-
Self-hosting email with Stalwart: deliverability and data-store traps
In October 2026 Gmail started rejecting mail from my own domain, and my DKIM key in DNS had lost every letter n. Seven traps from running Stalwart at home, and the mechanism behind each.
-
From 96,216 messy files to a 70,000-work library catalogue
How I turned 96,216 ebook and scan files into a works/editions/files catalogue on Elasticsearch and FSCrawler: curation rules that worked, markers that backfired, and crawler settings that cost me the most time.
-
My dynamic DNS job got my home IP banned by the registrar
Polling GoDaddy's API every 5 minutes to keep an apex A record current got my home IP banned. How to diagnose an API ban, switch to change detection with zero calls on a stable day, and avoid two related DNS traps.
-
Live numbers on a static site with cron-generated JSON
My homepage's pod count read 141, 159 and 154 within one hour, so every number on my static site now comes from a JSON file regenerated every 30 minutes. The design, and four mistakes it taught me.
-
Translating whole books with local LLMs: the failure modes
My local translation service rebuilds scanned books page by page in another language. Most fixes were not about the model: segment context, glossary scope, a lost-update race and page rebuilding.
-
Entity resolution lessons from a library and a threat-intel store
Six entity-resolution principles learned resolving authors in a 70,000-work library and networks in a threat-intel store: keep every claim, deterministic ids, decision tiers, lift over co-occurrence, no bulk lists, sample first.
-
One query wrote 376 GB of temp files: shared Postgres lessons
A six-way LEFT JOIN on my shared PostgreSQL spilled 376 GB to pgsql_tmp in 3.5 hours. The limits every shared instance needs, a RAM-disk temp tablespace and its restart trap, and two more shared-database lessons from k3s.
-
Why my long CrowdSec bans vanished after two days
CrowdSec's alert flush deleted my year-long bans after ~48 hours, a systemd timer sat dead for 24 days, and the fix triggered 18 router re-add storms. Mechanisms and fixes.
-
Falco on Linux 7.0: 222 restarts and a BPF verifier error
Falco 0.43 restarted 222 times on a Linux 7.0 kernel. The path to the fix: OOM kills, dropped syscalls, a BPF verifier rejection fixed in Falco 0.45.1, and Helm 4 server-side apply conflicts.
-
One password in 13 places: inventory and rotation of home-lab secrets
An inventory found 62 plaintext credentials in my workload specs and one password reused 13 times. How I moved them into Secrets, built a pointer registry on Vaultwarden, and rotated with proof.
-
120 fake Googlebots, 9 real ones, and the week I banned Google
ASN checks let 77 fake Googlebots on Google Cloud through. How I verify crawlers with published IP ranges and forward-confirmed rDNS, ban impostor fleets, and how I accidentally banned the real Googlebot.
-
My SSH honeypot accepted every password, so it never banned anyone
194 attacker IPs escaped my honeypot's auto-ban for three months because it waited for failed logins. Lessons on ban-on-connect and building a honeypot log pipeline that fails loudly.