Category: Security & Edge Networking
Zero-Trust Cloudflare Tunnels, Tailscale/WireGuard mesh VPNs, reverse proxies, and edge firewall defense.
-
Hardening the Gateway: Firewalla Security Architecture, Custom DNS & Automated Post-Boot Scripts
Comprehensive guide to hardening a Firewalla gateway: IoT network isolation, split-horizon DNS, NextDNS integration with ctrld, and running automated persistence scripts on reboot via post_main.d.
-
Lightweight Homelab Identity: Deploying Pocket-ID for OIDC Single Sign-On
Deploy Pocket-ID as a minimal, resource-efficient OIDC identity provider for homelabs. Passkey/WebAuthn native, under 50MB RAM, distroless Docker image, and zero enterprise bloat.
-
Deploying a Secure WireGuard & Tailscale Exit Node on a VPS for Private Mobile Egress
Turn a low-cost VPS into a high-speed encrypted VPN gateway. Configuring Linux kernel IPv4/IPv6 forwarding, nftables NAT masquerade, and advertising an authenticated Tailscale exit node for secure public Wi-Fi browsing.
-
Fleet-Wide Intrusion Prevention: Deploying CrowdSec with Docker, Caddy & Firewall Bouncers
Modern alternative to Fail2ban: Deploying CrowdSec collaborative threat intelligence across your homelab fleet, parsing SSH and Caddy reverse proxy logs, and enforcing automated firewall IP bans.
-
Automating Edge Security: Cloudflare Origin Certificates & WAF Protections
When hosting web applications behind an edge proxy like Cloudflare, many site owners mistakenly leave their connection in ‘Flexible SSL’ mode—meaning the traffic between the browser and Cloudflare is encrypted,…
-
Enterprise Linux Auditing: Tracking Command Execution with Auditd
A common administrative goal is auditing every command executed by users across a shared server. Historical hacks involved appending logger commands to /etc/bash.bashrc or wrapping PROMPT_COMMAND. These shell-level approaches are…
-
Zero-Trust Edge Ingress: Deploying Cloudflare Tunnels (cloudflared) for Private Services
Opening ports 80 and 443 on your home or office router exposes your public IP address to port scans, DDoS attacks, and zero-day exploit probing. Modern zero-trust architecture replaces open…
-
How to Lock Down and Harden a Fresh Linux VPS (Ubuntu / Debian)
When deploying a fresh cloud VPS on Ubuntu or Debian, securing the host before exposing services to the public internet is critical. Automated scanners probe default SSH ports within seconds…
-
Modern Mesh VPN Architecture: Tailscale, Headscale, and WireGuard Site-to-Site Tunnels
Legacy point-to-point VPN protocols like PPTP, L2TP, and IPsec require complex port forwarding, fragile crypto negotiations, and central routing bottlenecks. Modern Linux networks rely on WireGuard and mesh coordination layers…
-
Automated TLS Certificates: Let’s Encrypt Wildcards, ACME DNS-01 & Reverse Proxies
Manual SSL certificate generation, CSR generation, and cron-based renewals are completely obsolete. Modern homelab and production environments automate 100% of the certificate lifecycle using ACME challenge protocols. This guide explains…