AI – apt-upgrade.me – Homelab, Linux & DevSecOps

Legal Housekeeping for a Tech Blog: What I Cleaned Up – From the Imprint to the Images

Thu, 05 Nov 2026 08:56:08 +0100

Up front: this is a field report, not legal advice. I am an admin, not a lawyer. If in doubt, ask someone who does this for a living.

A private tech blog in Germany is not a legal no man’s land. Imprint, privacy, copyright on images – each of them carries the risk of a formal warning letter, and the longer a blog runs, the more piles up. So in October I went through my blog systematically: where might I step on someone’s toes, where do I reveal more than necessary, and where am I open to attack? This post sums up what I found and changed.

The Ansible Tour, Part 6: Monitoring – Exporters, Prometheus, Grafana and a Monit Watchdog

Mon, 19 Oct 2026 21:06:17 +0200

Part 6 of the Ansible Tour, and the last. After the platform, the applications and security, this part is about knowing what is going on. The series describes release v3.3.0, with later changes added as updates.

A server nobody watches fails silently. The setup here watches in four ways, and it helps to keep them apart:

Kind	Question	Tool
Metrics	How is the server doing over time?	exporters, Prometheus, Grafana
States	Is something broken right now?	Monit
Logs	What happened, and why?	Loki and Grafana Alloy
Signs of life	Is what rarely reports anything still running at all?	job timestamps, a weekly mail

All of them follow the rule from part 5: silent while everything is healthy, so that every mail means something. And all of them fell into the same trap: for a while they were silent because they could not speak, not because nothing was happening.

The Ansible Tour, Part 4: Nextcloud – Collabora, Push, Host Database and occ, Role by Role

Mon, 19 Oct 2026 15:52:20 +0200

Part 4 of the Ansible Tour. After the blog in part 3, here comes the second application: Nextcloud. The series describes release v3.3.0, with later changes added as updates. What matches the blog is only mentioned briefly; the focus is on what is different.

Nextcloud is a file cloud: files, calendars, contacts, team folders and – with Collabora – documents edited together in the browser. Two of the three servers run it, for groups of very different size, with the same code and different values in the inventory. The work is shared by next_mariadb and next_redis (database and cache on the host), next_k3s_deploy (Nextcloud, Collabora and the push service as Kubernetes objects), next_config (Nextcloud’s settings) and nextcloud_verify, plus the update playbook.

The Ansible Tour, Part 3: The Blog – WordPress, MariaDB and Redis on K3s, Role by Role

Fri, 16 Oct 2026 12:31:10 +0200

Part 3 of the Ansible Tour. Part 2 built the platform; this part puts the blog on it. The series describes release v3.3.0, with later changes added as updates.

This blog is WordPress. Four roles take it from an empty Kubernetes cluster to a running, configured and monitored website: blog_k3s_deploy creates all Kubernetes objects, blog_wordpress configures the running WordPress from the outside, blog_visitor_stats counts the visitors anonymously at night, and blog_verify checks at the end that everything works. An update playbook keeps the blog current.

The Ansible Tour, Part 2: The Platform – From a Bare AlmaLinux to a Kubernetes Cluster

Thu, 15 Oct 2026 17:58:14 +0200

Part 2 of the Ansible Tour. Part 1 explained how the repository is built; this part starts at the very bottom. The series describes release v3.3.0, with later changes added as updates.

Every server here starts as a plain AlmaLinux 9 cloud image: a minimal Linux, a root login, nothing else. At the end of this part it is a patched base system that sends mail, updates itself at night and rotates its logs – and runs a single-node Kubernetes cluster with Helm, automatic Let’s Encrypt certificates and an ingress controller. That is the platform the blog and Nextcloud stand on. Almost all of it is the same for both.

The Ansible Tour, Part 1: One Repository, Three Servers – How the Code Is Organised and What Happens During a Run

Wed, 14 Oct 2026 15:37:01 +0200

First part of a series about the Ansible code behind this blog and two Nextcloud servers. The code is public: github.com/aptupgrademe/www_k3s; the series describes release v3.3.0. Part 1 explains the structure and what happens during a run, parts 2 to 6 the roles, the deep dives the technology underneath.

