Blog

Combining OpenClaw, NemoClaw, Ollama, and a self-hosted Matrix server into a fully private, kernel-sandboxed agentic AI stack with no third-party servers in the critical path.

A step-by-step guide to running a private, federation-disabled Matrix homeserver (Synapse + PostgreSQL) natively on Debian 13, with token-gated registration behind an nginx reverse proxy.

A field guide to mutual TLS — Root CAs, client certificates, revocation, and NGINX enforcement — plus CertWiz-mTLS, a toolkit that automates the whole certificate lifecycle.

Building a custom two-stage Dockerfile to run llama.cpp with CUDA on the NVIDIA Spark (ARM64/Blackwell), since the official images only target x86_64, plus multimodal model routing with a models.ini catalog.

Debugging a mixed-content HTTPS error between a Dockerized Nuxt frontend and FastAPI backend behind Nginx, fixed with relative API paths and proper proxy headers.

Federating multiple Keycloak realms through a users-less hub realm, so Harbor (or any single-OIDC-client app) can offer sign-in across separate teams without a shared realm.

Running Harbor as a private Docker registry behind NGINX, with Keycloak SSO for the dashboard and a CLI secret for docker login/push.

Two real-world gotchas from putting PgAdmin behind the same NGINX reverse proxy as everything else: an SPA-sized rate limit, and the X-Frame-Options header that blocks its own embedded iframe.

Dropping Cloudflare Tunnel for a self-hosted NGINX reverse proxy with a Namecheap DDNS wildcard certificate, UFW firewall blocklists, and mutual TLS as an extra zero-trust layer.

Adding cAdvisor to watch per-container CPU, memory, and disk usage on the Pi, plus why Graylog is a heavier lift than the monitoring itself.