AI-assisted administration – apt-upgrade.me – Homelab, Linux & DevSecOps

Two Things My SSDs Were Missing: TRIM After BitLocker, and a Write Cache My HPE Server Quietly Switched Off

Tue, 06 Oct 2026 13:40:25 +0200

HP3, my HPE MicroServer Gen10 Plus v2, is back on Debian 13 with OpenZFS. Why it left Windows again is a story for another post. This one is about the restore afterwards, and a setting that had been hiding in plain sight for two operating systems and two blog posts.

The plan was boring, the way restores should be: a fresh RAIDZ1 pool over the same three WD Red SA500 SSDs, per-user datasets, then about 1.7 TB copied back from a USB disk with rsync. Same workflow as always: I make the calls, my AI co-admin (Claude) runs the commands and keeps an eye on the numbers. It was the numbers that started looking wrong.

Germany Only: Geo-Fencing SSH with nftables and Ansible (and What My Logs Said About Bots and Readers)

Thu, 01 Oct 2026 13:51:27 +0200

After moving two Nextcloud instances to new servers this week, I asked a simple question: do my three servers - this blog and the two Nextclouds - attract different kinds of attackers? The answer was mostly “no, it’s the same background noise everywhere”. Except for one line that bugged me: SSH. It runs on a non-standard port, accepts keys only, and fail2ban watches it. And yet the blog alone logged around 16 connection attempts per hour to the SSH daemon, from all over the world.

Two Minutes Forty-Five: My First Nextcloud App Update via Ansible (and the Guard Rail I Added Just Before)

Wed, 30 Sep 2026 21:30:02 +0200

Confession time: the production Nextcloud from the migration battle log has been running on K3s for a week, the repo has had an nextcloud-update.yml playbook for months, and I had never actually run it. Apps were updated the old-fashioned way, by clicking in the admin UI, or not at all. Today that changed. The run itself took 2 minutes 45 seconds. The interesting part was everything around it.

Same workflow as always: I decide, my AI co-admin (Claude) checks, builds and verifies. And the very first thing it found was not a bug in the update logic, but a loaded foot-gun in line three.

The iLO Knows the Temperature, But Not Yesterday’s: Building a Heat History for My Homelab Rack

Wed, 30 Sep 2026 19:15:38 +0200

It started with a simple question on a lazy afternoon: how warm are my three servers, actually? The iLO answered instantly: intake air 22 to 25 °C, fans idling at 6 %, everything green. Great. Then the follow-up question: and during the heat wave in July? Silence. The iLO 5 shows temperatures and fans live only. No history, no graph, no “last Tuesday”. So I built one, and it’s on GitHub: aptupgrademe/ilo-thermal.

My Own Little Certificate Authority: AD CS, Auto-Enrollment and Goodbye to “Your Connection Is Not Private”

Tue, 29 Sep 2026 19:05:28 +0200

My homelab has three domain controllers, two clients, three iLO management boards and, until last week, exactly zero certificates anyone had a reason to trust. Every RDP session started with a warning, every iLO greeted me with “Your connection is not private” (issuer: Default Issuer (Do not trust), which is at least honest), and the domain controllers didn’t speak LDAPS at all.

I don’t run many internal web services, so for a while I assumed a private PKI was a solution looking for a problem. Wrong. A Windows domain has plenty of places where certificates quietly make things better. The trick is to let Active Directory hand them out on its own, so that I never have to think about renewing them again.

Day Two Operations: Hardening Three Windows Domain Controllers (and Finding a Clock That Answered to Nobody)

Mon, 28 Sep 2026 14:57:03 +0200

In the last post three HP boxes became a Windows Server 2025 domain: AD, DNS, DHCP failover, Group Policy, BitLocker, Storage Spaces. That was day one: everything installed, everything green, everything “works”.

This post is about day two, the part where you stop admiring the green checkmarks and start asking uncomfortable questions. What time is it, according to whom? Which services are running that nobody asked for? What happens if a server simply doesn’t boot tomorrow? Spoiler: one of those questions had a very funny answer.