Posts

Notes, write-ups, and projects from the homelab and the day job — ordered by most recently updated.

//All Posts

Vaultwarden behind a WireGuard VPN — architecture diagram

Migrating Vaultwarden (Bitwarden) Password Manager behind WireGuard VPN

A technical account of migrating a self-hosted password vault from an internet-exposed reverse-proxy setup to behind a WireGuard VPN tunnel — what went smoothly, what didn't, and what the problems revealed about the underlying systems.

// Eliminated public web attack surface — the vault is reachable only through an authenticated, cryptographically silent VPN tunnel

The Site That Kept Reverting to a Parked Page (And Why It Wasn't the App)

A company site went live on deploy, then silently reverted to a hosting parked page roughly 14 hours later — every time. The fix had nothing to do with the application. A debugging story about chasing the wrong theories before dig told the truth.

// Root-caused a recurring silent outage to a registrar-vs-DNS-host mismatch; fixed with a one-record DNS change, no app changes, no site rebuild

Self-hosting Private GitHub Runners on a Kubernetes Cluster

Why we moved our GitHub Actions workloads to self-hosted runners on Kubernetes at work, the bill that triggered it, and what I'm planning to bring home to the homelab.

// Cut GitHub-hosted Actions minute spend significantly while keeping a familiar developer experience

To Kubernetes or not to Kubernetes, that is the Question: A Home Lab Perspective

When does running Kubernetes at home actually pay off, and when is it the wrong tool? A look at intent versus hype for self-hosters.

// A framework for deciding whether to run k8s at home, based on what you're actually trying to achieve

Migrating Homelab Workloads from Docker Compose to Talos Kubernetes

Why I moved from a single Docker Compose host to a 3-node Talos cluster, what broke in the process, and the surprising places the migration actually paid off.

// Zero-downtime workload migration; cluster upgrades are now boring

Self-Hosting Ollama with GPU Passthrough on Proxmox

Running local LLMs on consumer GPU hardware via a Proxmox VM with PCIe passthrough. IOMMU groups, VFIO binding, and the boring tuning that makes inference actually fast.

// Local Llama 3.1 70B inference at 18 tok/s on consumer hardware

GitOps on Kubernetes with ArgoCD and SOPS

Declarative cluster state in a single Git repo, with encrypted secrets that age-encrypt at rest and decrypt only at sync time. A pattern I've now used across three different homelab clusters.

// Whole-cluster state recoverable from one git clone + one age key

Single Sign-On for the Homelab with Keycloak

Putting every self-hosted service behind one login with the same identity provider I use at work. OIDC for the apps that support it, oauth2-proxy for the ones that don't, and the trade-offs of each.

// One login screen across ~18 self-hosted services, on the same IdP I use professionally