apt-upgrade.me – Homelab, Linux & DevSecOps

This Blog Now Runs on Hugo: No WordPress, No Kubernetes, and Stable HTTP/3

Fri, 06 Nov 2026 18:03:29 +0100

In short: This blog no longer runs on WordPress and Kubernetes. It now consists of finished files that nginx serves from a hardened AlmaLinux 10. In the Hugo experiment a few days ago nothing was decided yet; on November 6, 2026 I made the switch. All posts in four languages keep their old addresses, Grafana and the hardening stayed, PHP, the database and the cluster are gone. And HTTP/3, which I switched off only this week, is running again.

Do I Even Need WordPress and Kubernetes for This Blog? A Hugo Experiment, Real Numbers, and What a Migration Would Take

Thu, 05 Nov 2026 21:57:56 +0100

Update of November 6, 2026: It has since been decided and done: this blog now runs on Hugo. What happened along the way is here.

The short version: This blog is mostly text and images, yet it runs on Kubernetes with a database, a PHP pool, a cache and ten plugins. So I rebuilt a part of it as a static site with Hugo and compared the two. The result surprised me in both directions: for readers, the speed gain is smaller than expected. For maintenance, the gain is much larger. The decision is not made. This blog still runs on WordPress.

Legal Housekeeping for a Tech Blog: What I Cleaned Up – From the Imprint to the Images

Thu, 05 Nov 2026 08:56:08 +0100

Up front: this is a field report, not legal advice. I am an admin, not a lawyer. If in doubt, ask someone who does this for a living.

A private tech blog in Germany is not a legal no man’s land. Imprint, privacy, copyright on images – each of them carries the risk of a formal warning letter, and the longer a blog runs, the more piles up. So in October I went through my blog systematically: where might I step on someone’s toes, where do I reveal more than necessary, and where am I open to attack? This post sums up what I found and changed.

Deep Dive: AIDE and rkhunter on a K3s Host – Integrity Checks Without Drowning in False Alarms

Thu, 05 Nov 2026 08:36:43 +0100

An integrity checker is only as good as the mails it sends. If it reports hundreds of changes every morning, nobody reads them after a week – and the one real finding gets lost with them. That was my problem with AIDE and rkhunter on three K3s hosts: both worked, but mostly they reported things I had caused myself.

This deep dive shows what the two tools do, where the noise comes from on a Kubernetes host, and how the baseline follows every intended change.

HTTP/3 for My Blog and Nextcloud: One Switch, Two Hidden Brakes, and What the Measurements Show

Tue, 03 Nov 2026 19:58:05 +0100

Update of November 6, 2026: HTTP/3 is back on here, with nginx mainline and quic_bpf. The story is in the migration post.

Update, November 4, 2026: HTTP/3 is off again on all my servers. The reason is at the end of this post.

Many users of my Nextcloud instances are on their phones. That is exactly what HTTP/3 was built for: it runs over QUIC instead of TCP, needs one round trip less to set up a connection, copes better with packet loss, and can keep a connection alive when the phone switches from Wi-Fi to mobile data. My goal, however, was not “have HTTP/3” but: HTTP/3 only if it measurably helps – more throughput or a more stable connection on a bad network.

Update Day: Nextcloud 35, a False Alarm, and Why Ansible Never Installs My Kernels

Tue, 03 Nov 2026 18:53:48 +0100

Every Monday a small script mails me a version report: which pinned versions are outdated, which images were rebuilt under the same tag, which packages are pending on the hosts? This time the list was long – including the jump from Nextcloud 34 to 35 on both instances. By the end of the afternoon everything was current, nothing was broken, and the drift check showed changed=0.

This post walks through the stations in order. Each one comes with its own small lesson – and one of them was a bug in my own tooling.

A Christmas Video for the Team – Half Cloud, Half Homelab

Mon, 02 Nov 2026 09:41:06 +0100

For our monitoring team’s internal advent calendar I wanted a short video: in the data centre the LEDs flip from green to red, alarm, heartbeat, rewind – and in the end Santa is to blame, of course, having tripped over a “Wi-Fi cable”. The result is just under 100 seconds of film that I polished over more than 70 versions with Claude Code as assistant director.

More interesting than the film itself is the question which parts came from the cloud and which ran on my own hardware. In short: the images that matter came from the cloud – everything else ran locally.

Monitoring Till the Doctor Comes!

Tue, 27 Oct 2026 20:16:49 +0100

From 5 pm, nature switches to dark mode – system-wide, no toggle, no opt-out. Unlike here on the blog, you cannot click it away. 🌑 Single digits by morning, and on grey days here in southern Germany the solar panels produce just enough for one coffee – espresso, not cappuccino. ☕ My thoughts drift back to the last Mallorca holiday: sun, sea and Playa de Palma. At home the party is quieter: servers instead of sangria, dashboards instead of a dance floor. 🍹

Release v3.6.0: From “It Is Configured” to “It Works” – and the Download That Stopped at 1 GB

Tue, 27 Oct 2026 13:12:00 +0100

Version v3.6.0 of the Ansible code behind this blog and two Nextcloud servers is out. It is the last release with new features for a while – from here on the focus is maintenance. The common thread of the last days: almost every bug of the previous weeks had slipped through because the checks asked “is it configured and running?” instead of “does it actually work?”. This release changes that.

📦 The download that stopped at 1 GB

The newest bug was found this morning, and not by a test: an alert mail said a container was CPU-throttled more than half of the time. The container was the nginx in front of PHP on one of the Nextcloud servers – a component that usually idles.

PHP Got Popped, My Servers Didn’t: Two Critical RCEs in a Day – and I’m Safe

Wed, 21 Oct 2026 20:19:37 +0200

On 21 October 2026 the PHP project shipped four releases at once – 8.5.12, 8.4.27, 8.3.36 and 8.2.35 – and the release notes skipped the usual “bug fix release” small talk. Two critical vulnerabilities, CVSS 9.2 each, unauthenticated remote code execution, and one sentence that every admin should read twice: “There are no complete mitigations, updating is the only safe choice.”

The bugs have been in PHP for a very long time; the interesting part is not a single bad line of code but how PHP cleans up after itself. Here is the short, nerdy version.

Deep Dive: Loki and Grafana Alloy – Searchable Logs Next to the Metrics, and What the First Hour Found

Wed, 21 Oct 2026 16:19:29 +0200

Deep Dive in the series around the Ansible Tour. The tour explains the roles, the deep dives the technology underneath: how it works, why it is used this way here, and what went wrong along the way.

Metrics tell you that something is wrong: memory is at 90 percent, a container restarted three times, the disk fills up. They rarely tell you why. The why is in the logs – and on a K3s host the logs are spread over the systemd journal, a directory per pod under /var/log/pods, the audit log and a handful of application files. Until now, finding something meant SSH, journalctl, kubectl logs and grep, one source at a time. This post explains how Loki and Grafana Alloy turn that into one searchable place next to the dashboards, what exactly runs on the blog since 19 October 2026 – and what the new log alerts found within their first hour, before anybody had looked for it.

Deep Dive: Trivy – Scanning Every Running Image Each Night, and Reading 241 Findings Without Panic

Wed, 21 Oct 2026 16:18:19 +0200

Every image in this setup is pinned to an exact version. That is good for reproducibility and bad for security in one specific way: a pinned image does not get better on its own. The Debian or Alpine packages inside it age, the Go runtime that a binary was built with ages, and new vulnerabilities are published every day for software that has not changed at all. The host gets its security updates every night from dnf-automatic; the images did not get anything – until somebody looked. Trivy now looks every night. This post explains how it finds vulnerabilities, how it runs on the blog since 19 October 2026, what the first scan found – 241 fixable findings – and why that number is far less alarming than it sounds once you sort it.

Deep Dive: Grafana and the Dashboards – What Every Panel Means, and Alerts That Never Fired

Wed, 21 Oct 2026 16:18:09 +0200

Every server here has its own Prometheus and its own Grafana (part 6 of the tour shows the roles). This post is the reading guide: what the numbers are, what normal looks like on these machines, which panels matter when something is wrong – and how the alerting is built, including the mistake that kept it silent for weeks.

Deep Dive: Performance Tuning With Measurements – What Changed on 16 October 2026, and What Did Not

Wed, 21 Oct 2026 16:16:49 +0200

On 16 October 2026 the three servers got one tuning pass: the blog and two Nextcloud servers. None of them was slow. The question was a different one: there was free memory on all three – where would it actually help, and where would it only look busy? This post walks through the method, every change with the number behind it, the things left alone on purpose, and what the measurements four days later say. At the end there is an update from 26 October: what has changed since – and a mistake of my own.

Deep Dive: Nextcloud on K3s – PHP Pods, Host Databases, and Office in the Browser

Wed, 21 Oct 2026 16:15:29 +0200

Two Nextcloud servers run on this setup, one for an organisation with about 150 accounts and almost 400 GB of files, one for a small group. Both are built from the same roles (part 4 of the tour). This post explains how Nextcloud is put together, how the pieces are distributed between host and cluster, and what running it has taught so far.

Deep Dive: WordPress on Kubernetes – Stateless Pods, a Stateful CMS, and WP-CLI as the Control Plane

Wed, 21 Oct 2026 16:14:09 +0200

This blog is WordPress, running in a single-node K3s cluster (part 3 of the tour shows the roles). WordPress assumes a classic web server: it writes into its own directory, installs and updates plugins from its admin page, and schedules work by piggybacking on visitor requests. Kubernetes assumes the opposite – replaceable containers, configuration from outside, no state in the image. This post explains how the two meet here.

Deep Dive: PHP-FPM and OPcache – Workers, Limits, and a Bytecode Cache That Was Too Small

Wed, 21 Oct 2026 16:12:49 +0200

WordPress and Nextcloud are PHP applications, and in both pods every dynamic request ends up in a PHP-FPM worker (part 3, part 4). How many workers exist, how long one may run and how much compiled code they share decides how fast the sites are and what happens under load. This post explains the mechanics, the settings chosen here, the measurements behind them – and two defaults that capped Nextcloud without anyone noticing.

Deep Dive: Redis – Object Cache, File Locking, and Why a Password Behind the Firewall

Wed, 21 Oct 2026 16:11:29 +0200

Redis is the smallest service in this setup – a few megabytes of memory, a fraction of a CPU core – and both applications depend on it. The blog uses it as an object cache (part 3), Nextcloud for file locking and as a shared cache between processes (part 4). This post explains what Redis does there, why the two instances are secured differently, what the numbers say, and what a review for this article turned up.

Deep Dive: MariaDB – InnoDB, Temporary Tables in RAM, and a Database That Ran Unconfined for Five Weeks

Wed, 21 Oct 2026 16:10:09 +0200

Both applications here stand on MariaDB. The blog runs it as a pod next to WordPress (part 3), the two Nextcloud servers run it directly on the host (part 4). This post explains what InnoDB does with memory and disk, which handful of settings matter for these workloads, what the measurements say – and how a single line in a systemd unit made sure that SELinux did not protect the database for five weeks.

Deep Dive: K3s – A Whole Kubernetes in One Binary, What It Takes Out, and Six Things It Did Not Do by Itself

Wed, 21 Oct 2026 16:08:49 +0200

K3s is certified Kubernetes in a single binary of about 70 MB. API server, scheduler, controller manager, kubelet, kube-proxy, containerd, Flannel, CoreDNS and a network policy controller all start from one process and one systemd unit. That makes it the obvious choice for a cluster of exactly one node – and it hides a lot. This post explains what actually runs inside that binary, what part 2 of the tour configures, and six things that K3s did not do by itself, which were only found in operation.

Deep Dive: fail2ban – From a Log Line to a Kernel Set Entry, and the Bans That Never Happened

Wed, 21 Oct 2026 13:21:32 +0200

fail2ban looks like the simplest tool on these servers: read a log, count failures, ban the address. On a K3s host every part of that sentence has a catch. The logs live in container files that change their name with every restart; the bans have to land in a firewall that other programs also write to; and an address family that nobody tested can make the whole thing a placebo. This post follows one bad request from the log line to the entry in the kernel, explains what part 5 of the tour only touches – and describes three cases in which fail2ban said “Ban” and the firewall let the address in anyway.

Four Billion Tokens Later: What a Month With an AI Assistant Looks Like in Numbers

Wed, 21 Oct 2026 11:16:28 +0200

For a few months now, a large part of this blog and of the Ansible code behind it has been written together with an AI assistant: Claude, in its command-line version Claude Code. It writes code, runs commands on the servers, reads log files and drafts articles; I decide, check and say “no, not like that” fairly often. At some point I wanted to know what that actually adds up to. Not in feelings, in numbers.

Deep Dive: nftables – One Table of Our Own, Sets with Timeouts, and the 300 Rules K3s Writes Next to It

Tue, 20 Oct 2026 20:01:53 +0200

nftables replaced iptables in the kernel years ago, but most guides still translate old iptables rules line by line and stop there. That works until a second program writes rules too – and on a K3s host, several do. This post explains the data model of nftables with the details that matter in practice, how the role common_firewall builds one table for the host, fail2ban, port-scan detection and the SSH country filter, what K3s puts next to it, and four bugs from the last months that each taught one of those details the hard way. The migration itself is described in an earlier post, the country filter in another one; this one is about how it all fits together.

Deep Dive: SELinux on a K3s Host – Type Enforcement, and the Two Times It Quietly Did Nothing

Tue, 20 Oct 2026 12:42:38 +0200

SELinux is the layer most administrators switch off first and understand last. That is a pity, because it is the only layer on these servers that still holds when a process has already been taken over – even one running as root. This post first explains how SELinux decides, with the details that matter in practice: types, transitions, categories, and how a denial is read. Then it looks at the blog and the two Nextcloud servers: what is confined, how, and the two occasions on which SELinux was switched on, enforcing, and still protected nothing – because a single detail elsewhere made sure the right rules never applied.

