Automation – apt-upgrade.me – Homelab, Linux & DevSecOps

The Ansible Tour, Part 1: One Repository, Three Servers – How the Code Is Organised and What Happens During a Run

Wed, 14 Oct 2026 15:37:01 +0200

First part of a series about the Ansible code behind this blog and two Nextcloud servers. The code is public: github.com/aptupgrademe/www_k3s; the series describes release v3.3.0. Part 1 explains the structure and what happens during a run, parts 2 to 6 the roles, the deep dives the technology underneath.

Three servers, 34 roles, four playbooks, about 22,000 lines of YAML and templates. Opening the repository for the first time, you mostly see files. This part explains three things worth knowing first: how one set of roles serves two very different applications, where every value comes from, and what actually happens between ansible-playbook and the final summary.

My 5-Year IT Learning Roadmap — From Sysadmin to Infrastructure Engineer

Thu, 27 Aug 2026 15:22:44 +0200

Linux. Windows. Networking. Security. Observability. Automation. Cloud. Kubernetes. AI.

But above all:

🧠 Learn to understand systems — not just to operate them.

I’ve been thinking quite a lot about where I want to take my IT skills over the next several years.

My professional background already gives me a fairly broad foundation:

🐧 Linux system administration
📊 Monitoring
🚨 Technical event management
📝 Log management
🌐 Networking
🔐 Security

My current professional focus is increasingly around Graylog and log management.

🐧➡️🪟 From Penguin to Windows: Why I’m Running Windows Server 2025 in My Homelab (Again)

Fri, 03 Jul 2026 11:13:00 +0200

I’ve been a huge Linux fan for years – and that hasn’t changed one bit. I run Linux in VMs, on servers, and pretty much anywhere I can get a shell prompt. I still love its flexibility, openness, and its beautiful CLI-first philosophy. To be honest, there was even a time when I was a full-blown “Linux-only” evangelist. Not just technically, but ideologically as well. At the same time, I’ve always enjoyed using Windows on the desktop. Both worlds have their strengths and weaknesses. Linux gives me freedom, transparency, and endless opportunities to tinker. Windows, on the other hand, has consistently delivered excellent hardware support, mature drivers, painless firmware updates, reliable power management, and great peripheral compatibility. Things like standby, BIOS updates, fingerprint readers, and random hardware quirks often just work. Sometimes that’s worth a lot. That said, I have mixed feelings about moving more of my private infrastructure back to Windows. Topics like digital sovereignty, privacy, and the current geopolitical climate – including developments in the US and around Donald Trump – definitely make me pause for a moment. As someone who has been deeply involved in the Linux ecosystem for years, I strongly associate Linux with transparency, control over my systems, privacy, and IT security. For me, Linux was never just an operating system. It was always part of a broader philosophy around digital self-determination and owning your technology instead of merely renting it from someone else. That’s also one of the reasons why I’ve spent a lot of time looking into privacy-focused projects like GrapheneOS. If you’re interested, I’ve written more about that topic here. And yet... here I am. Again. Funny enough, I’ve actually been down this rabbit hole before. About a year ago, I wrote a blog post about moving parts of my homelab back to Windows. That original post has since been retired, and this article replaces it entirely – because, just like homelabs themselves, opinions, requirements, and architectures tend to evolve over time.

Replacing Cron Jobs with Jenkins for Nextcloud Backups 🚀

Fri, 05 Jun 2026 09:09:14 +0200

Today I spent some time exploring Jenkins in my homelab environment.

For those who somehow managed to avoid Jenkins during the last decade: Jenkins is one of the most widely used open-source automation servers available today. Originally released in 2011 as a fork of the Hudson project, Jenkins has become one of the cornerstones of modern DevOps workflows. It is primarily used for Continuous Integration (CI) and Continuous Delivery (CD), automating software builds, tests, deployments, and all kinds of recurring administrative tasks. If a process can be automated, Jenkins can probably handle it. 😎

WordPress on K3s — A Nerdy, Layered Update Strategy

Tue, 31 Mar 2026 13:26:24 +0200

This article is a direct continuation of the previous guide. If you haven’t read it yet, start here: Initial Setup: WordPress on K3s (Ansible-managed).

