step-ca: Let's Encrypt for Your LAN
Run step-ca as a private ACME server so Caddy and Traefik auto-issue and renew TLS certs for grafana.home.arpa, with no internet exposure and no CT log leaks.
Tag: security
All the articles with the tag "security".
Rootless Podman Quadlets vs Docker
Rootless Podman Quadlets or rootless Docker for a home lab host? Networking, cgroups, auto-updates, bind mounts and boot behavior compared, with a clear pick.
Read-Only Docker Containers: What Breaks
Turn on read_only: true and watch nginx, Postgres, Redis, Python and Node fail in specific ways. Real errors, plus the minimum tmpfs and volume set for each.
PHP2Shell: Is Your Homelab Running PHP?
PHP2Shell is two unauthenticated PHP RCE flaws. Find every PHP container in your homelab, patch to the fixed release, and keep Cloudflare's WAF as a seatbelt.
Keycloak vs Authentik vs Authelia
Keycloak, Authentik and Authelia compared on realms, LDAP and AD federation, SAML, OIDC, clustering and RAM, with Compose files and a pick for each use case.
Outline: The Team Wiki That Needs SSO
Outline has no password login, so self-hosting it means pairing it with an OIDC provider. Here is a working Docker stack with Postgres, Redis, and Dex.
Firewall Rule Audit: Find the Dead Rules
Find unused firewall rules on a Linux box with nftables counters, then retire them safely with a snapshot-and-diff routine, a jq script, and a systemd timer.
Home Lab Threat Model: What's Exposed
Mass scanners find a new home lab IP within hours. Audit what the internet can reach, from UPnP to Docker ports to IPv6, then build a threat model that fits.
Kyverno: K8s Policy Without Rego
Kyverno on k3s: validate, mutate, generate, verify signed images, handle exceptions, and test policies in CI. Plus the CEL policy types replacing ClusterPolicy.
AppArmor Profiles for Docker, Step by Step
Docker puts every container under the docker-default AppArmor profile. See what it blocks, then build a tested nginx profile with audit deny and complain mode.
Catch Your Self-Hosted Apps Phoning Home
Self-hosted is not silent. Audit outbound calls with DNS query logs, watch live connections, block egress with Docker networks, then flip telemetry opt-outs.
Pre-Commit Hooks That Catch Secrets
A secret that reaches git push is already gone. Compare gitleaks, TruffleHog, and detect-secrets as pre-commit hooks, with working configs you can copy.