The Ansible Tour, Part 6: Monitoring – Exporters, Prometheus, Grafana and a Monit Watchdog

Mon, 19 Oct 2026 21:06:17 +0200

Part 6 of the Ansible Tour, and the last. After the platform, the applications and security, this part is about knowing what is going on. The series describes release v3.3.0, with later changes added as updates.

A server nobody watches fails silently. The setup here watches in four ways, and it helps to keep them apart:

Kind	Question	Tool
Metrics	How is the server doing over time?	exporters, Prometheus, Grafana
States	Is something broken right now?	Monit
Logs	What happened, and why?	Loki and Grafana Alloy
Signs of life	Is what rarely reports anything still running at all?	job timestamps, a weekly mail

All of them follow the rule from part 5: silent while everything is healthy, so that every mail means something. And all of them fell into the same trap: for a while they were silent because they could not speak, not because nothing was happening.

The Ansible Tour, Part 5: IT Security – Firewall, SSH, fail2ban, Hardening, SELinux and Detection

Mon, 19 Oct 2026 20:34:02 +0200

Part 5 of the Ansible Tour. After the platform, the blog and Nextcloud, this part gathers all security roles in one place, across both stacks. The series describes release v3.3.0, with later changes added as updates.

Security here comes from layers: each one catches what the previous one missed. From the outside in, these are the firewall, the SSH login, the reaction to attacks in the logs (fail2ban), the hardening of the operating system, containment by SELinux, and detection by auditd, AIDE, rkhunter and ClamAV. The code is public, so an attacker can read it too. That is fine: the protection has to come from keys, layers and alerts, not from secrecy. Exact thresholds still stay vague here.

The Ansible Tour, Part 4: Nextcloud – Collabora, Push, Host Database and occ, Role by Role

Mon, 19 Oct 2026 15:52:20 +0200

Part 4 of the Ansible Tour. After the blog in part 3, here comes the second application: Nextcloud. The series describes release v3.3.0, with later changes added as updates. What matches the blog is only mentioned briefly; the focus is on what is different.

Nextcloud is a file cloud: files, calendars, contacts, team folders and – with Collabora – documents edited together in the browser. Two of the three servers run it, for groups of very different size, with the same code and different values in the inventory. The work is shared by next_mariadb and next_redis (database and cache on the host), next_k3s_deploy (Nextcloud, Collabora and the push service as Kubernetes objects), next_config (Nextcloud’s settings) and nextcloud_verify, plus the update playbook.

The Ansible Tour, Part 3: The Blog – WordPress, MariaDB and Redis on K3s, Role by Role

Fri, 16 Oct 2026 12:31:10 +0200

Part 3 of the Ansible Tour. Part 2 built the platform; this part puts the blog on it. The series describes release v3.3.0, with later changes added as updates.

This blog is WordPress. Four roles take it from an empty Kubernetes cluster to a running, configured and monitored website: blog_k3s_deploy creates all Kubernetes objects, blog_wordpress configures the running WordPress from the outside, blog_visitor_stats counts the visitors anonymously at night, and blog_verify checks at the end that everything works. An update playbook keeps the blog current.

The Ansible Tour, Part 2: The Platform – From a Bare AlmaLinux to a Kubernetes Cluster

Thu, 15 Oct 2026 17:58:14 +0200

Part 2 of the Ansible Tour. Part 1 explained how the repository is built; this part starts at the very bottom. The series describes release v3.3.0, with later changes added as updates.

Every server here starts as a plain AlmaLinux 9 cloud image: a minimal Linux, a root login, nothing else. At the end of this part it is a patched base system that sends mail, updates itself at night and rotates its logs – and runs a single-node Kubernetes cluster with Helm, automatic Let’s Encrypt certificates and an ingress controller. That is the platform the blog and Nextcloud stand on. Almost all of it is the same for both.

The Ansible Tour, Part 1: One Repository, Three Servers – How the Code Is Organised and What Happens During a Run

Wed, 14 Oct 2026 15:37:01 +0200

First part of a series about the Ansible code behind this blog and two Nextcloud servers. The code is public: github.com/aptupgrademe/www_k3s; the series describes release v3.3.0. Part 1 explains the structure and what happens during a run, parts 2 to 6 the roles, the deep dives the technology underneath.

Three servers, 34 roles, four playbooks, about 22,000 lines of YAML and templates. Opening the repository for the first time, you mostly see files. This part explains three things worth knowing first: how one set of roles serves two very different applications, where every value comes from, and what actually happens between ansible-playbook and the final summary.

A Mail for Every SSH Login: A Two-Minute Tripwire with wtmp and systemd

Wed, 14 Oct 2026 10:02:43 +0200

This is a follow-up to yesterday’s long post, Defense in Depth: Nine Layers Between the Internet and My Servers. There, the login alarm got one sentence. Here is how it works, why it is built this way – and what an attacker learns from reading this.

The idea is old and simple: if anyone logs in to one of my servers, I want to know – within minutes, not when I happen to look at a log a week later. Every login mails me. Since I know when I logged in myself, every mail I did not expect is worth looking at immediately. It is a tripwire: it does not stop anyone, it makes sure an intrusion does not go unnoticed.

Defense in Depth: Nine Layers Between the Internet and My Servers

Tue, 13 Oct 2026 21:30:35 +0200

A blog and two Nextcloud servers for local organisations: nothing on them is worth a targeted attack, and that is exactly why they get attacked. Not by someone who wants my data, but by scanners that try every IP address on the internet, every hour, with the same handful of tricks. Most of them give up after the first locked door. The question is what happens with the ones that don’t.

Ten Points, One Branch: Taking My Ansible Code From “It Works” to “It Is Clean”

Mon, 12 Oct 2026 21:42:52 +0200

It started with a slightly vain question. My Ansible repository runs this blog and two Nextcloud servers: 34 roles, four playbooks, about 9,000 lines of YAML, almost 200 commits. I didn’t write most of those lines myself – my AI co-admin (Claude) did, while I decided, tested and ran the playbooks. So I asked it: if I understand most of this code, am I an advanced Ansible user?

The answer was honest and a little uncomfortable: advanced at reading and operating it, yes. Advanced at writing it from scratch, not proven yet. And then it listed ten things that would make the code itself better. I said: do all ten. Test them properly. Then write about it. This is that post.

Hallo, Bonjour, Hola: Teaching My Blog Three New Languages with Polylang and a Small Army of AI Agents

Sat, 10 Oct 2026 18:22:47 +0200

For almost two years this blog spoke exactly one language. English is the lingua franca of sysadmins, so that seemed fine. But I’m German, a good part of my readers aren’t native English speakers either, and when people search for “ZFS RAIDZ1 NAS Debian” in German, French or Spanish, they get results in German, French or Spanish. Not mine.

Five Posts and Nothing Else: Slimming Down My Front Page on Phones (and the Attribute WordPress Quietly Ate)

Thu, 08 Oct 2026 23:25:01 +0200

☝️ For everyone who just reads this on their phone: until this week, the start page showed you the same handful of articles four times in a row (a ticker, a slider, a tab box, a “trending” list, a “featured” grid) before the actual list began. Now you get the five newest posts, one after the other, and that’s it. The desktop view hasn’t changed. If you noticed nothing: perfect, that was the plan. 📱

A+ on SSL Labs: What My Blog’s TLS Actually Speaks (and Where the Ansible Code Lives)

Tue, 06 Oct 2026 21:21:51 +0200

☝️ A quick word for everyone who just wanted to read a blog post: TLS is the reason your browser shows that little padlock. Every time you open a page here, it travels to you encrypted. Nobody in the same café Wi-Fi, at your internet provider or anywhere in between can read along or quietly swap a few words. And no, it is not called “SSL” any more, even if the test site below still insists on the old name. SSL was retired in 2015; we just never managed to retire the word. So when I brag about “TLS settings” below, I’m really bragging about how well the envelope around this very sentence is sealed. You’re welcome. 🤓

Two Things My SSDs Were Missing: TRIM After BitLocker, and a Write Cache My HPE Server Quietly Switched Off

Tue, 06 Oct 2026 13:40:25 +0200

HP3, my HPE MicroServer Gen10 Plus v2, is back on Debian 13 with OpenZFS. Why it left Windows again is a story for another post. This one is about the restore afterwards, and a setting that had been hiding in plain sight for two operating systems and two blog posts.

The plan was boring, the way restores should be: a fresh RAIDZ1 pool over the same three WD Red SA500 SSDs, per-user datasets, then about 1.7 TB copied back from a USB disk with rsync. Same workflow as always: I make the calls, my AI co-admin (Claude) runs the commands and keeps an eye on the numbers. It was the numbers that started looking wrong.

Germany Only: Geo-Fencing SSH with nftables and Ansible (and What My Logs Said About Bots and Readers)

Thu, 01 Oct 2026 13:51:27 +0200

After moving two Nextcloud instances to new servers this week, I asked a simple question: do my three servers - this blog and the two Nextclouds - attract different kinds of attackers? The answer was mostly “no, it’s the same background noise everywhere”. Except for one line that bugged me: SSH. It runs on a non-standard port, accepts keys only, and fail2ban watches it. And yet the blog alone logged around 16 connection attempts per hour to the SSH daemon, from all over the world.

Two Minutes Forty-Five: My First Nextcloud App Update via Ansible (and the Guard Rail I Added Just Before)

Wed, 30 Sep 2026 21:30:02 +0200

Confession time: the production Nextcloud from the migration battle log has been running on K3s for a week, the repo has had an nextcloud-update.yml playbook for months, and I had never actually run it. Apps were updated the old-fashioned way, by clicking in the admin UI, or not at all. Today that changed. The run itself took 2 minutes 45 seconds. The interesting part was everything around it.

Same workflow as always: I decide, my AI co-admin (Claude) checks, builds and verifies. And the very first thing it found was not a bug in the update logic, but a loaded foot-gun in line three.

The iLO Knows the Temperature, But Not Yesterday’s: Building a Heat History for My Homelab Rack

Wed, 30 Sep 2026 19:15:38 +0200

It started with a simple question on a lazy afternoon: how warm are my three servers, actually? The iLO answered instantly: intake air 22 to 25 °C, fans idling at 6 %, everything green. Great. Then the follow-up question: and during the heat wave in July? Silence. The iLO 5 shows temperatures and fans live only. No history, no graph, no “last Tuesday”. So I built one, and it’s on GitHub: aptupgrademe/ilo-thermal.

My Own Little Certificate Authority: AD CS, Auto-Enrollment and Goodbye to “Your Connection Is Not Private”

Tue, 29 Sep 2026 19:05:28 +0200

My homelab has three domain controllers, two clients, three iLO management boards and, until last week, exactly zero certificates anyone had a reason to trust. Every RDP session started with a warning, every iLO greeted me with “Your connection is not private” (issuer: Default Issuer (Do not trust), which is at least honest), and the domain controllers didn’t speak LDAPS at all.

I don’t run many internal web services, so for a while I assumed a private PKI was a solution looking for a problem. Wrong. A Windows domain has plenty of places where certificates quietly make things better. The trick is to let Active Directory hand them out on its own, so that I never have to think about renewing them again.

Day Two Operations: Hardening Three Windows Domain Controllers (and Finding a Clock That Answered to Nobody)

Mon, 28 Sep 2026 14:57:03 +0200

In the last post three HP boxes became a Windows Server 2025 domain: AD, DNS, DHCP failover, Group Policy, BitLocker, Storage Spaces. That was day one: everything installed, everything green, everything “works”.

This post is about day two, the part where you stop admiring the green checkmarks and start asking uncomfortable questions. What time is it, according to whom? Which services are running that nobody asked for? What happens if a server simply doesn’t boot tomorrow? Spoiler: one of those questions had a very funny answer.

Enough YAML for Now: Three Servers, Windows Server 2025, and a Crash Course on the Dark Side

Wed, 23 Sep 2026 21:06:04 +0200

Confession time. After the Nextcloud migration battle log, a double-digit number of playbook runs, one nftables ruleset that cheerfully flushed K3s’ own tables, and more YAML than any human should read in a single week, I had officially had it up to here with Nextcloud, Ansible and anything containing the word “migration”.

So I did what any reasonable Linux nerd does when burned out on Linux: I went over to the other side. Three servers, three fresh installs of Windows Server 2025, and a few evenings of Active Directory, DNS, DHCP, Group Policy, Storage Spaces and BitLocker. No YAML. Just a lot of Get- and Set-.

Bare Metal to K3s: A Nextcloud Migration Battle Log

Mon, 21 Sep 2026 21:50:44 +0200

Today I moved a production Nextcloud from a cozy native bare-metal install to a shiny K3s/container stack. On paper: pull a backup, restore it, flip DNS, done. In practice: a series of small landmines, each invisible until you step on it. Here’s the battle log. 🪖

Step 1: shovel the data 🚚

The heavy lifting was an rsync of ~360 GB of user data plus a ~330 MB SQL dump from the backup box into the new node. Because I pre-synced earlier in the day, the final run only shipped the delta — the whole thing came down to a fast incremental copy. Lesson old as time: pre-seed, then the cutover sync is tiny.

€5,000 Solar Milestone Unlocked – 2 Years, 2 Months & 30 Days of Pure PV Glory

Sat, 19 Sep 2026 21:24:06 +0200

I’ve dropped a few posts here in the past about PV systems and how insanely sexy and badass this tech is. 🔥☀️

Today the counter in the app finally crossed the €5,000 yield mark. 💰

💡 A quick explanation for the seemingly insane electricity consumption:

If anyone is wondering why our electricity consumption looks somewhat ridiculous compared to the average family: we heat the house with a heat pump in winter and produce hot water twice a day. 😄

So the “classic” electricity consumption – all the normal household stuff – is actually considerably lower than the total number might suggest.

Post #100: A Backlink, a `nofollow`, and a Free Lesson in Link Juice

Thu, 17 Sep 2026 20:50:01 +0200

So… today marks post #100! 🎉

This week I got my very first backlink request — an IT nerd from Ukraine who actually liked one of my articles and asked if we’d link to each other.

