Blog

Setting up Keycloak for unified single sign-on across the stack, then wiring Grafana and Portainer to it via OpenID Connect, with an NGINX config for rate-limited remote access.

Automating Docker image updates with Watchtower, wired to Gotify for notifications, plus the IP-pinning gotcha that leaves Watchtower stuck mid self-update.

Building a Grafana + Prometheus + Node Exporter + Smartctl Exporter monitoring stack, gated behind Cloudflare Zero Trust, with an alert rule wired through to Gotify.

Self-hosting Gotify as a push-notification server, exposed via Cloudflare Tunnel, with a curl and Python example for sending alerts to it.

Running Home Assistant on the Pi with a Zigbee USB stick, exposing it via Cloudflare Tunnel or NGINX, and turning a touchscreen into a motion-aware kiosk dashboard.

Running Transmission behind an always-on OpenVPN tunnel in Docker, exposing it remotely via Cloudflare Tunnel or NGINX, and sharing the download directory back to the LAN over NFS.

Self-hosting Nextcloud on a Raspberry Pi with MariaDB and Redis, exposed via Cloudflare Tunnel or NGINX, plus the occ commands and cron job that keep it healthy long-term.

Self-hosting Vaultwarden as a Bitwarden-compatible password vault, exposed remotely via Cloudflare Tunnel, with a hardened NGINX config as the alternative reverse-proxy path.

Setting up remote access with Cloudflare Tunnel via Docker Compose and Portainer — dealing with CG-NAT, and enabling SSH access to the Pi through the tunnel.

Combining Pi-hole and dnscrypt-proxy in Docker for network-wide, encrypted DNS — plus the NULL-blocking-mode default that quietly breaks your own reverse proxy.