Step-by-step guides pulled from real homelab projects — rewritten for anyone to follow, with internal IPs and account details stripped out. Real gotchas kept in, because that's the useful part.
Browser-based VDI with Proxmox auto-cloning agent VMs on demand — the real permission set, every startup-script gotcha, and a general method for diagnosing a stuck clone/destroy loop from scratch.
KasmProxmoxVDIRunning your own internal certificate authority (step-ca) so every admin UI on your LAN gets a real, trusted cert — no more click-through security warnings.
PKIDockerMoving public domains from a vendor NAS's reverse proxy to a dedicated Caddy instance — plus the Cloudflare certificate trick you need if you're behind Cloudflare.
CaddyNetworkingRunning Vaultwarden (a Bitwarden-compatible server) in its own isolated container, and the safe way to migrate an existing vault without losing sessions or data.
VaultwardenDockerA self-hosted photo library with real ML search, plus CalDAV/CardDAV for contacts and calendars — and how to migrate years of existing data over safely.
ImmichSelf-HostingThree free, complementary scanners — network, container images, and web apps — set up to run on a schedule and actually get looked at.
SecurityOpenVASWiring your network controller, your hypervisor, an inventory system, and a monitoring stack together so new devices and VMs show up automatically — and the silent failure modes to watch for on every leg.
NetBoxProxmoxAutomationA fleet-wide notification rule silently discarding every service alert, plus real Docker container monitoring and a from-scratch agent bootstrap on a non-systemd host — every gotcha included.
CheckmkDockerMonitoringFixing weak SSH MAC algorithms across an entire fleet of mixed Linux containers, VMs, and vendor NAS units — and how to actually verify the fix worked.
SSHHardeningA dedicated backup target for your whole virtualization fleet — including physical Windows PCs, not just VMs — plus the permission gotchas that trip up almost everyone on first setup.
ProxmoxBackupsAn NFS bind-mount for a container's config folder is invisible to most backup tools — how to check for this silent gap and migrate onto real backed-up storage without losing anything.
DockerBackupsA second, independent backup server on a cloud VPS for genuine 3-2-1 coverage — locking it down with a firewall instead of a tunnel, a write-only sync credential, and the honest truth about backup immutability.
BackupsCloudAn off-site btrfs backup failed every night for 5 nights with zero alerting — the red herring that wasn't the cause, the real version-mismatch root cause, the fix, and closing the monitoring gap so it can't happen silently again.
BackupsMonitoringTwo approaches — a simple single-port tunnel for most games, and a VPS-based tunnel for games that need a whole range of ports — plus a subtle bug that can make a tunnel look healthy while being completely broken.
NetworkingGame ServersPutting a device on its own VLAN doesn't isolate it by default on most routers — how to check, fix it properly, and avoid a gotcha that silently breaks the direction you meant to keep working.
NetworkingSecurityProtocol and server choices that actually matter, a real gotcha with reused provider configs, and a test suite that goes well beyond a handful of pings.
VPNNetworkingBypassing an official Windows+Hyper-V requirement by finding the real Linux payload underneath — plus a real debugging story about a live-service game's hidden cloud dependencies, including two wrong turns before finding the real answer.
Self-HostingGame ServersA real security incident from one wrong env var name, a Cloudflare mTLS gotcha that broke only the iOS app, and the honest truth about what "automatic sync" can and can't mean on an iPhone.
SeafileSelf-HostingDiscovering a reverse proxy had zero access logging, standing up self-hosted Umami analytics, a dropped-image gotcha, and verifying the whole pipeline with a real simulated pageview instead of just a healthy container.
UmamiAnalyticsDocker