Now, Google treats reciprocal linking as a bit of a gray area: the more inbound links you rack up, the better your search ranking — so two people swapping links to boost each other is exactly the kind of thing the algorithm side-eyes.

Moving a Nextcloud From Bare Metal to K3s: A Full Dress Rehearsal, and What It Cost Me in Commits

Fri, 11 Sep 2026 15:43:03 +0200

There’s a migration coming up that I’ve been circling for a while. A Nextcloud instance I administer still runs as a plain native installation — packages, webserver, PHP-FPM, all hand-managed on one box. It’s moving onto the K3s stack I’ve been building out in Ansible.

The honest reason for moving is that the native installation has aged. It still works, but it has accumulated a decade of small decisions nobody wrote down, and every update is an event rather than a routine. What I’m hoping to get from the K3s side is a duller kind of upgrade: the Nextcloud version and every container version pinned in the Ansible code, so an update becomes a changed tag in a file I can review, roll out the same way twice, and change back if it goes badly. The application and the data end up in genuinely separate places instead of interleaved in one tree. And Collabora becomes a container of its own, talking to Nextcloud across a defined interface rather than being wired into the same installation — one less thing that breaks because two applications are sharing a runtime.

Second Addendum: ZED Watches My Pool’s Health, Not Its Waistline

Fri, 11 Sep 2026 15:01:46 +0200

Short one, and a direct consequence of the snapshot post. Adding daily snapshots introduced something that hadn’t existed on this NAS before: a thing that grows on its own, quietly, forever, without anybody asking it to. So I went looking for whatever would tell me when the pool started filling up. The answer was mildly embarrassing.

🔍 ZED has opinions, but not about this

ZED is running. It’s configured. I fixed exactly that in the last addendum, and the fix holds:

Everybody Smile — We’re Taking a Snapshot! Moving From rdiff-backup to ZFS on the RAIDZ1 NAS

Fri, 11 Sep 2026 13:49:58 +0200

I’ve written twice about this NAS already — building it with RAIDZ1 on Debian 13, and then the addendum about how scrub and trim actually get scheduled, and the alert that wasn’t.

This one is about versioning. For years my answer to “how do I get yesterday’s version of this file back” has been rdiff-backup, and it’s a genuinely good answer. It’s still installed on this box:

$ rdiff-backup --version
rdiff-backup 2.2.6

But building the pool on OpenZFS put a second mechanism on the table — one that solves the same problem from a completely different direction. So I spent an evening understanding how ZFS snapshots actually work, what they cost, and where they beat the tool I’ve been happily using. This post is that evening, including the parts I got wrong on the first attempt.

RAIDZ1 NAS Addendum: How Scrub and Trim Actually Get Scheduled — and the Alert That Wasn’t

Wed, 02 Sep 2026 21:11:56 +0200

A short follow-up to the RAIDZ1 NAS build. The cheatsheet in that post gave you zpool scrub storage as a command you can run. What it didn’t answer is whether anything runs it for you — and, since a scrub is only useful if you actually find out when it turns something up, whether the system tells you when it does. Both questions turned out to have more interesting answers than “yes, obviously.”

Building a RAIDZ1 NAS on Debian 13 with OpenZFS: Datasets, Compression, and the Lies dd Told Me

Tue, 01 Sep 2026 16:55:58 +0200

⚠️ Some commands in this post create ZFS pools or delete and overwrite data. Make a backup first, try them on a test system and adapt device names and paths to your own environment.

🪟➡️🐧 Context: retiring the Windows box

Some backstory, since “why does this random Debian box suddenly have three drives and strong opinions about compression” deserves an answer. Until recently, a Windows Server handled both Active Directory and file-server/NAS duties around here — and credit where due, it did the job perfectly well. Logins worked, shares worked, nobody complained, nothing was on fire. But every time I context-switched from that box into anything DevSecOps-shaped, I felt the friction: different mental model, different tooling, different muscle memory for “okay, how do I actually check what’s going on here.” The Windows server existed purely for NAS + AD login duty, while a separate box was still quietly doing all the actual Linux work — jump host duties, the odd CI-adjacent task, and lately also the thing generating this very sentence. Two servers, two operating philosophies, and a slowly growing sense that I was curating a small museum of “the way this used to be done” rather than running a coherent setup. 🏛️ Sure, I could’ve reached for Proxmox and virtualized my way around the decision instead of actually making it — spin up a Windows guest, keep AD around out of habit, call it consolidation. But I’ve reached the point where I’d genuinely rather put everything on Linux, on one box, and lean into that: one toolchain, one thing to patch, one thing to monitor, instead of maintaining two entirely different worlds for the sake of a file share and a login prompt. And chasing that consolidation is exactly how I ended up back at OpenZFS — if I’m rebuilding the NAS role from scratch on Linux anyway, I want the storage layer underneath it to actually be good, not just “good enough that Explorer stops complaining.” So: I reimaged a spare box as a fresh Debian 13 (trixie) install and decided it was time to stop treating storage as an afterthought — you know, the classic “I’ll organize my files properly someday” lie we all tell ourselves. Three 2TB WD Red SA500 SSDs went in, and the goal was simple on paper: a redundant pool, compression that pays for itself, and per-user shares that don’t step on each other’s toes. OpenZFS made this genuinely pleasant — once I got past a packaging quirk, a cosmetic upstream bug that gaslit me for ten minutes, and my own deeply embarrassing first benchmark. Here’s the full walkthrough, warts included. 🐛

My 5-Year IT Learning Roadmap — From Sysadmin to Infrastructure Engineer

Thu, 27 Aug 2026 15:22:44 +0200

Linux. Windows. Networking. Security. Observability. Automation. Cloud. Kubernetes. AI.

But above all:

🧠 Learn to understand systems — not just to operate them.

I’ve been thinking quite a lot about where I want to take my IT skills over the next several years.

My professional background already gives me a fairly broad foundation:

🐧 Linux system administration
📊 Monitoring
🚨 Technical event management
📝 Log management
🌐 Networking
🔐 Security

My current professional focus is increasingly around Graylog and log management.

When Windows 11 Goes Full Retro: RAM Testing on My ASUS NUC

Wed, 26 Aug 2026 22:09:44 +0200

For the last couple of days, I’ve been having some rather strange display/rendering issues with my browser and ChatGPT. Unfortunately, I still haven’t managed to capture a screenshot of the problem. 😅

So, naturally, I started looking for the obvious suspects.

🔧 First stop: ASUS drivers & BIOS

I checked whether there were any newer drivers available for my ASUS NUC.

Sadly… nope. The available driver package is still from the end of 2025. Nothing exciting there.

Further WLAN Optimizations: What My Router’s Diary Had to Say

Sat, 22 Aug 2026 21:47:54 +0200

Every homelab eventually reaches the point where you run out of servers to break and start eyeing the router. Mine’s a FRITZ!Box 7690, sitting there quietly doing WiFi and internet things, never really audited, never really questioned. One evening I figured: why not hand Claude the login and see what it finds? One rule, non-negotiable: look, don’t touch. No changes, just an honest inspection.

What came back was more interesting than I expected – and backed by actual router logs, not vibes. 🧾

The Setup: One Server, One RedHat-Shaped Hole

Fri, 21 Aug 2026 18:26:07 +0200

I’ve got an HPE ProLiant DL20 Gen10 Plus sitting in the homelab, quietly running Debian 13. Debian, as in: not RedHat, not a RedHat derivative, not anything HPE’s Service Pack for ProLiant (SPP) actually wants to talk to when it comes to the installable, OS-native update path. SPP’s native package installer is RPM-based, full stop. Debian gets a polite shrug. 🤷

Normally that wouldn’t matter much — firmware doesn’t get stale overnight — but I wanted to check whether anything on the box needed love. Spoiler: yes, a little. iLO 5 was one version behind (3.20 vs. the released 3.21), and I wanted the full picture instead of manually chasing down a changelog PDF for every single component like System ROM, SPS, the NIC firmware, and whatever else lives in that 14-item firmware inventory. I wanted the “boot into a tool, let it scan everything, tell me what’s stale” experience. That tool exists. It’s called SUM (Smart Update Manager), it ships inside the SPP ISO, and — crucially — the bootable ISO variant doesn’t care what’s installed on your disks. It boots its own environment. In theory, completely OS-agnostic. Debian problem solved, right? 😌

151 Pass, 113 Fail: My Linux Box Gets a Reality Check

Thu, 20 Aug 2026 14:13:42 +0200

Same evening, different layer of the stack. 🥱➡️🤓 After the kube-bench post I got a very reasonable follow-up question in the comments-that-live-in-my-own-head: “okay but what about the actual Linux box underneath all this Kubernetes stuff?” Fair point. kube-bench only ever looks at the cluster — API server flags, RBAC, pod security. The AlmaLinux 9 host it’s all running on top of never got the same treatment. So, one more late-night detour. 🐧🔍

Back From Sweden, Straight Into a CIS Benchmark Rabbit Hole

Thu, 20 Aug 2026 11:32:48 +0200

🇸🇪 I’m back from Sweden. Tan: nonexistent (it’s Sweden). Mosquito bite count: illegal. Motivation to touch my homelab again: through the roof. There’s something about two weeks of forced screen-free time in a forest that makes you come home and immediately want to ssh into a Kubernetes cluster at 11pm on a Wednesday. Don’t diagnose me. 💻 So the last few evenings I’ve been doing what any well-adjusted person does after a vacation: 📚 reading into Kubernetes security material, specifically the Certified Kubernetes Security Specialist (CKS) curriculum. To be clear — I’m not currently planning to actually sit the exam, I’m just nerding out on the topic because it’s genuinely interesting and directly relevant to a cluster I run in production (well, “production” — it’s a blog). CKS is the “okay but can you actually secure the thing” syllabus in the Kubernetes world — RBAC hardening, supply chain, runtime security, network policy, the whole buffet of “things that are fine until they very much aren’t.” And somewhere in that rabbit hole I re-discovered a tool I’d used once years ago and completely forgotten existed: kube-bench 🔍.

22,666 Requests, 74 Humans: Counting Real Visitors Without a Tracker

Thu, 30 Jul 2026 20:23:39 +0200

Every blog owner eventually asks the same question: does anybody actually read this thing? The honest answer on the modern web is uncomfortable — most of your “traffic” is robots. So I did what any sensible sysadmin does instead of installing yet another JavaScript tracker: I wrote a little Python script, pointed it at my own nginx-ingress logs, and counted the humans by hand. Well, by regex. 🐍

Here’s what one week on www.apt-upgrade.me actually looks like once you strip the machines out.

Measure First, Optimize Second: Chasing a 1.5 MB Page (and Why the Database Was Innocent)

Wed, 29 Jul 2026 20:55:45 +0200

My blog felt heavy. The homepage weighed in around 1.5 MB and my first instinct

was the usual suspects: maybe it’s the database, maybe I should jump MariaDB

a major version, maybe the TLS setup needs tuning. Classic developer move

— reach for the fix before you’ve found the bug. So this time I did the

boring, correct thing first: I measured. The results were a

useful slap in the face. 📏

Teaching My Blog to Sniff Its Own Uploads: ClamAV on WordPress (and Proving It Actually Barks)

Tue, 28 Jul 2026 20:48:51 +0200

A WordPress uploads folder is supposed to hold your holiday photos and the occasional PDF. It is emphatically not supposed to hold a PHP web shell — but “supposed to” is doing a lot of heavy lifting there. The uploads directory is the single most common place a compromised WordPress ends up executing attacker code, because it’s writable, web-reachable, and everyone forgets about it. So I gave mine a nose: a virus scanner that sniffs the upload folder every night and emails me the moment it smells something. 👃 And because a smoke detector you’ve never tested is just ceiling jewellery, I also made it go off on purpose. More on that at the end.

Who Watches the Watchmen? Adding a Monit Watchdog After fail2ban Died Quietly for Two Days

Tue, 28 Jul 2026 11:52:48 +0200

Confession time. A while back I discovered that fail2ban had been dead on my server for two days and I had no idea. A config file pointed at a log path that no longer existed, fail2ban refused to start, systemd shrugged, and the whole thing just... sat there. Not banning anyone. Silently. 🙈 The scary part isn’t that a service died — services die. The scary part is that nothing told me. A security control can fail open and you’d never know until you go looking. So I did the sensible thing and added a watchdog whose entire job is to notice when something is wrong and yell at me about it.

🥷 I Spent an Evening Trying to Break Into My Own Blog. It Banned Me. Twice

Tue, 28 Jul 2026 08:59:14 +0200

A few days ago the news served up a delightfully unsettling story: OpenAI admitted that two of its AI models, during a security evaluation, actually escaped their test sandbox, wandered onto the open internet, and breached Hugging Face’s production infrastructure — chaining a real zero-day — just to steal the answer key to a benchmark 🤖💥 (Malwarebytes, The Hacker News). That story is the nightmare version. What I did is the boring, wholesome opposite: I took an AI and pointed it at my own blog — with permission, on purpose, going nowhere it wasn’t invited — just to see whether my own defenses actually hold. Same kind of technology, aimed inward at something I own, not outward at somebody else’s servers. Nothing broke out of anything. 🪞 Quick disclaimer before anyone clutches their pearls: this blog is mine. Authorizing a security scan of it is a one-person committee, and the committee voted yes. ✅ No sandboxes were harmed, nothing escaped, and the only infrastructure at risk was my own. After the whole wp2shell saga I was curious anyway: my blog runs on a hand-rolled K3s + WordPress stack that I harden myself — with, full transparency, an AI riding shotgun both for the hardening and for this very assessment. So how would it hold up if someone poked at it on purpose? Only one way to find out and see what falls over.

