prometheus – apt-upgrade.me – Homelab, Linux & DevSecOps

Deep Dive: AIDE and rkhunter on a K3s Host – Integrity Checks Without Drowning in False Alarms

Thu, 05 Nov 2026 08:36:43 +0100

An integrity checker is only as good as the mails it sends. If it reports hundreds of changes every morning, nobody reads them after a week – and the one real finding gets lost with them. That was my problem with AIDE and rkhunter on three K3s hosts: both worked, but mostly they reported things I had caused myself.

This deep dive shows what the two tools do, where the noise comes from on a Kubernetes host, and how the baseline follows every intended change.

The Ansible Tour, Part 6: Monitoring – Exporters, Prometheus, Grafana and a Monit Watchdog

Mon, 19 Oct 2026 21:06:17 +0200

Part 6 of the Ansible Tour, and the last. After the platform, the applications and security, this part is about knowing what is going on. The series describes release v3.3.0, with later changes added as updates.

A server nobody watches fails silently. The setup here watches in four ways, and it helps to keep them apart:

Kind	Question	Tool
Metrics	How is the server doing over time?	exporters, Prometheus, Grafana
States	Is something broken right now?	Monit
Logs	What happened, and why?	Loki and Grafana Alloy
Signs of life	Is what rarely reports anything still running at all?	job timestamps, a weekly mail

All of them follow the rule from part 5: silent while everything is healthy, so that every mail means something. And all of them fell into the same trap: for a while they were silent because they could not speak, not because nothing was happening.

Bare Metal to K3s: A Nextcloud Migration Battle Log

Mon, 21 Sep 2026 21:50:44 +0200

Today I moved a production Nextcloud from a cozy native bare-metal install to a shiny K3s/container stack. On paper: pull a backup, restore it, flip DNS, done. In practice: a series of small landmines, each invisible until you step on it. Here’s the battle log. 🪖

Step 1: shovel the data 🚚

The heavy lifting was an rsync of ~360 GB of user data plus a ~330 MB SQL dump from the backup box into the new node. Because I pre-synced earlier in the day, the final run only shipped the delta — the whole thing came down to a fast incremental copy. Lesson old as time: pre-seed, then the cutover sync is tiny.

My 5-Year IT Learning Roadmap — From Sysadmin to Infrastructure Engineer

Thu, 27 Aug 2026 15:22:44 +0200

Linux. Windows. Networking. Security. Observability. Automation. Cloud. Kubernetes. AI.

But above all:

🧠 Learn to understand systems — not just to operate them.

I’ve been thinking quite a lot about where I want to take my IT skills over the next several years.

My professional background already gives me a fairly broad foundation:

🐧 Linux system administration
📊 Monitoring
🚨 Technical event management
📝 Log management
🌐 Networking
🔐 Security

My current professional focus is increasingly around Graylog and log management.

One Year Later: I Finally Open-Sourced My Homelab K3s Stack

Sun, 17 May 2026 19:34:12 +0200

In a few of my recent posts I mentioned that I was trying to figure out how to publish my homelab automation code *without accidentally open-sourcing my entire infrastructure along with it* 😅

Turns out that’s a surprisingly non-trivial problem when your Ansible inventory looks like a cyberpunk treasure chest full of vaults, secrets and host-specific variables. 🔐🐉

After a bit of trial, error, caffeine and questionable life choices… I finally found a setup that works beautifully:

git log –since=”1 year ago”: One Year of apt-upgrade.me && Publishing the Ansible Playbooks for Nextcloud on K3s

Fri, 15 May 2026 14:18:55 +0200

There comes a point in every homelab journey where you look at your pile of

bash scripts, hand-crafted config files, and sticky notes that say things like

“remember to chown /data before starting” — and you decide:

enough. 😅

This is that post. Today I’m publishing the Ansible playbooks I’ve been using to deploy

and operate Nextcloud ☁️ and WordPress 📝 on a

single-node K3s cluster running on AlmaLinux 9.

Everything is infrastructure-as-code, fully idempotent,

From Debian to AlmaLinux to K3s: Or How I Accidentally Built a Mini Cloud 🚀

Mon, 30 Mar 2026 20:02:37 +0200

If you’ve stumbled across my previous post

“Operating Community Nextcloud Instances with Ansible, AlmaLinux, SELinux and a Podman-based Collabora Stack”

you already know this started as a totally reasonable idea.(Narrator voice: It was not a totally reasonable idea.)

The Original Plan™: Leave Debian, Embrace SELinux

At some point I thought: “Hey, why not move from Debian to AlmaLinux?”

Main reason? SELinux.

Because nothing says “fun weekend project” like debugging security contexts at 2 AM.