Replacing the increasingly freemium Rambox with Ferdium, a fully-free messenger aggregator, self-hosting its optional sync server on a Raspberry Pi behind nginx so no chat metadata ever touches a third party.
Read Article →
Running two purpose-tuned Ollama instances on one GPU — one for text, one for vision — fronted by Open WebUI as an authenticated API gateway, so neither Ollama ever touches the internet directly.
Read Article →
Taking Pi-hole and DNSCrypt-Proxy on the road with dnsdist, nginx-terminated DoH/DoT, and EDNS Client Subnet — so remote devices get encrypted, filtered, per-client DNS anywhere in the world.
Read Article →
Upgrading Git-Kepo from an unreliable prototype to a production-grade NemoClaw agent: fixing Ollama context limits, splitting TOOLS.md to save tokens, and adding repo labelling and batch mode.
Read Article →
Building Git-Kepo, a Singlish-speaking NemoClaw specialist agent that clones repositories, runs churn/bus-factor/velocity diagnostics, and audits git history for leaked credentials using the LLM's own judgment.
Read Article →
Giving self-hosted OpenClaw agents real personality — building two Singlish-speaking AI characters on separate NemoClaw sandboxes that share a Matrix room and pass conversations to each other by mention.
Read Article →
Combining OpenClaw, NemoClaw, Ollama, and a self-hosted Matrix server into a fully private, kernel-sandboxed agentic AI stack with no third-party servers in the critical path.
Read Article →
Building a custom two-stage Dockerfile to run llama.cpp with CUDA on the NVIDIA Spark (ARM64/Blackwell), since the official images only target x86_64, plus multimodal model routing with a models.ini catalog.
Read Article →
Debugging a mixed-content HTTPS error between a Dockerized Nuxt frontend and FastAPI backend behind Nginx, fixed with relative API paths and proper proxy headers.
Read Article →
Federating multiple Keycloak realms through a users-less hub realm, so Harbor (or any single-OIDC-client app) can offer sign-in across separate teams without a shared realm.
Read Article →
Running Harbor as a private Docker registry behind NGINX, with Keycloak SSO for the dashboard and a CLI secret for docker login/push.
Read Article →
Two real-world gotchas from putting PgAdmin behind the same NGINX reverse proxy as everything else: an SPA-sized rate limit, and the X-Frame-Options header that blocks its own embedded iframe.
Read Article →
Adding cAdvisor to watch per-container CPU, memory, and disk usage on the Pi, plus why Graylog is a heavier lift than the monitoring itself.
Read Article →
Self-hosting a federated Matrix homeserver with Keycloak SSO, a Cloudflare Worker for the well-known federation lookup, and the DNS and memory gotchas that came with running it long-term.
Read Article →
Self-hosting Outline as a private Notion alternative, backed by Postgres and a shared Redis instance, with Keycloak SSO and an NGINX config tuned for a React SPA's burst of parallel requests.
Read Article →
Setting up Keycloak for unified single sign-on across the stack, then wiring Grafana and Portainer to it via OpenID Connect, with an NGINX config for rate-limited remote access.
Read Article →
Automating Docker image updates with Watchtower, wired to Gotify for notifications, plus the IP-pinning gotcha that leaves Watchtower stuck mid self-update.
Read Article →
Building a Grafana + Prometheus + Node Exporter + Smartctl Exporter monitoring stack, gated behind Cloudflare Zero Trust, with an alert rule wired through to Gotify.
Read Article →
Self-hosting Gotify as a push-notification server, exposed via Cloudflare Tunnel, with a curl and Python example for sending alerts to it.
Read Article →
Running Home Assistant on the Pi with a Zigbee USB stick, exposing it via Cloudflare Tunnel or NGINX, and turning a touchscreen into a motion-aware kiosk dashboard.
Read Article →
Running Transmission behind an always-on OpenVPN tunnel in Docker, exposing it remotely via Cloudflare Tunnel or NGINX, and sharing the download directory back to the LAN over NFS.
Read Article →
Self-hosting Nextcloud on a Raspberry Pi with MariaDB and Redis, exposed via Cloudflare Tunnel or NGINX, plus the occ commands and cron job that keep it healthy long-term.
Read Article →
Self-hosting Vaultwarden as a Bitwarden-compatible password vault, exposed remotely via Cloudflare Tunnel, with a hardened NGINX config as the alternative reverse-proxy path.
Read Article →
Setting up remote access with Cloudflare Tunnel via Docker Compose and Portainer — dealing with CG-NAT, and enabling SSH access to the Pi through the tunnel.
Read Article →
Combining Pi-hole and dnscrypt-proxy in Docker for network-wide, encrypted DNS — plus the NULL-blocking-mode default that quietly breaks your own reverse proxy.
Read Article →
Installing Docker on a Raspberry Pi, enabling cgroup memory accounting, moving container storage onto the encrypted SSD, and managing everything through a self-hosted Portainer instance.
Read Article →
Pinning NVIDIA driver, CUDA, and nvidia-smi package versions on Debian 12 to avoid mismatches, then wiring up the NVIDIA Container Toolkit for GPU access in Docker and a self-hosted Ollama + Open WebUI stack.
Read Article →