcoded telnet password and a cloud connection you can’t see into. The NAS has everything you care about. On a flat network, the first is one hop from the second, and nothing in between is checking whether that hop should be allowed.

BGP at Home: What Happens When You Peer with Your ISP

Fri, 15 Sep 2023 09:00:00 +0000

I have a /48 of IPv6 announced from a box in my house. That is roughly 1.2 billion billion addresses, more than the entire IPv4 internet several times over, sitting behind a single second-hand mini PC that cost less than a decent monitor. It is gloriously absurd, and getting there taught me more about how the internet actually works than a decade of reading RFCs. This is the story of how a hobbyist peers with an upstream, announces their own address space, and joins the roughly hundred thousand independent networks that route the global internet between them.

DNS Over HTTPS at Home: Running Your Own DoH Resolver

Sat, 12 Aug 2023 11:00:00 +0000

Plain DNS is the last great open postcard of the internet. You’ve encrypted your web traffic with TLS, you’ve got a VPN you trust, you’ve hardened SSH to within an inch of its life — and then your machine cheerfully shouts every single domain name you look up, in clear text, over UDP port 53, to whatever resolver your ISP handed you at DHCP time. Anyone on the path can read it, and plenty of middleboxes do.

Rallly: Self-Hosted Scheduling Without Doodle's Data Harvesting

Wed, 09 Aug 2023 09:00:00 +0000

There is a special kind of dread that comes from trying to pin six people down to a single evening. Reply-all threads spiral, someone proposes a date three others have already vetoed, and eventually somebody mutters the word “Doodle”. And Doodle does work. It also works very hard at watching everyone who clicks your link, sprinkling ad-tech all over a page whose entire job is to collect your friends’ availability and, increasingly, their attention. I host my own instead. The tool is called Rallly, and it is one of the few self-hosted things I actually recommend without a long list of caveats.

Tailscale vs Netbird: Self-Hosted Mesh VPNs Compared

Mon, 03 Jul 2023 09:00:00 +0000

I have lost count of the number of times I have recommended Tailscale to people. It is, genuinely, the easiest way to get a flat, encrypted network across machines that have no business being on the same subnet — your laptop in a café, a VPS in Frankfurt, the NAS in the cupboard under the stairs. You install it, you log in, and suddenly everything can ping everything else over WireGuard with no port forwarding and no faff. It feels like magic. If you want the gentle introduction to that magic before this comparison, I wrote one up in Tailscale: a zero-config mesh VPN; this piece assumes you already know what a tailnet is and want to know whether to own the control plane yourself.

Javascript, the good, bad and ugly.

Thu, 22 Dec 2022 17:01:57 +0000

Brendan Eich wrote the first version of JavaScript in ten days in May 1995, under pressure to ship something for the Netscape Navigator 2.0 beta. He had wanted to put Scheme in the browser; management wanted something that looked like Java, because Java was the hot thing that year. So he took the functional core of Scheme, the prototype-based objects of Self, and bolted on a curly-brace syntax that resembled Java without behaving anything like it. The result was called Mocha, then LiveScript, and finally — in a marketing deal with Sun — JavaScript. Three names and a deadline measured in days. Three decades later that ten-day prototype runs in every browser on earth, on servers, on embedded boards, and increasingly inside my home automation. I have shipped a lot of JavaScript and I have sworn at a lot of JavaScript, often in the same afternoon. This is the honest tour: where it earns its place, where it irritates, and where it genuinely gets ugly.

The Internet Is a Series of Tubes

Fri, 13 May 2022 17:47:19 +0000

On 28 June 2006, a US senator named Ted Stevens stood up during a committee debate on net neutrality and delivered a sentence that would outlive most of his legislative career: “It’s not a big truck. It’s a series of tubes.” He went on to explain that the tubes could get “filled”, that an email he had been sent took days to arrive because the tubes were congested, and that we should therefore be cautious about letting anyone dump “enormous amounts of material” into them. The internet, predictably, did not respond with kindness.

Clearing your DNS cache

Sat, 25 Dec 2021 17:28:00 +0000

I migrated a website to a new server once, updated the DNS A record, watched the new box light up with traffic from everywhere — except my own laptop, which stubbornly kept loading the old server for the better part of an hour. Nothing was broken. The record had changed. The internet at large had noticed. My machine simply hadn’t, because it had cached the old answer and intended to keep using it until its timer ran out. That gap — between “the record changed” and “your computer agrees” — is what flushing the DNS cache fixes, and it’s the single most common reason a site works for everyone except the one person standing in front of you.

Video Authoring with Google Photos

Tue, 16 Apr 2019 16:45:00 +0000

I built my first slideshow-video for a family birthday in about four minutes on my phone, sitting in a car park, and it looked genuinely good. That’s the pitch for Google Photos’ video tool in one sentence: it is the fastest way to turn a pile of stills into something with music and motion that you’d actually send to relatives. It is also, quietly, a lock-in machine — the free unlimited storage that once made it a no-brainer ended in June 2021, and the “movie” you assemble lives inside Google’s walls until you export it. So this is two posts in one: how to make the video, and how to keep the source photos somewhere you control.