Three servers, 34 roles, four playbooks, about 22,000 lines of YAML and templates. Opening the repository for the first time, you mostly see files. This part explains three things worth knowing first: how one set of roles serves two very different applications, where every value comes from, and what actually happens between ansible-playbook and the final summary.

A Mail for Every SSH Login: A Two-Minute Tripwire with wtmp and systemd

Wed, 14 Oct 2026 10:02:43 +0200

This is a follow-up to yesterday’s long post, Defense in Depth: Nine Layers Between the Internet and My Servers. There, the login alarm got one sentence. Here is how it works, why it is built this way – and what an attacker learns from reading this.

The idea is old and simple: if anyone logs in to one of my servers, I want to know – within minutes, not when I happen to look at a log a week later. Every login mails me. Since I know when I logged in myself, every mail I did not expect is worth looking at immediately. It is a tripwire: it does not stop anyone, it makes sure an intrusion does not go unnoticed.

Defense in Depth: Nine Layers Between the Internet and My Servers

Tue, 13 Oct 2026 21:30:35 +0200

A blog and two Nextcloud servers for local organisations: nothing on them is worth a targeted attack, and that is exactly why they get attacked. Not by someone who wants my data, but by scanners that try every IP address on the internet, every hour, with the same handful of tricks. Most of them give up after the first locked door. The question is what happens with the ones that don’t.

Ten Points, One Branch: Taking My Ansible Code From “It Works” to “It Is Clean”

Mon, 12 Oct 2026 21:42:52 +0200

It started with a slightly vain question. My Ansible repository runs this blog and two Nextcloud servers: 34 roles, four playbooks, about 9,000 lines of YAML, almost 200 commits. I didn’t write most of those lines myself – my AI co-admin (Claude) did, while I decided, tested and ran the playbooks. So I asked it: if I understand most of this code, am I an advanced Ansible user?

The answer was honest and a little uncomfortable: advanced at reading and operating it, yes. Advanced at writing it from scratch, not proven yet. And then it listed ten things that would make the code itself better. I said: do all ten. Test them properly. Then write about it. This is that post.

Hallo, Bonjour, Hola: Teaching My Blog Three New Languages with Polylang and a Small Army of AI Agents

Sat, 10 Oct 2026 18:22:47 +0200

For almost two years this blog spoke exactly one language. English is the lingua franca of sysadmins, so that seemed fine. But I’m German, a good part of my readers aren’t native English speakers either, and when people search for “ZFS RAIDZ1 NAS Debian” in German, French or Spanish, they get results in German, French or Spanish. Not mine.

Enough YAML for Now: Three Servers, Windows Server 2025, and a Crash Course on the Dark Side

Wed, 23 Sep 2026 21:06:04 +0200

Confession time. After the Nextcloud migration battle log, a double-digit number of playbook runs, one nftables ruleset that cheerfully flushed K3s’ own tables, and more YAML than any human should read in a single week, I had officially had it up to here with Nextcloud, Ansible and anything containing the word “migration”.

So I did what any reasonable Linux nerd does when burned out on Linux: I went over to the other side. Three servers, three fresh installs of Windows Server 2025, and a few evenings of Active Directory, DNS, DHCP, Group Policy, Storage Spaces and BitLocker. No YAML. Just a lot of Get- and Set-.

My 5-Year IT Learning Roadmap — From Sysadmin to Infrastructure Engineer

Thu, 27 Aug 2026 15:22:44 +0200

Linux. Windows. Networking. Security. Observability. Automation. Cloud. Kubernetes. AI.

But above all:

🧠 Learn to understand systems — not just to operate them.

I’ve been thinking quite a lot about where I want to take my IT skills over the next several years.

My professional background already gives me a fairly broad foundation:

🐧 Linux system administration
📊 Monitoring
🚨 Technical event management
📝 Log management
🌐 Networking
🔐 Security

My current professional focus is increasingly around Graylog and log management.

Further WLAN Optimizations: What My Router’s Diary Had to Say

Sat, 22 Aug 2026 21:47:54 +0200

Every homelab eventually reaches the point where you run out of servers to break and start eyeing the router. Mine’s a FRITZ!Box 7690, sitting there quietly doing WiFi and internet things, never really audited, never really questioned. One evening I figured: why not hand Claude the login and see what it finds? One rule, non-negotiable: look, don’t touch. No changes, just an honest inspection.

