-
ComfyUI on demand: systemd socket activation for a GPU container
Idle ComfyUI held up to 2.8 GB of VRAM my LLMs needed. A systemd socket now starts it on the first request and stops it after 10 idle minutes, and a guard makes room for image jobs.
-
My dynamic DNS job got my home IP banned by the registrar
Polling GoDaddy's API every 5 minutes to keep an apex A record current got my home IP banned. How to diagnose an API ban, switch to change detection with zero calls on a stable day, and avoid two related DNS traps.
-
Live numbers on a static site with cron-generated JSON
My homepage's pod count read 141, 159 and 154 within one hour, so every number on my static site now comes from a JSON file regenerated every 30 minutes. The design, and four mistakes it taught me.
-
Running 414 Kiwix ZIMs as an offline reference shelf
What I learned serving 414 Kiwix ZIM files (973 GB) beside my own library: undated aliases need -z, lazily opened ZIMs break when moved, 240 lack full-text indexes, and encyclopedias should be federated, not embedded.
-
One query wrote 376 GB of temp files: shared Postgres lessons
A six-way LEFT JOIN on my shared PostgreSQL spilled 376 GB to pgsql_tmp in 3.5 hours. The limits every shared instance needs, a RAM-disk temp tablespace and its restart trap, and two more shared-database lessons from k3s.
-
Authelia SSO pitfalls: a policy protects nothing if the route skips it
Three services my Authelia config marked two-factor served pages to anyone: the Traefik routes never called Authelia. Six SSO pitfalls from a home lab, all fixed, with config.
-
One password in 13 places: inventory and rotation of home-lab secrets
An inventory found 62 plaintext credentials in my workload specs and one password reused 13 times. How I moved them into Secrets, built a pointer registry on Vaultwarden, and rotated with proof.
-
Running a Tor bridge at home without exposing the LAN
My Tor bridge was flagged Not Recommended because a five-week-old latest image aged out. How I run an obfs4 bridge and Snowflake proxy at home: isolated, limited, current and monitored.
-
Google Analytics with real consent mode on a self-hosted site
Analytics showed one visitor and I assumed it was broken: of 265 browser-like addresses in a day, only 21 rendered a page. How I then added Google Analytics in basic consent mode via nginx sub_filter.
-
Six million files, one OSINT shelf: crawl, OCR, embed, NLP
Growing an OSINT records shelf from 35,733 to 185,000+ indexed documents: separate pipelines from the library, files an incremental crawler never sees, 70k image-only PDFs, and OCR measured in page-years.
-
A self-hosted classroom with SSO-only login and token-locked Jitsi
Version 1 of my self-hosted classroom had two logins, a 'changeme' API key and Jitsi secrets in Git. Version 2 uses SSO headers only, roles from groups and per-room Jitsi tokens. The design and the traps.
-
Pi-hole blocked my own analytics, and other DNS filter surprises
I thought Google Analytics had banned me: my own Pi-hole was answering 0.0.0.0 for four Google domains. Three surprises from running a DNS filter for the whole LAN, and how to test around it.