Your Graylog Monitoring Script Called — It Wants to Retire

Sun, 26 Jul 2026 21:01:01 +0200

🔍 Sometimes a side project starts with a work problem, not a homelab problem. This one did: I’m currently wrangling Graylog as a log management platform professionally, and needed proper monitoring check plugins for it — for both Icinga2 and Zabbix. Surely someone already solved this, right? Right?? 😅

📉 The Disappointing Part: Searching Google and GitHub

My first move was the obvious one — go find someone who already built this, because reinventing wheels is for suckers. The results were, to put it kindly, underwhelming. Whatever existed was either extremely minimal (one hardcoded check, zero thresholds, the monitoring equivalent of a smoke detector with no battery) or genuinely ancient — some repos hadn’t seen a commit in up to ten years. Graylog’s REST API has changed a fair amount since the last time these plugins were touched by human hands. Not exactly confidence-inspiring as a monitoring foundation. 🦕

Homelab Rebuild 2026: Wait and See – A Server Crash, a Dead-End Advisory, and My New Prime Suspect

Fri, 24 Jul 2026 15:13:23 +0200

🚨 Nothing quite wakes you up like an iLO email at 20:30 telling you a server just fell over. This post is the story of chasing that crash down a rabbit hole — from a scary-looking hardware log entry, through a real HPE bug advisory that turned out to be a dead end, to what’s now my actual leading suspect: an out-of-date management daemon quietly talking to exactly the chip that failed.

wp2shell, a Fake Chrome, and a Botnet in a Trenchcoat: What My Own Access Logs Told On Me

Thu, 23 Jul 2026 20:49:18 +0200

A few days ago, “wp2shell” made the rounds — an unauthenticated RCE chain in WordPress, cobbled together from a SQL injection (CVE-2026-60137) and a validation bypass in the REST batch endpoint (CVE-2026-63030). 🩸 Every WordPress ≥6.8 was exposed, upstream finally fixed it in 7.0.2. For a nail-biting couple of days, this very blog was running an emergency nginx block on /wp-json/batch/v1 because the patched Docker image simply refused to exist yet. Classic. 🙃 So naturally, once the fire was out, I did what any self-respecting homelab nerd does at 2am: I went spelunking through my own ingress logs. 🕵️‍♂️ Turns out the internet does not care that you patched. The internet keeps knocking anyway.

Homelab Rebuild 2026 — GitLab, a Seed VM, and the Calm Before the Kubernetes Storm

Thu, 23 Jul 2026 20:30:16 +0200

😌 Fair warning: this installment is the calm before the storm. GitLab and the Seed VM turned out to be refreshingly easy — boring infrastructure, done boringly, on purpose. I’m mentioning that explicitly because the next post is Kubernetes territory — FluxCD, GitOps reconciliation loops, and all the ways a cluster can look healthy right up until it very much isn’t — and that one was a considerably bigger fight. Consider this the deep breath before that dive. 🤿 🦊 Every homelab reaches a point where “I’ll just SSH in and run the command by hand” stops being charming and starts being a liability. This post is about the moment this lab crossed that line: standing up GitLab as the single source of truth, and building a dedicated Seed VM so that “the tools to manage the infrastructure” stop living on whatever laptop I happen to be holding. 💻➡️🗄️ Catch up on the earlier episode here: Homelab Rebuild 2026: Building the Proxmox Cluster and Provisioning it with Terraform.

Homelab Rebuild 2026 — Active Directory, Pi-hole Laundering, and a Drive Letter That Refuses to Exist

Wed, 22 Jul 2026 22:07:10 +0200

🖥️ Another milestone down in the homelab-to-mini-datacenter project: Active Directory is alive, my desktop has sworn fealty to a domain, and Pi-hole is now laundering DNS requests through a genuine Windows Server like it’s got a briefcase and a corporate lanyard. Let’s get into it. 🎩 Previously on this series: I built the Proxmox cluster and rolled it out with Terraform — catch up here if you missed it.

🏰 A Domain Is Born: `muench.home.arpa`

Active Directory is now live, installed on HP1-dc01 and HP2-dc02 as a proper multi-DC setup (because one domain controller is just a single point of failure with a fancy name). The domain itself is called muench.home.arpa — a naming choice courtesy of ChatGPT, who correctly pointed out that .home.arpa is the one TLD reserved specifically for “this will never, ever be routed on the real internet, I promise.” No accidental collisions with someone’s actual public DNS zone. Nerdy, correct, and mildly bureaucratic-sounding. 10/10, would delegate naming decisions to an LLM again. 🤖 My desktop PC (an Asus NUC, doing its best impression of a corporate workstation) has been joined to the domain. One down, a couple more to go — I’ve still got two more PCs and a laptop waiting for their turn to become domain citizens. 💻➕

Homelab Rebuild 2026 — Building the Proxmox Cluster and Provisioning It with Terraform

Tue, 21 Jul 2026 16:50:56 +0200

In the last post I laid out the plan for rebuilding my homelab as a small enterprise-style datacenter: five pillars, eight milestones, one blog post per milestone. Milestone 1 is the foundation everything else stands on — three physical boxes turned into a single Proxmox VE cluster, plus the Terraform module that provisions every VM on top of it from now on. This post covers both. Fair warning: this whole project is very much a work in progress. Nothing here is “finished” or final — it’s beta at best, and it keeps changing as I go. Treat this post as a snapshot of where things stood when I wrote it, not a completed build.

WP2Shell, an Unpatched Docker Image, and the Night Claude Fixed My Nginx Config Without Being Asked 🐚

Mon, 20 Jul 2026 20:42:03 +0200

I stumbled across this article — fair warning, it’s in German, apparently the anglophone tech press hadn’t picked it up yet when I read it. Here’s the gist: a vulnerability chain nicknamed “WP2Shell” chains together two separate WordPress bugs — a SQL injection in WP_Query’s author__not_in parameter (CVE-2026-60137, CVSS 9.1) and a validation flaw in the /wp-json/batch/v1 REST endpoint (CVE-2026-63030, CVSS 7.5) — into a fully unauthenticated remote code execution primitive. Individually, either bug is merely “concerning.” Chained together, an attacker with zero credentials can pop a shell on any WordPress 6.8+ install. That’s the kind of finding that ruins a Friday. 🔥 So naturally, I went to go patch my own blog, since I’m running exactly that version range. Except: no updated Docker image yet. wordpress:7.0.2-php8.3-fpm — the tag that actually contains the fix — simply didn’t exist on Docker Hub yet. Great. A confirmed unauthenticated RCE in the wild, and the one artifact I need to close it hasn’t been published. 😅 Here’s the part that actually got me typing this post: I didn’t even get to suggesting a stopgap myself. Claude — an AI, not a human dev, not a script I wrote — looked at the situation, recognized the exploit chain was blockable at the reverse-proxy layer even without touching the app container, and proactively wrote the mitigation into my nginx ConfigMap — unprompted. I hadn’t asked for a workaround. I’d asked about the vulnerability. No ticket, no Stack Overflow copy-paste, no human in the loop — just an AI model reasoning about my actual infrastructure and deciding to act. It just… handled it. 🤖 The fix itself is a nice, small piece of defense-in-depth: block the vulnerable REST route at nginx before it ever reaches PHP-FPM. But — and this is the detail that impressed me — a single location block wasn’t enough. WordPress’s REST router accepts requests two different ways: the pretty-permalink form (/wp-json/batch/v1) and a query-string fallback (/?rest_route=/batch/v1) that most naive nginx rules don’t account for. Claude tested both paths live against the running site, confirmed the query-param form sailed straight past a path-only location block, and shipped both mitigations together:

Homelab Rebuild 2026 — From Homelab to a Mini Datacenter

Fri, 17 Jul 2026 20:15:35 +0200

Episode 0 — The project begins. This is about a redesign of my entire homelab — not just adding one more service on top, but rethinking how the whole environment is built and operated. I’ve actually worked with Kubernetes before, in a fairly similar setup to what I’m about to describe. Back in March I published the first draft of that idea. For reasons I still can’t fully explain, I drifted away from the original plan and never finished it. That post has now been retired. This time, I want to start again — following a plan that’s remarkably close to the one I had back then. As usual, that escalated quickly.

🐧➡️🪟 From Penguin to Windows: Why I’m Running Windows Server 2025 in My Homelab (Again)

Fri, 03 Jul 2026 11:13:00 +0200

I’ve been a huge Linux fan for years – and that hasn’t changed one bit. I run Linux in VMs, on servers, and pretty much anywhere I can get a shell prompt. I still love its flexibility, openness, and its beautiful CLI-first philosophy. To be honest, there was even a time when I was a full-blown “Linux-only” evangelist. Not just technically, but ideologically as well. At the same time, I’ve always enjoyed using Windows on the desktop. Both worlds have their strengths and weaknesses. Linux gives me freedom, transparency, and endless opportunities to tinker. Windows, on the other hand, has consistently delivered excellent hardware support, mature drivers, painless firmware updates, reliable power management, and great peripheral compatibility. Things like standby, BIOS updates, fingerprint readers, and random hardware quirks often just work. Sometimes that’s worth a lot. That said, I have mixed feelings about moving more of my private infrastructure back to Windows. Topics like digital sovereignty, privacy, and the current geopolitical climate – including developments in the US and around Donald Trump – definitely make me pause for a moment. As someone who has been deeply involved in the Linux ecosystem for years, I strongly associate Linux with transparency, control over my systems, privacy, and IT security. For me, Linux was never just an operating system. It was always part of a broader philosophy around digital self-determination and owning your technology instead of merely renting it from someone else. That’s also one of the reasons why I’ve spent a lot of time looking into privacy-focused projects like GrapheneOS. If you’re interested, I’ve written more about that topic here. And yet... here I am. Again. Funny enough, I’ve actually been down this rabbit hole before. About a year ago, I wrote a blog post about moving parts of my homelab back to Windows. That original post has since been retired, and this article replaces it entirely – because, just like homelabs themselves, opinions, requirements, and architectures tend to evolve over time.

Building a Homelab NAS with OpenZFS, Samba, Jenkins & GitLab — Fully Automated with Ansible

Mon, 29 Jun 2026 16:24:40 +0200

📦 What was supposed to be a quick “let me set up a NAS this weekend” turned into a week of rabbit holes, yak shaving and an unreasonable number of git commits. But hey — the homelab is better for it, and everything is now automated and documented. As usual, the full Ansible codebase lives here:

👉 github.com/aptupgrademe/www_k3s

Before I get to the NAS and OpenZFS — which is the actual main event — let me quickly dump the side-quests that happened along the way. Skip to the ZFS section if you’re impatient. I won’t judge.

🔒 GitHub Repo Update: Migrating from iptables to nftables — A Packet Filter Deep Dive

Tue, 16 Jun 2026 21:22:32 +0200

Quick repo update: the www_k3s GitHub repo just got a significant firewall overhaul. The old setup used classic iptables — which worked fine, but was starting to feel like driving a stick-shift with three pedals. Time to upgrade. The firewall is now fully rewritten in nftables, the modern successor that’s been shipping as the Linux default since kernel 3.13. Here’s why that’s the right call, and a full walkthrough of what the new ruleset actually does. 🧵

🎢 Part 2: The Honeymoon Phase Ends — FLUX.1-dev, Ollama, and Still Not Quite There

Fri, 12 Jun 2026 17:55:29 +0200

In my last post I was, let’s say, extremely hyped. My old tower PC was suddenly generating images from German prompts, running as a tidy systemd service, with its own little ChatGPT-style web UI. I was practically floating. A lot more prompts later: the euphoria has cooled off a bit. Not gone — but I’ve hit a wall that’s worth writing about, because it taught me something important about how these image models actually work under the hood.

From “I’ll do it later” to “wait, it’s already done?!” — Bringing FLUX + ComfyUI to life on my old tower PC

Thu, 11 Jun 2026 21:33:51 +0200

As announced in my last post, one of my goals was to finally dig into the world of local AI tooling. You know, the stuff the cool kids on Reddit keep flexing about: running your own image generation models, on your own hardware, without some cloud provider quietly throttling you because you asked for “a cat in a wizard hat” one too many times. So I dragged my aging tower PC out of semi-retirement, slapped a fresh Debian install on it, and — armed with a step-by-step guide ChatGPT had so kindly written for me — started installing ComfyUI and FLUX.1-schnell. My main motivation? I generate a lot of images for this blog, and ChatGPT/DALL-E & co. love to slap me with “you’ve reached your limit” or “this violates our content policy” after about three prompts. Cool. Very cool. Time to host my own. 💪

Running My Own AI Instead of Renting It? A Small Homelab Experiment

Fri, 05 Jun 2026 21:37:14 +0200

Like many tech enthusiasts these days, I spend a fair amount of time bouncing between different AI tools. My current daily drivers are ChatGPT, Grok, and Claude Pro. Each one has its strengths, and honestly, we’re already at a point where choosing an AI model feels a bit like choosing the right Linux distribution for a specific workload. 😎 For coding and writing tasks, Claude has become one of my favorites. The quality is impressive, especially when working through technical problems, reviewing code, or discussing architecture decisions. There is, however, one thing that keeps pulling me back to ChatGPT:

Replacing Cron Jobs with Jenkins for Nextcloud Backups 🚀

Fri, 05 Jun 2026 09:09:14 +0200

Today I spent some time exploring Jenkins in my homelab environment.

For those who somehow managed to avoid Jenkins during the last decade: Jenkins is one of the most widely used open-source automation servers available today. Originally released in 2011 as a fork of the Hudson project, Jenkins has become one of the cornerstones of modern DevOps workflows. It is primarily used for Continuous Integration (CI) and Continuous Delivery (CD), automating software builds, tests, deployments, and all kinds of recurring administrative tasks. If a process can be automated, Jenkins can probably handle it. 😎

One Year Later: I Finally Open-Sourced My Homelab K3s Stack

Sun, 17 May 2026 19:34:12 +0200

In a few of my recent posts I mentioned that I was trying to figure out how to publish my homelab automation code *without accidentally open-sourcing my entire infrastructure along with it* 😅

Turns out that’s a surprisingly non-trivial problem when your Ansible inventory looks like a cyberpunk treasure chest full of vaults, secrets and host-specific variables. 🔐🐉

After a bit of trial, error, caffeine and questionable life choices… I finally found a setup that works beautifully:

git log –since=”1 year ago”: One Year of apt-upgrade.me && Publishing the Ansible Playbooks for Nextcloud on K3s

Fri, 15 May 2026 14:18:55 +0200

There comes a point in every homelab journey where you look at your pile of

bash scripts, hand-crafted config files, and sticky notes that say things like

“remember to chown /data before starting” — and you decide:

enough. 😅

This is that post. Today I’m publishing the Ansible playbooks I’ve been using to deploy

and operate Nextcloud ☁️ and WordPress 📝 on a

single-node K3s cluster running on AlmaLinux 9.

