Tag: security

Authelia is a bouncer. Authentik is the whole security desk. Pick the right self-hosted SSO for your home lab, with working configs, gotchas, and a migration path.

Pulling unscanned images onto your server is a gamble. Trivy finds the CVEs. Cosign proves the image hasn't been swapped out. Here's how to add both to your workflow.

Falco watches every syscall your containers make and screams when something sketchy happens. Like someone exec'ing a shell inside your nginx container at 3am.

Real cloudflared config: many services on one tunnel, Access policies, origin TLS, what quick tunnels are for, and what Cloudflare can see in your traffic.

You're pulling container images from strangers on the internet. Trivy scans them for CVEs. Cosign proves they haven't been tampered with. Use both.

Fail2ban bans IPs that attack you. CrowdSec bans them before they attack you, using community threat intelligence. Here's how to set up both and why you might want both.

Adding TOTP to SSH and sudo takes 10 minutes and makes password spray attacks useless. Here's the setup that won't lock you out of your own server.

OpenVPN is the battle-tested workhorse. WireGuard is everything VPNs should have been from the start. In 2026, here's which one you should actually use.

Managing authorized_keys across 10 servers is how you lose track of who has access to what. An SSH CA lets you sign keys and revoke access without touching every server.

Wazuh gives you SIEM, HIDS, FIM, and threat detection in one stack. Here's how to deploy it in your home lab with Docker and actually use it.

LUKS encrypts your drives so a stolen server is just expensive recycling. Here's how to set it up, manage keys, and unlock headless boxes remotely.

Run Docker containers without root privileges, here's the security difference, the install steps, and the gotchas nobody tells you about.