Nerd Life – apt-upgrade.me – Homelab, Linux & DevSecOps

Two Things My SSDs Were Missing: TRIM After BitLocker, and a Write Cache My HPE Server Quietly Switched Off

Tue, 06 Oct 2026 13:40:25 +0200

HP3, my HPE MicroServer Gen10 Plus v2, is back on Debian 13 with OpenZFS. Why it left Windows again is a story for another post. This one is about the restore afterwards, and a setting that had been hiding in plain sight for two operating systems and two blog posts.

The plan was boring, the way restores should be: a fresh RAIDZ1 pool over the same three WD Red SA500 SSDs, per-user datasets, then about 1.7 TB copied back from a USB disk with rsync. Same workflow as always: I make the calls, my AI co-admin (Claude) runs the commands and keeps an eye on the numbers. It was the numbers that started looking wrong.

Germany Only: Geo-Fencing SSH with nftables and Ansible (and What My Logs Said About Bots and Readers)

Thu, 01 Oct 2026 13:51:27 +0200

After moving two Nextcloud instances to new servers this week, I asked a simple question: do my three servers - this blog and the two Nextclouds - attract different kinds of attackers? The answer was mostly “no, it’s the same background noise everywhere”. Except for one line that bugged me: SSH. It runs on a non-standard port, accepts keys only, and fail2ban watches it. And yet the blog alone logged around 16 connection attempts per hour to the SSH daemon, from all over the world.

Two Minutes Forty-Five: My First Nextcloud App Update via Ansible (and the Guard Rail I Added Just Before)

Wed, 30 Sep 2026 21:30:02 +0200

Confession time: the production Nextcloud from the migration battle log has been running on K3s for a week, the repo has had an nextcloud-update.yml playbook for months, and I had never actually run it. Apps were updated the old-fashioned way, by clicking in the admin UI, or not at all. Today that changed. The run itself took 2 minutes 45 seconds. The interesting part was everything around it.

Same workflow as always: I decide, my AI co-admin (Claude) checks, builds and verifies. And the very first thing it found was not a bug in the update logic, but a loaded foot-gun in line three.

The iLO Knows the Temperature, But Not Yesterday’s: Building a Heat History for My Homelab Rack

Wed, 30 Sep 2026 19:15:38 +0200

It started with a simple question on a lazy afternoon: how warm are my three servers, actually? The iLO answered instantly: intake air 22 to 25 °C, fans idling at 6 %, everything green. Great. Then the follow-up question: and during the heat wave in July? Silence. The iLO 5 shows temperatures and fans live only. No history, no graph, no “last Tuesday”. So I built one, and it’s on GitHub: aptupgrademe/ilo-thermal.

My Own Little Certificate Authority: AD CS, Auto-Enrollment and Goodbye to “Your Connection Is Not Private”

Tue, 29 Sep 2026 19:05:28 +0200

My homelab has three domain controllers, two clients, three iLO management boards and, until last week, exactly zero certificates anyone had a reason to trust. Every RDP session started with a warning, every iLO greeted me with “Your connection is not private” (issuer: Default Issuer (Do not trust), which is at least honest), and the domain controllers didn’t speak LDAPS at all.

I don’t run many internal web services, so for a while I assumed a private PKI was a solution looking for a problem. Wrong. A Windows domain has plenty of places where certificates quietly make things better. The trick is to let Active Directory hand them out on its own, so that I never have to think about renewing them again.

Day Two Operations: Hardening Three Windows Domain Controllers (and Finding a Clock That Answered to Nobody)

Mon, 28 Sep 2026 14:57:03 +0200

In the last post three HP boxes became a Windows Server 2025 domain: AD, DNS, DHCP failover, Group Policy, BitLocker, Storage Spaces. That was day one: everything installed, everything green, everything “works”.

This post is about day two, the part where you stop admiring the green checkmarks and start asking uncomfortable questions. What time is it, according to whom? Which services are running that nobody asked for? What happens if a server simply doesn’t boot tomorrow? Spoiler: one of those questions had a very funny answer.

Enough YAML for Now: Three Servers, Windows Server 2025, and a Crash Course on the Dark Side

Wed, 23 Sep 2026 21:06:04 +0200

Confession time. After the Nextcloud migration battle log, a double-digit number of playbook runs, one nftables ruleset that cheerfully flushed K3s’ own tables, and more YAML than any human should read in a single week, I had officially had it up to here with Nextcloud, Ansible and anything containing the word “migration”.

