shuffle-on
Blog · Lișneanu Dumitru-Cristian · page 6 of 7

Notes from the lab.

Notes from a sovereign lab on one machine: self-hosted AI, infrastructure, security, and the books written from its library.

RSS · Atom · JSON Feed

  1. 9 min read

    A chat-ops bot is a doorway, not a convenience

    My infrastructure chat bot went silent for six hours because the router had blocked the messaging API's one IP. That and a self-heal webhook wired to nothing taught me how to build and test a privileged chat-ops bot.

  2. 7 min read

    Running a Tor bridge at home without exposing the LAN

    My Tor bridge was flagged Not Recommended because a five-week-old latest image aged out. How I run an obfs4 bridge and Snowflake proxy at home: isolated, limited, current and monitored.

  3. 9 min read

    Typed decisions from logits: LLM judgements that cannot fabricate

    Reading a 9B model's option probabilities instead of its text took a disambiguation task from 22.7% to 86.7%, added a usable confidence, and removed fabricated reasons. Most of the gain was wording.

  4. 7 min read

    Google Analytics with real consent mode on a self-hosted site

    Analytics showed one visitor and I assumed it was broken: of 265 browser-like addresses in a day, only 21 rendered a page. How I then added Google Analytics in basic consent mode via nginx sub_filter.

  5. 8 min read

    Six million files, one OSINT shelf: crawl, OCR, embed, NLP

    Growing an OSINT records shelf from 35,733 to 185,000+ indexed documents: separate pipelines from the library, files an incremental crawler never sees, 70k image-only PDFs, and OCR measured in page-years.

  6. 8 min read

    On single-node Kubernetes, RollingUpdate can mount your database twice

    With one replica, RollingUpdate starts the new pod before stopping the old, and on a single node both mount the same ReadWriteOnce volume. How I audited 123 Deployments, fixed 15 with zero downtime, and what really slowed Qdrant.

  7. 8 min read

    A self-hosted classroom with SSO-only login and token-locked Jitsi

    Version 1 of my self-hosted classroom had two logins, a 'changeme' API key and Jitsi secrets in Git. Version 2 uses SSO headers only, roles from groups and per-room Jitsi tokens. The design and the traps.

  8. 9 min read

    How my Kubernetes dashboard locked me out of my own SSO

    Headlamp's backend retried a dead OIDC refresh token every 5 seconds with no backoff, and Authelia's per-IP rate limiter then blocked my own login. The wrong theory, the upstream race, a Helm drift landmine and the watchdog that caps it.

  9. 8 min read

    Secrets in GitOps history: scan by key name, then rotate

    My Kubernetes manifests repo had credentials from its first commit. Why value-shaped scans drown in noise and still miss passwords, how key-name scanning with triage found the real ones, and why rotation, not deletion or history rewrites, is the fix.

  10. 8 min read

    An MCP server for a private library, gated per user

    Building an MCP connector so AI assistants can search and read my library: FastMCP's 421 Host trap, per-user tokens and role-filtered tools, reading long books, and gating restricted collections without regex bypasses.

  11. 7 min read

    Pi-hole blocked my own analytics, and other DNS filter surprises

    I thought Google Analytics had banned me: my own Pi-hole was answering 0.0.0.0 for four Google domains. Three surprises from running a DNS filter for the whole LAN, and how to test around it.

  12. 8 min read

    Prometheus WAL on a RAM disk: the trade-offs, and my empty tmpfs

    My Prometheus config said the WAL lived on a RAM disk. The tmpfs held 0 bytes; the 785 MB WAL was on the SSD all along. Why, whether it was ever a good idea, and where RAM disks do help.