-
594,101 knocks: who reads my site, and what AI crawlers can't see
AI systems read my site 1.5x as often as search engines and 58x as often as Google, mostly my signed threat-intel dossiers. One crawler hit my login page 594,101 times. What is public is the small part.
-
Why I went fully local: from cloud AI to a sovereign lab at home
In April 2026 my AI setup mixed slow local models with cloud ones. By October everything that runs, stores or decides was local. The library-scale arithmetic, the test that ended the argument, and the one exception I still keep.
-
Moving secrets out of files: the night I built a key registry
For months my lab's passwords lived wherever the programs needed them. A week after a test wiped my home folder, I spent one night building a registry that tracks where every secret lives, never its value, with guided and reversible rotation.
-
From searching my own folders to a 72,000-work library
In April 2026 I pointed a search engine at my own folders. By October it was a catalogue of 72,312 works in 123,123 files. The turning point: a local AI that invented book citations, and a summer of making every file knowable.
-
One login for everything: how a missing dot moved my lab to SSO
My SSO portal could not hold a session on my one-word internal domain, so much of my lab had no login or kept its own passwords. A migration on 6 May 2026 started the move to one identity, roles from groups, and a manager that is the only door, even for AI agents.
-
My website stopped describing the lab and started showing it
In April 2026 every number on my site was typed by hand and stale within hours. On 14 October a redesign went live that is built around live evidence from the lab: library size, sealed reports, running pods. Why a portfolio should show, not describe.
-
One machine, everything: what I would do differently, and what's next
One workstation runs my whole lab: Kubernetes, a 120,000-work library, honeypots, local AI. Seven months of records hold 253 mistakes. What one machine gave me, what it cost, what I would do from day one, and what comes next.
-
DNS is not a firewall: splitting Traefik into LAN and public
My internal services had no public DNS, yet anyone could reach them by sending the right Host header to my public IP. How I proved it over Tor, split Traefik into LAN and public entry points, and the two test mistakes I made.
-
A provenance ledger for a home library, anchored in Bitcoin
How I fingerprint every file in my research library (CIDv1 + SHA-256), log them in a signed append-only Merkle tree, anchor each daily root in Bitcoin with OpenTimestamps, and verify it all offline.
-
From Ollama to a llama.cpp router: 49 models down to a few presets
I replaced Ollama with a llama.cpp router on my home-lab GPU: on-demand presets, sleep timers, embedding parity tests, and a log-driven retirement that freed about 400 GB.
-
Self-hosting email with Stalwart: deliverability and data-store traps
In October 2026 Gmail started rejecting mail from my own domain, and my DKIM key in DNS had lost every letter n. Seven traps from running Stalwart at home, and the mechanism behind each.
-
From 96,216 messy files to a 70,000-work library catalogue
How I turned 96,216 ebook and scan files into a works/editions/files catalogue on Elasticsearch and FSCrawler: curation rules that worked, markers that backfired, and crawler settings that cost me the most time.