So I did what any reasonable Linux nerd does when burned out on Linux: I went over to the other side. Three servers, three fresh installs of Windows Server 2025, and a few evenings of Active Directory, DNS, DHCP, Group Policy, Storage Spaces and BitLocker. No YAML. Just a lot of Get- and Set-.

Debian 13 Upgrade Adventure – With a Little Help from ChatGPT 🐧🤖

Wed, 20 Aug 2025 17:51:14 +0200

So today I did something both brilliant and borderline reckless: I asked ChatGPT to whip up a Bash script that upgrades a Debian 12 system to the fresh new Debian 13.

Yes, I know, trusting an AI with my beloved Linux distro is basically the sysadmin equivalent of “hold my beer.” 🍺

The Setup

I played it safe (well, safe-ish). First, I spun up a VM, made a backup (because… duh), and then unleashed the script. To my mild surprise and great relief, it actually worked. The thing ran in interactive mode, threw a couple of “Are you sure, human?” type questions my way (I think two or three), then rebooted the machine.

How I Accidentally Became a Python Apprentice… Thanks to a Discount and Dr. Angela 😅🐍

Tue, 05 Aug 2025 12:44:32 +0200

⚠️ Heads-up, fellow human (or bot):
This post is currently outdated and due for a proper rewrite.

Some parts may no longer be accurate, complete, or aligned with the latest tech realities.

A fully updated and more detailed version is on the way soon™.
TL;DR: Read at your own nerdy risk — no warranties, no guarantees, just vibes. 🤓

Me and My Rack – A Nerdy Love Story

Fri, 01 Aug 2025 09:08:26 +0200

Yesterday, I spent some hours again with my lovely rack. No, not my ribs. My server rack! 😅

What I did

I changed some very long LAN cables to shorter ones. The old ones were just... quick and dirty.
I added another switch – same model. It’s for backup and also gives me more ports. Yay!
I removed a metal thingy with cable holders and added a fan thing with 8 fans to blow out hot air. Much cooler now. Literally.
I tied some cables together with zip ties. Because... order!

Switch or not to switch?

I thought about buying a new switch. A fancy one from Mikrotik. It has 48 ports, Linux OS, and fans! 😍 But... it’s 3 times more expensive than my good old TP-Link switches.

🛡️ Getting ClamAV Daemon to Play Nice with Nextcloud’s Antivirus App (Like a True Nerd)

Sun, 13 Jul 2025 21:35:59 +0200

If you’re like me and want your Nextcloud to scream the moment something shady shows up in your files, then you’re probably using the Antivirus for Files app. But here’s the twist: for performance and true sysadmin joy, you don’t want clamscan. You want the big guns — the ClamAV Daemon using a local Unix socket.

⚙️ Step 1: Install ClamAV and the Daemon

sudo apt update
sudo apt install clamav clamav-daemon -y

This installs the scanner and the background daemon — the dream team of file hygiene.

🚀 Mission: FreeBSD – Or How I Rage-Quit to Debian at Warp Speed

Fri, 11 Jul 2025 13:09:01 +0200

Last night, in a galaxy not that far away (namely, under my desk), I felt a sudden and powerful urge to finally install FreeBSD on my tower PC.

This idea has been haunting me for years. It creeps up on me now and then, whispering: “Ditch the Linux soup. Embrace the BSD purity.”

Roughly 10 to 15 years ago, I had already toyed around with FreeBSD. Back then it was already… let’s call it: quirky but intriguing.

Our Solar Year: From Zero to Megawatt-Hero

Sat, 07 Jun 2025 20:33:21 +0200

About a year ago, I flipped the switch on my photovoltaic system. Now, twelve months later, I can say:

👉 Smartest decision I’ve made — and the most satisfying system upgrade I’ve ever installed.

The system runs smoothly, reliably delivers clean power, and completely changed how I think about energy.

Of course, it also takes a bit of discipline — knowing when to run certain appliances to make the most of your solar yield.

Hello World !

Wed, 14 May 2025 15:20:25 +0200

Hi, I’m Raphael – a 47-year-old open source enthusiast from Germany.

My digital heart beats for GNU/Linux, IT security, and all things electromobility – especially as we cruise into the post-gasoline era, one clean volt at a time.

I created this blog to share thoughts, tips, and the occasional bash one-liner. If you’re into nerdy stuff, terminals, or the elegance of sudo, you might just feel at home here.

Have fun exploring – and stay upgraded!