This guide describes a clean, deterministic update pipeline for a WordPress stack running on Kubernetes via K3s, orchestrated with Ansible. Think of it as a layered onion of updates — each layer independently maintainable, yet fully composable. It also serves as a personal reference — a kind of living documentation — until these workflows become second nature to me 😉

From Debian to AlmaLinux to K3s: Or How I Accidentally Built a Mini Cloud 🚀

Mon, 30 Mar 2026 20:02:37 +0200

If you’ve stumbled across my previous post

“Operating Community Nextcloud Instances with Ansible, AlmaLinux, SELinux and a Podman-based Collabora Stack”

you already know this started as a totally reasonable idea.(Narrator voice: It was not a totally reasonable idea.)

The Original Plan™: Leave Debian, Embrace SELinux

At some point I thought: “Hey, why not move from Debian to AlmaLinux?”

Main reason? SELinux.

Because nothing says “fun weekend project” like debugging security contexts at 2 AM.

🧠 Operating Community Nextcloud Instances with Ansible, AlmaLinux, SELinux and a Podman-based Collabora Stack

Thu, 26 Feb 2026 15:27:38 +0100

I currently operate multiple Nextcloud instances for two local community organizations in a purely voluntary capacity.

The original motivation was twofold: enabling digital sovereignty while turning the entire setup into a personal learning sandbox. 🚀The initial deployments were provisioned using Ansible. However, the automation pipeline never reached full end-to-end maturity; smaller adjustments and operational tweaks were still executed manually. 🔧Historically, each Nextcloud instance had its own dedicated playbook. While functional, this architecture revealed structural weaknesses over time — particularly when synchronized or centralized changes across both environments became necessary. ⚙️

🤖 From ChatGPT to Claude: Adventures of a Slightly Terrified Nerd in VS Code

Tue, 17 Feb 2026 21:24:10 +0100

AI coding experiments, Ansible chaos, and that moment when the machine stares back at you… 👀

🧠 My AI Workflow So Far

I’ve been using ChatGPT for over a year now — pretty much daily.

Mostly for generating images, writing code, polishing wording, creating templates,
and of course for researching and summarizing texts.

Basically: if there’s a repetitive brain task, I outsource it to silicon. 🤓💡

🔄 Plot Twist: Trying Claude

Today, kind of by accident, I canceled ChatGPT and decided to try Claude instead.
I’ve read a lot about it, and from what I gather, it might actually have the edge when it comes to coding.

As a full-time nerd, I obviously had to test this theory immediately.
Because reading about tools is nice — but throwing them into production chaos is nicer. 😄

💻 VS Code + Claude Plugin = Nerd Playground

I currently love working with Visual Studio Code, so what really interested me
was integrating Claude via a plugin.

And now I have this setup:

VS Code
An Ansible playbook
8 roles
A chat editor directly connected to Claude

Which basically means: the AI is now sitting right inside my dev environment.
Not watching… totally not watching… 👀

🚀 The Experiment

I wrote into the chat:

“Optimize my Ansible code, apply best practices…”

…and BÄÄÄMM!! 💥

The thing has been grinding away for minutes now — finding one issue after another.
Claude basically has full access to the Ansible codebase and is tearing through it like a senior DevOps engineer on caffeine. ☕🐧

Slightly terrifying. Slightly impressive. Definitely nerd-satisfying.

😱 Meanwhile, In My Head… (The Nerd Image Vibes)

If I had to visualize this moment, it would look exactly like that image:

A slightly panicking nerd in a server room, sweating, clutching his laptop,
while an evil-looking AI watches him intensely from a glowing screen.

And yes — he’s still wearing sunglasses. Indoors. At night. In a server room. 😎

Because when an AI starts reviewing your infrastructure code,
you either:

stay cool
pretend you planned everything
or whisper: “Please don’t read my TODO comments…” 😬

The vibe is somewhere between:
“This is amazing”
and

“Oh no… it sees everything.”

⏳ Letting It Cook

For now, I’m just letting Claude do its thing.

Tomorrow I’ll go through the code, check the optimizations, and see:

how good the improvements actually are
whether I still understand my own infrastructure
and if not… I’ll just have Claude generate documentation and explanations too 😄

Because why panic when you can automate your understanding?

