Author: Wes
-
Hardening the Gateway: Firewalla Security Architecture, Custom DNS & Automated Post-Boot Scripts
Comprehensive guide to hardening a Firewalla gateway: IoT network isolation, split-horizon DNS, NextDNS integration with ctrld, and running automated persistence scripts on reboot via post_main.d.
-
Out-of-Band Infrastructure Monitoring: Deploying Uptime Kuma & AutoKuma on an External VPS
Deploy Uptime Kuma out-of-band on an external cloud VPS to monitor your homelab and home ISP. Pair with AutoKuma for declarative GitOps monitor management via TOML files and instant Ntfy…
-
The Zero-Paper Household: Automated OCR, Tagging & Archiving with Paperless-ngx
Deploy Paperless-ngx to transform physical mail, receipts, and bills into a searchable, automated digital archive. Complete Docker Compose stack with PostgreSQL, Valkey, and consumption directory pipelines.
-
Production Photo & Video Management: Deploying Immich with ML Acceleration on OpenZFS
Deploy Immich as a self-hosted Google Photos replacement on TrueNAS SCALE / Linux. Complete Docker Compose stack with Valkey, PostgreSQL pgvector, hardware ML inference, and OpenZFS dataset tiering.
-
Lightweight Homelab Identity: Deploying Pocket-ID for OIDC Single Sign-On
Deploy Pocket-ID as a minimal, resource-efficient OIDC identity provider for homelabs. Passkey/WebAuthn native, under 50MB RAM, distroless Docker image, and zero enterprise bloat.
-
Deploying a Secure WireGuard & Tailscale Exit Node on a VPS for Private Mobile Egress
Turn a low-cost VPS into a high-speed encrypted VPN gateway. Configuring Linux kernel IPv4/IPv6 forwarding, nftables NAT masquerade, and advertising an authenticated Tailscale exit node for secure public Wi-Fi browsing.
-
Zero-Downtime Container Healthchecks, Auto-Healing & Safe Update Strategies
Prevent silent container deadlocks. Implementing production Docker healthcheck blocks, configuring autoheal for automated container recovery, and managing safe zero-downtime container updates.
-
Predictive Drive Failure & S.M.A.R.T. Health Monitoring with smartd and Scrutiny
Detect hard drive and NVMe SSD degradation before data loss occurs. Setting up smartd background monitoring, automated self-tests, and deploying Scrutiny in Docker with instant webhook failure alerts.
-
Fleet-Wide Intrusion Prevention: Deploying CrowdSec with Docker, Caddy & Firewall Bouncers
Modern alternative to Fail2ban: Deploying CrowdSec collaborative threat intelligence across your homelab fleet, parsing SSH and Caddy reverse proxy logs, and enforcing automated firewall IP bans.
-
The 3-2-1 Backup Architecture: Automated Encrypted Restic Backups to B2 & S3 with Systemd Timers
Step-by-step production runbook for backing up VPS and home servers using Restic with client-side encryption, Backblaze B2 / Wasabi S3 object storage, systemd timers, automated snapshot pruning, and integrity checks.