-
One login for everything: how a missing dot moved my lab to SSO
My SSO portal could not hold a session on my one-word internal domain, so much of my lab had no login or kept its own passwords. A migration on 6 May 2026 started the move to one identity, roles from groups, and a manager that is the only door, even for AI agents.
-
Authelia SSO pitfalls: a policy protects nothing if the route skips it
Three services my Authelia config marked two-factor served pages to anyone: the Traefik routes never called Authelia. Six SSO pitfalls from a home lab, all fixed, with config.
-
A self-hosted classroom with SSO-only login and token-locked Jitsi
Version 1 of my self-hosted classroom had two logins, a 'changeme' API key and Jitsi secrets in Git. Version 2 uses SSO headers only, roles from groups and per-room Jitsi tokens. The design and the traps.
-
How my Kubernetes dashboard locked me out of my own SSO
Headlamp's backend retried a dead OIDC refresh token every 5 seconds with no backoff, and Authelia's per-IP rate limiter then blocked my own login. The wrong theory, the upstream race, a Helm drift landmine and the watchdog that caps it.
-
Running Gitea and CI inside the cluster they deploy
Lessons from a self-hosted Gitea in k3s: why git push hits the SSO login page, getting passwords out of 7 remote URLs, a Git server OOM-killed at 512 MiB and 2 GiB, and what act_runner needs before 365 tests pass in 82 seconds.