Adventures in IPv6, Firewalls & the “Oops-I-Forgot” Department 🚀

Mon, 25 Aug 2025 16:17:34 +0200

So, a few days ago I thought: “Hey, let’s be cool, ditch Apache, and hop onto the Nginx hype train because... HTTP/3, baby!” 🎉

Fast-forward to today, when I decided to show off and run one of those fancy SSL / web server grading tools. You know, the nerd’s equivalent of flexing in front of a mirror. 😎

...and then BAM 💥: my blog was completely invisible over IPv6. Like, gone. As if Thanos snapped half the packets away. 🫰

How I Managed to Wreck My Firewall Appliance With a Debian 13 Upgrade

Wed, 20 Aug 2025 21:25:15 +0200

Yesterday I proudly hit publish on a post about my super smooth upgrade to Debian 13… feeling like a proper Linux wizard. 🧙‍♂️

A few hours later, reality slapped me in the face: I managed to completely nuke my poor firewall appliance while trying to upgrade it as well. RIP.

Technically, it still booted and looked fine – no scary red error messages. But this box was the one running Traefik, the gatekeeper to my self-hosted blog. And suddenly… things got weird.

🧼 Cleaning Up Filenames on Linux with `detox` – The Tiny Tool That Saved My Backups

Thu, 24 Jul 2025 13:05:36 +0200

😤 When a Backup Fails... Because of a Filename

Recently, one of my automated backups on Linux unexpectedly crashed mid-run. No fancy error message, no graceful fallback — just a silent abort.

After some hardcore grep and log spelunking, I found the culprit: a single file with a non-compliant filename that the backup tool couldn’t process. Worse yet — the file had come from a macOS system (MacBook Air). Of course. 😅

🚀 Moving a Grown-Up Nextcloud Instance to a Fresh Server (with Bash & Ansible)

Tue, 15 Jul 2025 08:58:30 +0200

(This article is the logical follow-up to the backup script described here: Nextcloud Backup Like a Pro – Automated with Bash. Both posts go hand in hand to complete the full migration and disaster recovery (workflow.)

After several years of running a trusty Nextcloud instance — complete with countless user files, calendars, contacts, and quirky shared folders — it was time for an upgrade. The old server was showing signs of age, and a shiny new machine had been provisioned with Ansible for a clean start.

🛡️🧙‍♂️ Deploying Nextcloud: My Ansible Quest for Ultimate Automation ⚔️☁️

Tue, 08 Jul 2025 20:07:17 +0200

⚠️ Heads-up, fellow human (or bot):
This post is currently outdated and due for a proper rewrite.

Some parts may no longer be accurate, complete, or aligned with the latest tech realities.

A fully updated and more detailed version is on the way soon™.
TL;DR: Read at your own nerdy risk — no warranties, no guarantees, just vibes. 🤓

How I Back Up My Mom’s PC Over VPN — Without the Cloud (or Headaches)

Thu, 05 Jun 2025 21:06:23 +0200

Let’s be honest: keeping family members’ devices backed up is something many of us in tech mean to do — but often don’t. Between the complexity of cloud solutions, the privacy concerns, and the general “if it ain’t broken, don’t touch it” mentality, it’s easy to postpone.

I finally decided to set up a simple, reliable, and fully automated backup solution for my mother’s PC. Since she lives in a different city, remote access and automation were essential from the beginning. The requirements were clear:

Patch Me If You Can: Keeping Debian VMs Updated with Ansible (Without Losing My Weekend)

Wed, 28 May 2025 09:09:17 +0200

I have around 12 Debian-based VMs running in my homelab. A while ago, I used to update them all manually — one by one. SSH into each machine, run apt update && apt upgrade, wait, reboot if needed... then repeat. It worked, but it was slow, boring, and very easy to forget one or two machines.

Now I use Ansible to handle everything for me. I wrote a simple playbook, and with just one command, all my VMs update in parallel. If any of them need a reboot, Ansible checks for that and takes care of it too. I just run the playbook and let the automation do the heavy lifting.

📡 Shipping Logs Like a Pro: Fluent Bit Meets Ansible in My Homelab

Mon, 26 May 2025 13:01:05 +0200

By now, my little homelab has grown into a small but mighty fleet of virtual machines — almost a dozen of them are humming along nicely. But with more services come more logs… and more chaos. 🌀

To bring order to that chaos, I’m using the open-source log shipper Fluent Bit to collect logs from all my VMs and forward them to a centralized OpenSearch instance for analysis and visualization.

The goal? Collect everything — from disk space warnings, failed login attempts, and systemd noise to juicy kernel messages. All logs across all my machines should end up neatly indexed and searchable in a single OpenSearch dashboard.