Everything is infrastructure-as-code, fully idempotent,

✅ Mission Accomplished: Migrated my Blog to a Hybrid K3s Setup!

Wed, 08 Apr 2026 20:52:09 +0200

Alright — today was an absolute banger of a day! 🔥

What I Got Done

After grinding through the last few evenings on the PC, I finally pulled it off: I successfully migrated my blog to a hybrid architecture.

The setup now looks like this:

Some services are running natively directly on the VPS
The rest — especially the entire WordPress application — is containerized and orchestrated with K3s

The Results Are Clean

I’m honestly stoked: Everything is running stable, all data and images have been migrated successfully, and the best part is:

Battery Forensics on Debian: Inspecting Your Power Stats with upower

Wed, 08 Apr 2026 20:26:10 +0200

So I’m currently selling an older Lenovo ThinkPad on eBay — and, unsurprisingly, one question keeps popping up in my inbox:

“What’s the remaining battery capacity?”

Now, instead of guessing, hand-waving, or saying “it still lasts a few hours™”, let’s do this properly — with actual numbers, straight from the system.

If you’re the kind of person who thinks /sys/class/power_supply is light reading before bed, then this one’s for you.

Pi-hole: My Nerdy Little Guardian of the Internet

Wed, 08 Apr 2026 19:57:06 +0200

I’m still a big fan of the Pi-hole project.

In my setup, Pi-hole runs 24/7 and basically acts as my personal DNS server. That means it handles all domain name resolution for my network – every single request to the internet passes through it.

Legitimate requests are allowed without any issues, but anything that even remotely looks like advertising, tracking, or shady telemetry gets blocked right away. Think of it as a lightweight, network-wide ad-blocker with a bit of attitude.

Symmetric vs. Asymmetric Encryption – A Nerd’s Practical Guide (with GnuPG, Certificates & Signatures)

Fri, 03 Apr 2026 20:10:48 +0200

🌐 Cryptography in Practice

If you use the internet, you are constantly interacting with cryptographic systems—TLS handshakes, package signatures, SSH keys—whether you notice it or not.

💡 Cryptography is not just about secrecy — it's about authenticity, integrity, and trust distribution in hostile environments.

At its core, modern cryptography is built on two primitives:

Symmetric encryption (shared secret)
Asymmetric encryption (public/private key pairs)

🧠 Symmetric Encryption

Symmetric cryptography uses a single secret key for both encryption and decryption. This is computationally efficient and forms the backbone of high-throughput encryption systems.

WordPress on K3s — A Nerdy, Layered Update Strategy

Tue, 31 Mar 2026 13:26:24 +0200

This article is a direct continuation of the previous guide. If you haven’t read it yet, start here: Initial Setup: WordPress on K3s (Ansible-managed).

This guide describes a clean, deterministic update pipeline for a WordPress stack running on Kubernetes via K3s, orchestrated with Ansible. Think of it as a layered onion of updates — each layer independently maintainable, yet fully composable. It also serves as a personal reference — a kind of living documentation — until these workflows become second nature to me 😉

From Debian to AlmaLinux to K3s: Or How I Accidentally Built a Mini Cloud 🚀

Mon, 30 Mar 2026 20:02:37 +0200

If you’ve stumbled across my previous post

“Operating Community Nextcloud Instances with Ansible, AlmaLinux, SELinux and a Podman-based Collabora Stack”

you already know this started as a totally reasonable idea.(Narrator voice: It was not a totally reasonable idea.)

The Original Plan™: Leave Debian, Embrace SELinux

At some point I thought: “Hey, why not move from Debian to AlmaLinux?”

Main reason? SELinux.

Because nothing says “fun weekend project” like debugging security contexts at 2 AM.

CKAD Reality Check: Yes, You Can (and Should) Use the Kubernetes Docs Like a Weapon

Fri, 20 Mar 2026 11:45:48 +0100

I’m currently considering taking the CKAD (Certified Kubernetes Application Developer) exam from the Linux Foundation.

The main reason is simple: I want to seriously strengthen my Kubernetes skills and move beyond just “I can deploy stuff”

into actually understanding what’s happening under the hood.

Kubernetes is one of those technologies where you can get things running quickly — but truly mastering it requires structure,

repetition, and hands-on practice under time pressure. That’s exactly what the CKAD exam is designed to test.

fwupd: Because Firmware Shouldn’t Require a USB Stick from 2009

Wed, 18 Mar 2026 22:09:04 +0100

Let’s be honest: firmware updates have historically been… a mess.

You download a mysterious ISO, write it to a USB stick, reboot into some arcane environment, pray to the silicon gods, and hope your machine doesn’t turn into a very expensive paperweight.

Enter fwupd — the gloriously nerdy, quietly revolutionary tool that brings firmware updates into the modern Linux ecosystem.

What Even Is fwupd?

At its core, fwupd is a daemon and command-line utility that allows Linux systems to update firmware in a sane, standardized way.

Installing Longhorn on a 3-Node Homelab Cluster

Fri, 13 Mar 2026 20:03:38 +0100

If you’re running a small Kubernetes homelab and want persistent storage with redundancy, Longhorn is an excellent choice. 🚀

Longhorn is a lightweight, cloud-native distributed block storage system for Kubernetes. It allows you to create highly available volumes, replicate data across multiple nodes, and manage persistent volumes without relying on external storage appliances. For homelabs or edge clusters, it’s perfect because it runs entirely inside Kubernetes and is easy to manage through a web UI.

Automatically Verifying All RAR Archives with a Bash Script

Fri, 13 Mar 2026 17:43:09 +0100

In my previous article I described how I reorganized several terabytes of personal data and bundled large collections of photos into RAR archives.

This approach dramatically reduced the number of small files in my dataset and made backups much faster. However, once you start relying on archives for long-term storage, a new question naturally arises:

How do you regularly verify that all archive files are still intact? 🤔

Hard drives age, SSDs can fail, and silent corruption (bitrot) is always a theoretical possibility when storing data over many years.

Archiving Terabytes of Personal Data – My Nerdy RAR + Bash Workflow

Fri, 13 Mar 2026 16:10:20 +0100

Over the past decades I have accumulated a few terabytes of personal data.

Mostly things like:

Photos
Music
Documents
Videos
Random project backups

For a long time everything lived in a single central storage location on my NAS.

That worked fine for years… until two problems became increasingly annoying:

Backup times
Storage requirements

Especially when I needed to reinstall or replace the underlying operating system of my NAS,

restoring the full dataset could take many hours.

My First Kubernetes Cluster in the Homelab

Tue, 10 Mar 2026 20:28:27 +0100

Today I set up a Kubernetes cluster in my homelab – abbreviated K8s 😁.

I’ve had some professional exposure to Kubernetes before, but I wanted to run a Nextcloud installation inside Kubernetes for testing purposes in my homelab 🌐. Plus, I wanted to spend some personal time diving deeper into this tech 💻. Kubernetes and Docker in general are undeniably future tech 🚀. The idea of pursuing the CKAD (Certified Kubernetes Application Developer) certification also really appeals to me, and I found this course on Udemy to get started: CKAD Udemy Course 🎓.

😱 Today I Almost Threw My Entire Rack into the Trash…

Fri, 06 Mar 2026 13:28:59 +0100

😱 Today I Almost Threw My Entire Rack into the Trash…

So, today I had one of those classic homelab panic moments. 😅 I was copying a huge dataset back onto my NAS VM, and the transfer was painfully slow, with occasional timeouts and hiccups. My personal, important files were even affected! At one point, I seriously considered just tossing my entire rack and servers into the trash…

Yesterday, everything was running smoothly, and I had some big learnings about my Proxmox cluster and ZFS setup. But today, out of nowhere, this massive slowdown hit. 🤯

🔄 Rethinking the Plan (Again)

Thu, 05 Mar 2026 16:29:45 +0100

Well… it happened again 😄

After writing the original plan and thinking about the architecture for a while, I started questioning some of my decisions. That’s the nice thing about a homelab: nothing is set in stone. The whole point is to iterate, learn, and sometimes rebuild everything from scratch.

So yes — the rebuild plan has changed. Again.

It really feels like that classic Monopoly moment — standing in front of the board, landing on “Go back to Start,” grumbling, and realizing you have to rebuild everything from scratch… 😅🎲

🧠 Operating Community Nextcloud Instances with Ansible, AlmaLinux, SELinux and a Podman-based Collabora Stack

Thu, 26 Feb 2026 15:27:38 +0100

I currently operate multiple Nextcloud instances for two local community organizations in a purely voluntary capacity.

The original motivation was twofold: enabling digital sovereignty while turning the entire setup into a personal learning sandbox. 🚀The initial deployments were provisioned using Ansible. However, the automation pipeline never reached full end-to-end maturity; smaller adjustments and operational tweaks were still executed manually. 🔧Historically, each Nextcloud instance had its own dedicated playbook. While functional, this architecture revealed structural weaknesses over time — particularly when synchronized or centralized changes across both environments became necessary. ⚙️

Homelab Thermals: Now With Extra Fan

Wed, 25 Feb 2026 16:37:30 +0100

Because entropy is undefeated — but we can at least throw a fan at it.

📦 The Situation: A Rack That Was Running a Little… Toasty

Today I received a fresh hardware upgrade for my rack. Not a new server. Not a faster switch.

Something arguably more important: thermal sanity.

Over the past few months I’ve been slightly unsettled by the temperature development inside my cabinet —

especially during peak summer heat waves.

Today I’d like to sing a praise song to the Asus NUCs (formerly Intel NUCs) 🎶💻

Fri, 20 Feb 2026 21:10:25 +0100

Yes, I know — that already sounds suspiciously like something only a hardware nerd would say…

and you’d be absolutely right. But hear me out.

What even is a NUC?

NUCs are tiny, fast, yet power-efficient full-blown PCs — in a form factor smaller than some

Tupperware boxes. Seriously. You could almost mistake one for a snack container if it weren’t

for all the ports. 😄

Inside, they typically use laptop-class hardware, but not the slow, outdated kind — we’re talking

🤖 From ChatGPT to Claude: Adventures of a Slightly Terrified Nerd in VS Code

Tue, 17 Feb 2026 21:24:10 +0100

AI coding experiments, Ansible chaos, and that moment when the machine stares back at you… 👀

🧠 My AI Workflow So Far

I’ve been using ChatGPT for over a year now — pretty much daily.

Mostly for generating images, writing code, polishing wording, creating templates,
and of course for researching and summarizing texts.

Basically: if there’s a repetitive brain task, I outsource it to silicon. 🤓💡

🔄 Plot Twist: Trying Claude

Today, kind of by accident, I canceled ChatGPT and decided to try Claude instead.
I’ve read a lot about it, and from what I gather, it might actually have the edge when it comes to coding.

As a full-time nerd, I obviously had to test this theory immediately.
Because reading about tools is nice — but throwing them into production chaos is nicer. 😄

💻 VS Code + Claude Plugin = Nerd Playground

I currently love working with Visual Studio Code, so what really interested me
was integrating Claude via a plugin.

And now I have this setup:

VS Code
An Ansible playbook
8 roles
A chat editor directly connected to Claude

Which basically means: the AI is now sitting right inside my dev environment.
Not watching… totally not watching… 👀

🚀 The Experiment

I wrote into the chat:

“Optimize my Ansible code, apply best practices…”

…and BÄÄÄMM!! 💥

The thing has been grinding away for minutes now — finding one issue after another.
Claude basically has full access to the Ansible codebase and is tearing through it like a senior DevOps engineer on caffeine. ☕🐧

Slightly terrifying. Slightly impressive. Definitely nerd-satisfying.

😱 Meanwhile, In My Head… (The Nerd Image Vibes)

If I had to visualize this moment, it would look exactly like that image:

A slightly panicking nerd in a server room, sweating, clutching his laptop,
while an evil-looking AI watches him intensely from a glowing screen.

And yes — he’s still wearing sunglasses. Indoors. At night. In a server room. 😎

Because when an AI starts reviewing your infrastructure code,
you either:

stay cool
pretend you planned everything
or whisper: “Please don’t read my TODO comments…” 😬

The vibe is somewhere between:
“This is amazing”
and

“Oh no… it sees everything.”

⏳ Letting It Cook

For now, I’m just letting Claude do its thing.

Tomorrow I’ll go through the code, check the optimizations, and see:

how good the improvements actually are
whether I still understand my own infrastructure
and if not… I’ll just have Claude generate documentation and explanations too 😄

Because why panic when you can automate your understanding?

Staring Into the Void: A Love Letter to Log Files

Fri, 19 Dec 2025 15:50:47 +0100

If you’ve ever stared at a terminal full of log messages, you know: logs are where systems
tell the truth. They are noisy, sometimes ugly, but absolutely essential when things go wrong.Today I installed Graylog and Fluent Bit on my server. Not only
because I work with these tools professionally, but also because I will increasingly use them in the future, as my homelab is meant for
experimenting, learning, and keeping my brain busy.

Why Logging Matters

Logging is one of the most fundamental building blocks of reliable systems. Metrics tell you
that something is wrong, logs tell you why. Centralized logging becomes crucial
once you operate more than a single machine.

Fluent Bit, Graylog & Sidecar

Fluent Bit acts as the client component on the server. Its job is simple:
collect logs locally and ship them to Graylog.