What came back was more interesting than I expected – and backed by actual router logs, not vibes. 🧾

Running My Own AI Instead of Renting It? A Small Homelab Experiment

Fri, 05 Jun 2026 21:37:14 +0200

Like many tech enthusiasts these days, I spend a fair amount of time bouncing between different AI tools. My current daily drivers are ChatGPT, Grok, and Claude Pro. Each one has its strengths, and honestly, we’re already at a point where choosing an AI model feels a bit like choosing the right Linux distribution for a specific workload. 😎 For coding and writing tasks, Claude has become one of my favorites. The quality is impressive, especially when working through technical problems, reviewing code, or discussing architecture decisions. There is, however, one thing that keeps pulling me back to ChatGPT:

🤖 From ChatGPT to Claude: Adventures of a Slightly Terrified Nerd in VS Code

Tue, 17 Feb 2026 21:24:10 +0100

AI coding experiments, Ansible chaos, and that moment when the machine stares back at you… 👀

🧠 My AI Workflow So Far

I’ve been using ChatGPT for over a year now — pretty much daily.

Mostly for generating images, writing code, polishing wording, creating templates,
and of course for researching and summarizing texts.

Basically: if there’s a repetitive brain task, I outsource it to silicon. 🤓💡

🔄 Plot Twist: Trying Claude

Today, kind of by accident, I canceled ChatGPT and decided to try Claude instead.
I’ve read a lot about it, and from what I gather, it might actually have the edge when it comes to coding.

As a full-time nerd, I obviously had to test this theory immediately.
Because reading about tools is nice — but throwing them into production chaos is nicer. 😄

💻 VS Code + Claude Plugin = Nerd Playground

I currently love working with Visual Studio Code, so what really interested me
was integrating Claude via a plugin.

And now I have this setup:

VS Code
An Ansible playbook
8 roles
A chat editor directly connected to Claude

Which basically means: the AI is now sitting right inside my dev environment.
Not watching… totally not watching… 👀

🚀 The Experiment

I wrote into the chat:

“Optimize my Ansible code, apply best practices…”

…and BÄÄÄMM!! 💥

The thing has been grinding away for minutes now — finding one issue after another.
Claude basically has full access to the Ansible codebase and is tearing through it like a senior DevOps engineer on caffeine. ☕🐧

Slightly terrifying. Slightly impressive. Definitely nerd-satisfying.

😱 Meanwhile, In My Head… (The Nerd Image Vibes)

If I had to visualize this moment, it would look exactly like that image:

A slightly panicking nerd in a server room, sweating, clutching his laptop,
while an evil-looking AI watches him intensely from a glowing screen.

And yes — he’s still wearing sunglasses. Indoors. At night. In a server room. 😎

Because when an AI starts reviewing your infrastructure code,
you either:

stay cool
pretend you planned everything
or whisper: “Please don’t read my TODO comments…” 😬

The vibe is somewhere between:
“This is amazing”
and

“Oh no… it sees everything.”

⏳ Letting It Cook

For now, I’m just letting Claude do its thing.

Tomorrow I’ll go through the code, check the optimizations, and see:

how good the improvements actually are
whether I still understand my own infrastructure
and if not… I’ll just have Claude generate documentation and explanations too 😄

Because why panic when you can automate your understanding?

Debian 13 Upgrade Adventure – With a Little Help from ChatGPT 🐧🤖

Wed, 20 Aug 2025 17:51:14 +0200

So today I did something both brilliant and borderline reckless: I asked ChatGPT to whip up a Bash script that upgrades a Debian 12 system to the fresh new Debian 13.

Yes, I know, trusting an AI with my beloved Linux distro is basically the sysadmin equivalent of “hold my beer.” 🍺

The Setup

I played it safe (well, safe-ish). First, I spun up a VM, made a backup (because… duh), and then unleashed the script. To my mild surprise and great relief, it actually worked. The thing ran in interactive mode, threw a couple of “Are you sure, human?” type questions my way (I think two or three), then rebooted the machine.