Blog

A field guide to mutual TLS — Root CAs, client certificates, revocation, and NGINX enforcement — plus CertWiz-mTLS, a toolkit that automates the whole certificate lifecycle.

Building a custom two-stage Dockerfile to run llama.cpp with CUDA on the NVIDIA Spark (ARM64/Blackwell), since the official images only target x86_64, plus multimodal model routing with a models.ini catalog.

Debugging a mixed-content HTTPS error between a Dockerized Nuxt frontend and FastAPI backend behind Nginx, fixed with relative API paths and proper proxy headers.

Federating multiple Keycloak realms through a users-less hub realm, so Harbor (or any single-OIDC-client app) can offer sign-in across separate teams without a shared realm.

Running Harbor as a private Docker registry behind NGINX, with Keycloak SSO for the dashboard and a CLI secret for docker login/push.

Two real-world gotchas from putting PgAdmin behind the same NGINX reverse proxy as everything else: an SPA-sized rate limit, and the X-Frame-Options header that blocks its own embedded iframe.

Dropping Cloudflare Tunnel for a self-hosted NGINX reverse proxy with a Namecheap DDNS wildcard certificate, UFW firewall blocklists, and mutual TLS as an extra zero-trust layer.

Adding cAdvisor to watch per-container CPU, memory, and disk usage on the Pi, plus why Graylog is a heavier lift than the monitoring itself.

Self-hosting a federated Matrix homeserver with Keycloak SSO, a Cloudflare Worker for the well-known federation lookup, and the DNS and memory gotchas that came with running it long-term.

Self-hosting Outline as a private Notion alternative, backed by Postgres and a shared Redis instance, with Keycloak SSO and an NGINX config tuned for a React SPA's burst of parallel requests.