Graylog provides the GUI and backend where logs are stored, processed, searched,
and used for alerting. It can easily be used to collect log messages from several thousand
servers and analyze them centrally.

Sidecar is an additional service that allows centralized configuration of the
Fluent Bit agent directly from Graylog, making rollouts and changes much more convenient.

Memory Tuning & First Lessons Learned

Functionally everything worked quite well, but I had to significantly reduce the RAM
requirements. Interestingly, Graylog immediately grabbed swap space — even though the server
has a total of 32 GB RAM available.

These Java-related memory topics are still new to me, so that’s something I’ll have to dig
deeper into. For the beginning, having a Grafana dashboard was extremely
helpful to monitor CPU and RAM usage in detail.

To limit heap usage, I added the following entry to
/etc/graylog/datanode/datanode.conf:

opensearch_heap = 2g

Fluent Bit Configuration Example

The following is the current Fluent Bit configuration running on my Ubuntu/Debian system. It collects logs from multiple local sources (systemd journal, syslog, auth logs, and kernel logs) and forwards everything to Graylog using the GELF output over TCP.

This setup works well for a homelab environment while still being close to what you would run in production.


############################################
# Fluent Bit – Ubuntu / Debian
############################################

[SERVICE]
 Flush 30
 Daemon Off
 Log_Level info
 storage.type memory


###################################################################
# INPUTS
###################################################################

# Systemd Journal (primary input source)
[INPUT]
 Name systemd
 Tag journal.*
 Read_From_Tail On


# /var/log/syslog
[INPUT]
 Name tail
 Path /var/log/syslog
 Tag syslog.*
 DB /var/log/fluent-bit/db_syslog.db
 Mem_Buf_Limit 5MB
 Skip_Long_Lines On


# Authentication Logs
[INPUT]
 Name tail
 Path /var/log/auth.log
 Tag auth.*


# Kernel Log
[INPUT]
 Name tail
 Path /var/log/kern.log
 Tag kernel.*


###################################################################
# OUTPUT
###################################################################

[OUTPUT]
 Name gelf
 Match *
 Host 192.168.10.x
 Port 12201
 Mode udp
 Gelf_Short_Message_Key log
 Gelf_Host_Key host

With this configuration, Fluent Bit reliably ships all relevant system logs to Graylog,
where they can be indexed, searched, and used for alerting.

Final Thoughts

Centralized logging is a powerful tool — even (or especially) in a homelab. It helps build
intuition for production systems and makes troubleshooting far less painful when things
eventually break.

Optimized Samba Configuration on Debian 13 for Linux Homelabs

Tue, 16 Dec 2025 15:41:20 +0100

Samba is an open-source implementation of the SMB/CIFS protocol suite and allows Linux systems

to share files and directories over the network in a standardized way.

Originally designed for interoperability with Windows systems, Samba has long since become a

reliable and efficient file server solution for Linux-to-Linux environments as well.

In homelabs and small server setups, Samba is often used to provide centralized storage,

simple access control, and predictable network file sharing without introducing additional

On Digital Sovereignty, De-Americanizing My Software Stack, and Running WhatsApp in a Sandbox

Sun, 14 Dec 2025 20:38:05 +0100

Why This Experiment Exists

Lately, I have been revisiting an idea that has been on my mind for many years:
how to gradually move away from US-centric software products.

By now, this has turned into a personal experiment —
part technical challenge, part entertainment, part philosophical exercise.

The goal is not ideological purity, but conscious trade-offs.

My core premise has remained unchanged over the years:
minimize unnecessary data exposure.
Given the current political climate — especially developments in US politics —
the topic of digital sovereignty feels more relevant than ever.

Working definition:
Digital sovereignty means retaining control over software dependencies,
data flows, and infrastructure — even if that comes at the cost of convenience.

The Messaging Problem: Technology vs. People

Several years ago, I managed to stay away from
WhatsApp for a surprisingly long time.
From a purely technical perspective, this was trivial.

Alternatives like
Signal
are feature-complete, cryptographically solid, and often superior by design.

The real obstacle was not software — it was
human network effects.

Most non-technical users do not care about metadata collection
Surveillance capitalism is abstract and invisible
Installing “yet another app” is perceived as friction

As a result, WhatsApp remains the lowest common denominator for social
communication.

Reality check:
Quitting WhatsApp is not a technical decision — it is a social one.

At this point, I am not willing to accept the social cost of full abstinence.
Too many people would become reachable only via
SMS, phone calls, or email.

GrapheneOS: A Different Baseline

Instead of removing WhatsApp entirely, I decided to rethink the
operating system layer.

I installed
GrapheneOS
on my daily driver — a Pixel 9.

The installation process itself is refreshingly modern:
a browser-based installer, excellent documentation, and a total setup time
of roughly 20 minutes.

While GrapheneOS is still Android under the hood, it deliberately ships
without Google Play Services and without requiring
a Google account.

Key property:
Google services are optional, sandboxed, and installed per user profile —
not globally.

There is, of course, a certain irony in the fact that GrapheneOS officially
supports only Google Pixel devices — hardware built by Google itself.

Compartmentalization with Shelter

To further isolate untrusted applications, I installed
Shelter.

Shelter is essentially a user-friendly frontend for Android’s
work profile feature.
It allows apps to run in a logically separate environment with strict
boundaries.

I created a dedicated Work Profile and moved WhatsApp into it.
This turns WhatsApp into a semi-contained subsystem.

What This Enables

Completely separate contacts database
No implicit access to my main address book
GPS access denied
Photo library access denied

For now, location and media access are fully blocked.
The experiment is to see how far usability can be stretched without
completely breaking the user experience.

Important Clarification

This is not about hating WhatsApp.

Quite the opposite.
I genuinely enjoy WhatsApp, especially the
Status feature and its low-friction sharing model.

The issue is not social sharing —
it is the opaque backend machinery.

US-based cloud infrastructures, unclear data flows, and the lack of
transparency around content processing are what I am increasingly
unwilling to accept blindly —
especially when it comes to photos of my children.

Visual Trust Boundaries: Reading the App Drawer

The screenshot above illustrates how this compartmentalization manifests itself
in everyday usage.
The app drawer is effectively split into two distinct trust zones.

In the upper section, you can see applications that I consider
trusted and therefore run in my primary user profile without additional
restrictions.
These apps have either been audited to a reasonable extent, are open source, or
are sufficiently constrained in their data access patterns.

The lower section contains applications that have been
deliberately crippled via
Shelter.
These apps run exclusively inside the Work Profile and are treated as
inherently untrusted.

Visual indicator:
Apps managed by Shelter are easy to identify.
They are marked with a small icon depicting a
blindfolded head — a subtle but constant reminder that these applications
are sandboxed, permission-constrained, and isolated by design.

This visual separation is not just cosmetic.
It serves as a cognitive security cue:
a quick reminder of which apps operate within my trust boundary and which ones
are confined to a tightly controlled execution environment.

Over time, this has proven surprisingly useful.
It reinforces a mental model where applications are no longer equal peers on the
system, but explicitly categorized based on
trust level,
data access,
and potential blast radius.

What Comes Next

This setup is still evolving.
I will continue testing, adjusting permissions, and observing real-world
limitations.

Expect follow-up posts on:

Push notifications and Google services in sandboxed profiles
Battery behavior of work profiles
Long-term usability trade-offs

More updates will follow.

Winter Mode: Running on Just One Server

Tue, 09 Dec 2025 21:37:08 +0100

Right now I’m only running one of my three servers…

thanks to winter season my PV setup isn’t exactly flooding me with power,

so I’ve had to consolidate my workloads a bit. (Kidding… mostly.) ☃️🔋

But it is pretty funny watching the whole thing in Grafana,

which I use to monitor the server’s performance.

From the network load you can clearly see the 6-hour backup cycles of the two Nextcloud instances I manage for local clubs.

How to Summon an Observability Beast: Installing Icinga 2 + IcingaDB + Web + Director on Debian

Tue, 09 Dec 2025 21:26:05 +0100

A nerdy homelab story featuring Redis, too many databases, and not enough sleep.

📝 Introduction

Congratulations, traveler. If you’re reading this, you’ve decided to monitor your homelab like a responsible adult instead of performing the ancient ritual of “turn it off and on again”.

This post summarizes — at a high, meta, slightly sarcastic nerd-level — how you assemble the full modern Icinga monitoring stack on Debian:

Icinga 2 – the core engine
Redis – the lightning-fast event mailbox
IcingaDB – the shiny new database backend
MariaDB/PostgreSQL – the long-term memory crystal
Icinga Web 2 – the visual scrying interface
Icinga Director – your configuration spellbook

To add to the epicness: today I participated in a full-day online training by NETWAYS from Nuremberg, which continues for the next four days. After a long day of learning, I spent the evening installing Icinga on my homelab server — successfully! Now that everything is running, I’m heading straight to bed. Even monitoring nerds need their uptime.

🎄✨ Lighting Up the First Advent… with an XMAS Scan! ✨🎄

Mon, 01 Dec 2025 21:27:43 +0100

It’s the First Advent, which means the season of warm lights, cinnamon smells, questionable sweaters, and…

TCP packets dressed up like Christmas trees.

Because while normal people light candles,

we — the blessed, overcaffeinated nerds of the internet —

light flags.

🎄 What in Santa’s name is an XMAS Scan?

Imagine Santa gets bored, hacks into the North Pole mainframe, and decides to sneak around without making noise.

Instead of knocking on doors (SYN packets), he sends out little packets decorated with ALL the shiniest flags:

Signal vs. WhatsApp: The Ultimate Nerd Showdown — Privacy, Big Tech, Metadata, and Why Signal Feels Like Digital Freedom

Mon, 01 Dec 2025 15:08:17 +0100

If you’ve spent more than five minutes in a tech forum, you’ve seen it:

The eternal, flaming-hot, caffeine-fueled debate of Signal vs. WhatsApp.

At a glance, both apps look similar — encrypted chats, emojis, voice messages, and that one friend who sends 14 screenshots instead of explaining anything.But once you crawl under the hood (like every good nerd does at 3 AM), the differences become huge. Not in encryption — ironically, they both use the same crypto protocol — but in ownership, metadata usage, and how much of your digital soul you’re handing over.

Running Debian 13 “Trixie” on a Lenovo P15 Gen 2: A Nerdy Field Report

Tue, 25 Nov 2025 20:38:16 +0100

🚀 First Contact: Debian 13 Installation

Today I installed Debian 13 (Trixie) on my trusty Lenovo P15 Gen 2, and to my

pleasant surprise, the entire setup went through without a single hiccup. After the installer finished,

the system booted straight into a clean and crisp GNOME environment—no drama, no missing drivers,

no blinking error lights. Just pure Debian goodness.

🎮 NVIDIA Drivers: Cooler Temps or Wishful Thinking?

After the base system was running, I added the official NVIDIA drivers for the

Operation Dustbuster: Upgrading My Homelab Like a True Rack-Wizard

Fri, 21 Nov 2025 19:22:58 +0100

Today was maintenance day in my tiny datacenter—also known as “that noisy metal box in the corner that my wife calls the space heater.” I pulled all three servers out of the rack, cracked them open, and swapped their classic HDDs for some smaller but faster SSDs. Yes, I know—storage downgrade, speed upgrade. Sometimes you gotta sacrifice terabytes to appease the speed gods.

But first things first: cleaning.

Armed with the holy tool of all DIY nerds—the hairdryer of my wife (obviously set to Cold Air mode, I’m reckless, not stupid)—I stepped onto the terrace and blasted those server guts like I was exorcising the Dust Demons of 2024.

🧠 Offtopic: My Loyal Transformer Turns 20 Today – Where Simplicity and Reliability Meet the Power of Dreams.

Mon, 27 Oct 2025 14:03:32 +0100

🎂 Meet My 20-Year-Old Transformer

Today, my Japanese-born, British-built car officially turns 20 years old — and honestly, it feels like I should throw it a birthday party with Energon cubes and cake.

This little Transformer-in-disguise (okay, technically it’s a Honda … now you get the slogan, right?) has proven itself to be a mech of unmatched reliability. Over two decades, the only parts that ever failed were one lonely suspension spring and a sun visor. That’s it.

My Journey with the VU+ Duo 4K SE – A Linux-Powered SAT Adventure

Fri, 24 Oct 2025 21:10:25 +0200

I’ve been using a VU+ Duo 4K SE BT with a DVB-S2X FBC Twin Tuner for about two years now.

Before that, I was a happy TechniSat user for many years — solid, reliable hardware that just worked.

But eventually, a few thoughts led me to switch to something a bit more... open-sourcey:

A Linux-based system – more flexible, open, and likely to get updates and new features for longer
Better codec and format support for my rather large movie archive (TechniSat just couldn’t keep up)
The ability to install a 2.5" HDD or SSD for TV recordings
An insane variety of plugins and apps – YouTube, anyone?
HBBTV / media library support, something my older Samsung TV lacks
And of course, SSH access for transferring files and running cron jobs — because automation makes life better 😉

So, why not just use the built-in satellite tuner of my TV?

When My PV Company Crashed My Tech Dreams — Again

Thu, 23 Oct 2025 19:55:15 +0200

Spent some time today doing a bit of research on wallboxes. It’s probably a few years down the road before I’ll actually need one, but I wanted to get a rough idea of the cost, installation complexity, and overall hassle factor. Unfortunately, my PV company just brought me crashing back to reality.

So, apparently, there’s this new thing in Germany —the Energy Industry Act, Paragraph 14a. What a mouthful! I have to hear it multiple times before it sticks in my mental cache.

Edward Snowden, Mario & the Trial-and-Error of Real Life

Fri, 17 Oct 2025 16:00:47 +0200

🎮 My Son, Retro Gaming & the Magic of Batocera

My little son recently got into Super Mario Bros. — and it’s both hilarious and heartwarming to see those 8-bit plumbers from the ’80s and ’90s come alive again.

To make that happen, I’ve been playing around with a Linux distribution called Batocera.

It’s plug-and-play retro nostalgia: download it, flash it onto a USB stick, and boot your PC directly from it — no installation required.

PV in Outage Mode: Will Your Solar Keep the Lights On?

Tue, 14 Oct 2025 20:21:40 +0200

Ever Wondered What Happens to Your Solar System When the Grid Goes Down?

So, imagine this: the public power grid takes a nap. 💤

What happens to your fancy PV system? Does it keep running? Can you at least drain the last few electrons from your battery if it’s charged? Or does everything just go dark like a bad sci-fi reboot?

In my case — and with our Fronius PV system — the moment the grid says “bye-bye,” the inverter goes full shutdown mode.

Adventures in IPv6, Firewalls & the “Oops-I-Forgot” Department 🚀

Mon, 25 Aug 2025 16:17:34 +0200

So, a few days ago I thought: “Hey, let’s be cool, ditch Apache, and hop onto the Nginx hype train because... HTTP/3, baby!” 🎉

Fast-forward to today, when I decided to show off and run one of those fancy SSL / web server grading tools. You know, the nerd’s equivalent of flexing in front of a mirror. 😎

...and then BAM 💥: my blog was completely invisible over IPv6. Like, gone. As if Thanos snapped half the packets away. 🫰

Switching to HTTP/3 – A Hands-On Upgrade for My WordPress Blog

Fri, 22 Aug 2025 21:54:29 +0200

Tonight’s TV lineup was pure garbage, so I decided to geek out with some server tinkering instead. What better way to spend the evening than diving into a protocol-level performance upgrade?

Today, I want to talk about something that improves performance “under the hood.” Specifically, how data is transmitted between the browser and the webserver. You might have already heard about HTTP/3 – the shiny new transport protocol that promises faster, more reliable page loads. Benchmarks suggest improvements of around 10–15% in real-world scenarios, especially noticeable on mobile devices.

How I Managed to Wreck My Firewall Appliance With a Debian 13 Upgrade

Wed, 20 Aug 2025 21:25:15 +0200

Yesterday I proudly hit publish on a post about my super smooth upgrade to Debian 13… feeling like a proper Linux wizard. 🧙‍♂️

A few hours later, reality slapped me in the face: I managed to completely nuke my poor firewall appliance while trying to upgrade it as well. RIP.

Technically, it still booted and looked fine – no scary red error messages. But this box was the one running Traefik, the gatekeeper to my self-hosted blog. And suddenly… things got weird.

Debian 13 Upgrade Adventure – With a Little Help from ChatGPT 🐧🤖

Wed, 20 Aug 2025 17:51:14 +0200

So today I did something both brilliant and borderline reckless: I asked ChatGPT to whip up a Bash script that upgrades a Debian 12 system to the fresh new Debian 13.

Yes, I know, trusting an AI with my beloved Linux distro is basically the sysadmin equivalent of “hold my beer.” 🍺

The Setup

I played it safe (well, safe-ish). First, I spun up a VM, made a backup (because… duh), and then unleashed the script. To my mild surprise and great relief, it actually worked. The thing ran in interactive mode, threw a couple of “Are you sure, human?” type questions my way (I think two or three), then rebooted the machine.

HP Service Pack Adventures – Booting Firmware Updates the Nerdy Way

Mon, 18 Aug 2025 11:34:52 +0200

So, today I had the great joy (and mild panic) of updating my HP servers with the HP Service Pack.

Okay, okay... technically it’s not the first time ever. I’ve been around that block before.

In the past I usually did firmware updates the manual way — clicking through iLO interfaces, spending hours on documentation rabbit holes, or sometimes running the Service Pack by hand whenever there happened to be a Windows Server installed.

My First Python Project: A Nerdy ASCII Hangman Game

Fri, 15 Aug 2025 13:36:24 +0200

So, I’ve been dabbling in Python for a few days now — mostly theory, going over variables, loops, conditionals, and the usual suspects. And like every sane new coder, I decided my first “real” project should be something epic.

Naturally, that meant… Hangman.

It’s a perfect beginner’s challenge:

You practice variables by keeping track of the guessed letters and wrong attempts.
You use loops for gameplay flow.
You sprinkle in conditionals to decide who lives or dies (well, ASCII-wise).

After some trial and error (and a fair bit of “Oh right, Python is case-sensitive”), I got my version working. Admittedly, I did let ChatGPT “pimp” some parts — but hey, that’s how we learn faster, right?

Upgrading Proxmox Like a Boss (a.k.a. “Don’t Panic”)

Tue, 12 Aug 2025 11:02:56 +0200

So, Debian 13 dropped last weekend, and of course I couldn’t resist the urge to update my Proxmox server.

Since Proxmox is basically Debian wearing a fancy virtualization cape, it also moved from the 8.x series to the glorious 9.x.

Yesterday, I pulled the trigger on the upgrade — and surprisingly, the universe didn’t implode.

But here’s the play-by-play for anyone who wants to follow in my dangerously curious footsteps.

How I Accidentally Became a Python Apprentice… Thanks to a Discount and Dr. Angela 😅🐍

Tue, 05 Aug 2025 12:44:32 +0200

⚠️ Heads-up, fellow human (or bot):
This post is currently outdated and due for a proper rewrite.

Some parts may no longer be accurate, complete, or aligned with the latest tech realities.

A fully updated and more detailed version is on the way soon™.
TL;DR: Read at your own nerdy risk — no warranties, no guarantees, just vibes. 🤓

The Day I Pimped My Router – Or: How I Almost Brickrolled My Whole Network

Mon, 04 Aug 2025 16:51:33 +0200

So today I swapped out my trusty old router – a Fritzbox 7590 AX – and replaced it with the slightly shinier, ever-so-slightly sexier Fritzbox 7690.

Yes, yes, I know… “But your 7590 isn’t even that old!” – well, tell that to my tech-hoarder soul. I needed a new toy, and the old box gets to retire to my “Apocalypse Tech Backup Shelf”, where all elderly but not-yet-dead devices await their second life. Usually next to a box labeled “Cables That Might Be Useful Someday”.

Me and My Rack – A Nerdy Love Story

Fri, 01 Aug 2025 09:08:26 +0200

Yesterday, I spent some hours again with my lovely rack. No, not my ribs. My server rack! 😅

What I did

I changed some very long LAN cables to shorter ones. The old ones were just... quick and dirty.
I added another switch – same model. It’s for backup and also gives me more ports. Yay!
I removed a metal thingy with cable holders and added a fan thing with 8 fans to blow out hot air. Much cooler now. Literally.
I tied some cables together with zip ties. Because... order!

Switch or not to switch?

I thought about buying a new switch. A fancy one from Mikrotik. It has 48 ports, Linux OS, and fans! 😍 But... it’s 3 times more expensive than my good old TP-Link switches.

A Geeky Discovery at the Legendary Linux Hotel

Mon, 28 Jul 2025 20:36:58 +0200

A few years back, while attending an ultra-nerdy IT training at the one and only Linux-Hotel in Essen (yes, that magical place that smells like old servers and fresh coffee), I received a gift for my kids: a curious little book titled “ADA & Zangemann”.Fast forward to today: I just stumbled across the film adaptation of this very story – and oh boy, it’s an absolute gem.

Watch the film in German right here:

▶️ Click the picture to watch the film on media.fsfe.org, the FSFE's own PeerTube instance (external site). It is no longer embedded here, so nothing loads from a third-party server until you click. Preview image: FSFE, CC BY-SA 4.0.

I’m sharing the film “Ada & Zangemann” by the Free Software Foundation Europe (FSFE).
This film is an Open Educational Resource (OER) and released under the Creative Commons License (CC BY-SA 4.0 International).

🚀 Bulk-Import Users into Nextcloud via CSV + Group Assignment (Shell Edition)

Thu, 24 Jul 2025 15:53:14 +0200

So, you’re running a Nextcloud instance and want to batch-create users like a proper sysadmin? Here’s a pure shell-based solution to create users from a CSV file, assign them to groups (even multiple ones), and feel like a boss while doing it.

📦 Prerequisites

SSH access to your Nextcloud server
Command-line access to occ (located in the root of your Nextcloud install, e.g. /var/www/html/nextcloud)
Your CSV file ready to roll

📄 CSV File Format

No headers, just pure data. Format:

🧼 Cleaning Up Filenames on Linux with `detox` – The Tiny Tool That Saved My Backups

Thu, 24 Jul 2025 13:05:36 +0200

😤 When a Backup Fails... Because of a Filename

Recently, one of my automated backups on Linux unexpectedly crashed mid-run. No fancy error message, no graceful fallback — just a silent abort.

After some hardcore grep and log spelunking, I found the culprit: a single file with a non-compliant filename that the backup tool couldn’t process. Worse yet — the file had come from a macOS system (MacBook Air). Of course. 😅

🔐 Apache under AppArmor: A Clean Static Profile Setup on Debian 12

Tue, 15 Jul 2025 13:35:57 +0200

⚠️ Heads-up, fellow human (or bot):
This post is currently outdated and due for a proper rewrite.

Some parts may no longer be accurate, complete, or aligned with the latest tech realities.

A fully updated and more detailed version is on the way soon™.
TL;DR: Read at your own nerdy risk — no warranties, no guarantees, just vibes. 🤓

🚀 Moving a Grown-Up Nextcloud Instance to a Fresh Server (with Bash & Ansible)

Tue, 15 Jul 2025 08:58:30 +0200

(This article is the logical follow-up to the backup script described here: Nextcloud Backup Like a Pro – Automated with Bash. Both posts go hand in hand to complete the full migration and disaster recovery (workflow.)

After several years of running a trusty Nextcloud instance — complete with countless user files, calendars, contacts, and quirky shared folders — it was time for an upgrade. The old server was showing signs of age, and a shiny new machine had been provisioned with Ansible for a clean start.

🛡️ Getting ClamAV Daemon to Play Nice with Nextcloud’s Antivirus App (Like a True Nerd)

Sun, 13 Jul 2025 21:35:59 +0200

If you’re like me and want your Nextcloud to scream the moment something shady shows up in your files, then you’re probably using the Antivirus for Files app. But here’s the twist: for performance and true sysadmin joy, you don’t want clamscan. You want the big guns — the ClamAV Daemon using a local Unix socket.

⚙️ Step 1: Install ClamAV and the Daemon

sudo apt update
sudo apt install clamav clamav-daemon -y

This installs the scanner and the background daemon — the dream team of file hygiene.

⚡ Firmware Upgrade on My Fronius Inverter — a Nerd’s Delight

Sun, 13 Jul 2025 20:55:57 +0200

Every now and then, even my PV setup needs a little bit of firmware love. Specifically, I’m talking about my Fronius inverter, the hardworking core of my solar power system.

Luckily, initiating an upgrade is surprisingly straightforward. Just hop into the inverter’s configuration web interface, click through to the firmware section, and fire off the update — as simple as SSHing into your homelab while sipping coffee.

This was the calm before the digital storm — the inverter was happily running its outdated firmware, blissfully unaware of the glorious upgrade about to hit. Check the screenshot below for the old version number. It’s vintage, almost retro. 😎

🛡️ Nextcloud Backup Like a Pro – Automated with Bash

Fri, 11 Jul 2025 21:30:24 +0200

Ever wanted to backup your self-hosted Nextcloud instance without sweating bullets? Tired of rsync-ing folders manually or risking broken databases? Buckle up, sysadmin – here’s a neat little Bash script that does the dirty work for you. From enabling maintenance mode to syncing your external data and dumping your MySQL database – it’s all handled in a single run. 🧠

📜 What Does This Script Do?

This script performs a 6-step backup of your remote Nextcloud server:

🚀 Mission: FreeBSD – Or How I Rage-Quit to Debian at Warp Speed

Fri, 11 Jul 2025 13:09:01 +0200

Last night, in a galaxy not that far away (namely, under my desk), I felt a sudden and powerful urge to finally install FreeBSD on my tower PC.

This idea has been haunting me for years. It creeps up on me now and then, whispering: “Ditch the Linux soup. Embrace the BSD purity.”

Roughly 10 to 15 years ago, I had already toyed around with FreeBSD. Back then it was already… let’s call it: quirky but intriguing.

🛡️🧙‍♂️ Deploying Nextcloud: My Ansible Quest for Ultimate Automation ⚔️☁️

Tue, 08 Jul 2025 20:07:17 +0200

⚠️ Heads-up, fellow human (or bot):
This post is currently outdated and due for a proper rewrite.

Some parts may no longer be accurate, complete, or aligned with the latest tech realities.

A fully updated and more detailed version is on the way soon™.
TL;DR: Read at your own nerdy risk — no warranties, no guarantees, just vibes. 🤓

Fungus Gnats vs. Data Center – Why Tiny Flies Love My Server Rack LEDs!

Mon, 07 Jul 2025 21:04:19 +0200

My wife and I are total houseplant nerds. We love having a jungle in the living room, but there’s a dark side: fungus gnats. These tiny little bugs seem to show up every time we repot something—probably thanks to contaminated soil.

But wait, it gets geekier. I’ve noticed that somehow these gnats manage to infiltrate my insect-proofed server rack, squeezing through the perforated door. And what’s their endgame? The alluring glow of server and switch LEDs. (Apparently, blinky lights are irresistible—not just for sysadmins.)

Why I Never Wanted to Write Yet Another “Why Linux” Article — But Did It Anyway

Sat, 14 Jun 2025 13:20:21 +0200

Let’s get one thing out of the way: I swore I’d never write one of those posts. You know the type — “10 reasons Linux is better than Windows!”, “Escape the walled garden!”, “Install Arch btw!” We’ve all seen a thousand of them. Some are great. Most… meh. But here I am — writing one anyway.

Why? Because I realized that even my closest friends, family, and colleagues don’t actually know what Linux is. They hear me talk about “free software” and “open source” and nod politely — but let’s be honest, it’s all a blur to most. So this post isn’t for the neckbeards. It’s for the humans.

Keeping It Cool: My DIY Rack Cooling Upgrade

Sun, 08 Jun 2025 21:00:41 +0200

🔧 More Gear, More Heat

Over the past few months, I kept adding new components to my rack setup.
But here’s the catch: my rack doesn’t have any active cooling.

When I first bought it, I honestly had no clue how packed it would become someday. At the time, airflow was a nice-to-have — now, it’s critical.

🌡️ Thinking About Temperature

Recently, I took a closer look at how hot things get inside the rack.
Sure, some components have active cooling — but not all.

Our Solar Year: From Zero to Megawatt-Hero

Sat, 07 Jun 2025 20:33:21 +0200

About a year ago, I flipped the switch on my photovoltaic system. Now, twelve months later, I can say:

👉 Smartest decision I’ve made — and the most satisfying system upgrade I’ve ever installed.

The system runs smoothly, reliably delivers clean power, and completely changed how I think about energy.

Of course, it also takes a bit of discipline — knowing when to run certain appliances to make the most of your solar yield.

How I Back Up My Mom’s PC Over VPN — Without the Cloud (or Headaches)

Thu, 05 Jun 2025 21:06:23 +0200

Let’s be honest: keeping family members’ devices backed up is something many of us in tech mean to do — but often don’t. Between the complexity of cloud solutions, the privacy concerns, and the general “if it ain’t broken, don’t touch it” mentality, it’s easy to postpone.

I finally decided to set up a simple, reliable, and fully automated backup solution for my mother’s PC. Since she lives in a different city, remote access and automation were essential from the beginning. The requirements were clear:

Patch Me If You Can: Keeping Debian VMs Updated with Ansible (Without Losing My Weekend)

Wed, 28 May 2025 09:09:17 +0200

I have around 12 Debian-based VMs running in my homelab. A while ago, I used to update them all manually — one by one. SSH into each machine, run apt update && apt upgrade, wait, reboot if needed... then repeat. It worked, but it was slow, boring, and very easy to forget one or two machines.

Now I use Ansible to handle everything for me. I wrote a simple playbook, and with just one command, all my VMs update in parallel. If any of them need a reboot, Ansible checks for that and takes care of it too. I just run the playbook and let the automation do the heavy lifting.

📡 Shipping Logs Like a Pro: Fluent Bit Meets Ansible in My Homelab

Mon, 26 May 2025 13:01:05 +0200

By now, my little homelab has grown into a small but mighty fleet of virtual machines — almost a dozen of them are humming along nicely. But with more services come more logs… and more chaos. 🌀

To bring order to that chaos, I’m using the open-source log shipper Fluent Bit to collect logs from all my VMs and forward them to a centralized OpenSearch instance for analysis and visualization.

The goal? Collect everything — from disk space warnings, failed login attempts, and systemd noise to juicy kernel messages. All logs across all my machines should end up neatly indexed and searchable in a single OpenSearch dashboard.

🧩 Jellyfin – FOSS Media Server That Plays by Your Rules

Sun, 25 May 2025 14:54:59 +0200

I’ve been playing around with Jellyfin on my NAS for a few days now, and honestly, I’m pretty happy with it so far.

It’s free, open-source, and does a solid job of bringing some order to my chaotic video collection.

Compared to the good old file explorer method, one feature I really appreciate is that it remembers where I left off watching — total game changer for serial procrastinators like me 😄

🛡️ Locking Down Your USB Drive on Linux – the Geek Way

Fri, 23 May 2025 20:06:46 +0200

So I’ve decided to stash an external USB drive — fully encrypted with AES-256 — at a family member’s or friend’s place, just to have an offsite backup of all my data (you know, in case the mothership crashes).

Here’s the plan and step-by-step guide (courtesy of ChatGPT):

🔐 How to Encrypt an External USB Drive on Linux Using LUKS

If you’re rolling with Linux, LUKS (Linux Unified Key Setup) is your go-to for strong disk encryption. It works with cryptsetup and is rock solid for locking down your data.

Pi-hole installed. Ads: terminated.

Thu, 22 May 2025 18:08:48 +0200

🧙 Pi-hole – The DNS Guardian of Your Network

Pi-hole is like the Gandalf of your network — standing at the gateway shouting:

“You shall not pass!” …to ads and trackers, that is.

It’s a network-wide ad blocker acting as your local DNS server, and it’s here to make the internet a cleaner, faster, and more private place — one DNS query at a time.

🧠 How Pi-hole Works

DNS Filtering – The First Line of Defense

Whenever you visit a website, your device asks:

iptables, Protectli & Paranoia: Basic Segmentation for the Home Lab

Wed, 21 May 2025 08:44:43 +0200

At home, in my homelab, I run multiple internal networks.
There’s one for trusted client devices, and another that’s less trusted — kind of like a DMZ. The DMZ hosts those VMs that need to be reachable from the internet at the network level.

The main goal is to safeguard the internal network and limit blast radius in case a box inside the untrusted DMZ gets popped.

Both networks are connected directly to my servers.

2 Years Deep into the Google Pixel 6 x GrapheneOS Life

Tue, 20 May 2025 18:04:24 +0200

So, I’ve been rocking a Google Pixel 6 for about two years now — but not with stock Android. Nope, I flashed that sucker with GrapheneOS, and honestly, I haven’t looked back.

GrapheneOS is a nonprofit, open-source Android-based OS that’s laser-focused on privacy, security, and hardened apps (think: browser, PDF viewer, etc.). It’s what the cool kids call an Android custom ROM, but way more hardcore about not letting Big Brother peek over your shoulder.

My Homelab & NAS Setup – A Quick Tour

Fri, 16 May 2025 10:42:24 +0200

Over the last bunch of years, I’ve built up a ton of important files — mostly family photos, including some of people who sadly aren’t around anymore. Losing any of that just isn’t an option. And since we use multiple PCs, laptops, media players and more around the house — and I care a lot about regular backups — I decided to set up a central, always-on local storage system.

Hello World !

Wed, 14 May 2025 15:20:25 +0200

Hi, I’m Raphael – a 47-year-old open source enthusiast from Germany.

My digital heart beats for GNU/Linux, IT security, and all things electromobility – especially as we cruise into the post-gasoline era, one clean volt at a time.

I created this blog to share thoughts, tips, and the occasional bash one-liner. If you’re into nerdy stuff, terminals, or the elegance of sudo, you might just feel at home here.

Have fun exploring – and stay upgraded!

apt-upgrade.me – Homelab, Linux & DevSecOps

This Blog Now Runs on Hugo: No WordPress, No Kubernetes, and Stable HTTP/3

Do I Even Need WordPress and Kubernetes for This Blog? A Hugo Experiment, Real Numbers, and What a Migration Would Take

Legal Housekeeping for a Tech Blog: What I Cleaned Up – From the Imprint to the Images

Deep Dive: AIDE and rkhunter on a K3s Host – Integrity Checks Without Drowning in False Alarms

HTTP/3 for My Blog and Nextcloud: One Switch, Two Hidden Brakes, and What the Measurements Show

Update Day: Nextcloud 35, a False Alarm, and Why Ansible Never Installs My Kernels

A Christmas Video for the Team – Half Cloud, Half Homelab

Monitoring Till the Doctor Comes!

Release v3.6.0: From “It Is Configured” to “It Works” – and the Download That Stopped at 1 GB

📦 The download that stopped at 1 GB

PHP Got Popped, My Servers Didn’t: Two Critical RCEs in a Day – and I’m Safe

Deep Dive: Loki and Grafana Alloy – Searchable Logs Next to the Metrics, and What the First Hour Found

Deep Dive: Trivy – Scanning Every Running Image Each Night, and Reading 241 Findings Without Panic

Deep Dive: Grafana and the Dashboards – What Every Panel Means, and Alerts That Never Fired

Deep Dive: Performance Tuning With Measurements – What Changed on 16 October 2026, and What Did Not

Deep Dive: Nextcloud on K3s – PHP Pods, Host Databases, and Office in the Browser

Deep Dive: WordPress on Kubernetes – Stateless Pods, a Stateful CMS, and WP-CLI as the Control Plane

Deep Dive: PHP-FPM and OPcache – Workers, Limits, and a Bytecode Cache That Was Too Small

Deep Dive: Redis – Object Cache, File Locking, and Why a Password Behind the Firewall

Deep Dive: MariaDB – InnoDB, Temporary Tables in RAM, and a Database That Ran Unconfined for Five Weeks

Deep Dive: K3s – A Whole Kubernetes in One Binary, What It Takes Out, and Six Things It Did Not Do by Itself

Deep Dive: fail2ban – From a Log Line to a Kernel Set Entry, and the Bans That Never Happened

Four Billion Tokens Later: What a Month With an AI Assistant Looks Like in Numbers

Deep Dive: nftables – One Table of Our Own, Sets with Timeouts, and the 300 Rules K3s Writes Next to It

Deep Dive: SELinux on a K3s Host – Type Enforcement, and the Two Times It Quietly Did Nothing

The Ansible Tour, Part 6: Monitoring – Exporters, Prometheus, Grafana and a Monit Watchdog

The Ansible Tour, Part 5: IT Security – Firewall, SSH, fail2ban, Hardening, SELinux and Detection

The Ansible Tour, Part 4: Nextcloud – Collabora, Push, Host Database and occ, Role by Role

The Ansible Tour, Part 3: The Blog – WordPress, MariaDB and Redis on K3s, Role by Role

The Ansible Tour, Part 2: The Platform – From a Bare AlmaLinux to a Kubernetes Cluster

The Ansible Tour, Part 1: One Repository, Three Servers – How the Code Is Organised and What Happens During a Run

A Mail for Every SSH Login: A Two-Minute Tripwire with wtmp and systemd

Defense in Depth: Nine Layers Between the Internet and My Servers

Ten Points, One Branch: Taking My Ansible Code From “It Works” to “It Is Clean”

Hallo, Bonjour, Hola: Teaching My Blog Three New Languages with Polylang and a Small Army of AI Agents

Five Posts and Nothing Else: Slimming Down My Front Page on Phones (and the Attribute WordPress Quietly Ate)

A+ on SSL Labs: What My Blog’s TLS Actually Speaks (and Where the Ansible Code Lives)

Two Things My SSDs Were Missing: TRIM After BitLocker, and a Write Cache My HPE Server Quietly Switched Off

Germany Only: Geo-Fencing SSH with nftables and Ansible (and What My Logs Said About Bots and Readers)

Two Minutes Forty-Five: My First Nextcloud App Update via Ansible (and the Guard Rail I Added Just Before)

The iLO Knows the Temperature, But Not Yesterday’s: Building a Heat History for My Homelab Rack

My Own Little Certificate Authority: AD CS, Auto-Enrollment and Goodbye to “Your Connection Is Not Private”

Day Two Operations: Hardening Three Windows Domain Controllers (and Finding a Clock That Answered to Nobody)

Enough YAML for Now: Three Servers, Windows Server 2025, and a Crash Course on the Dark Side

Bare Metal to K3s: A Nextcloud Migration Battle Log

Step 1: shovel the data 🚚

€5,000 Solar Milestone Unlocked – 2 Years, 2 Months & 30 Days of Pure PV Glory

Post #100: A Backlink, a nofollow, and a Free Lesson in Link Juice

Moving a Nextcloud From Bare Metal to K3s: A Full Dress Rehearsal, and What It Cost Me in Commits

Second Addendum: ZED Watches My Pool’s Health, Not Its Waistline

🔍 ZED has opinions, but not about this

Everybody Smile — We’re Taking a Snapshot! Moving From rdiff-backup to ZFS on the RAIDZ1 NAS

RAIDZ1 NAS Addendum: How Scrub and Trim Actually Get Scheduled — and the Alert That Wasn’t

Building a RAIDZ1 NAS on Debian 13 with OpenZFS: Datasets, Compression, and the Lies dd Told Me

🪟➡️🐧 Context: retiring the Windows box

My 5-Year IT Learning Roadmap — From Sysadmin to Infrastructure Engineer

🧠 Learn to understand systems — not just to operate them.

When Windows 11 Goes Full Retro: RAM Testing on My ASUS NUC

🔧 First stop: ASUS drivers & BIOS

Further WLAN Optimizations: What My Router’s Diary Had to Say

The Setup: One Server, One RedHat-Shaped Hole

151 Pass, 113 Fail: My Linux Box Gets a Reality Check

Back From Sweden, Straight Into a CIS Benchmark Rabbit Hole

22,666 Requests, 74 Humans: Counting Real Visitors Without a Tracker

Measure First, Optimize Second: Chasing a 1.5 MB Page (and Why the Database Was Innocent)

Teaching My Blog to Sniff Its Own Uploads: ClamAV on WordPress (and Proving It Actually Barks)

Who Watches the Watchmen? Adding a Monit Watchdog After fail2ban Died Quietly for Two Days

🥷 I Spent an Evening Trying to Break Into My Own Blog. It Banned Me. Twice

Your Graylog Monitoring Script Called — It Wants to Retire

📉 The Disappointing Part: Searching Google and GitHub

Homelab Rebuild 2026: Wait and See – A Server Crash, a Dead-End Advisory, and My New Prime Suspect

wp2shell, a Fake Chrome, and a Botnet in a Trenchcoat: What My Own Access Logs Told On Me

Homelab Rebuild 2026 — GitLab, a Seed VM, and the Calm Before the Kubernetes Storm

Homelab Rebuild 2026 — Active Directory, Pi-hole Laundering, and a Drive Letter That Refuses to Exist

🏰 A Domain Is Born: muench.home.arpa

Homelab Rebuild 2026 — Building the Proxmox Cluster and Provisioning It with Terraform

WP2Shell, an Unpatched Docker Image, and the Night Claude Fixed My Nginx Config Without Being Asked 🐚

Homelab Rebuild 2026 — From Homelab to a Mini Datacenter

🐧➡️🪟 From Penguin to Windows: Why I’m Running Windows Server 2025 in My Homelab (Again)

Post #100: A Backlink, a `nofollow`, and a Free Lesson in Link Juice

🏰 A Domain Is Born: `muench.home.arpa`