Automating wildcard Let's Encrypt renewals on a registrar with no DNS API, using acme.sh, acme-dns, and one permanent CNAME record — no static IP, no paid API tier, no human in the loop.
Read Article →
Replacing the increasingly freemium Rambox with Ferdium, a fully-free messenger aggregator, self-hosting its optional sync server on a Raspberry Pi behind nginx so no chat metadata ever touches a third party.
Read Article →
Running two purpose-tuned Ollama instances on one GPU — one for text, one for vision — fronted by Open WebUI as an authenticated API gateway, so neither Ollama ever touches the internet directly.
Read Article →
Taking Pi-hole and DNSCrypt-Proxy on the road with dnsdist, nginx-terminated DoH/DoT, and EDNS Client Subnet — so remote devices get encrypted, filtered, per-client DNS anywhere in the world.
Read Article →
A step-by-step guide to running a private, federation-disabled Matrix homeserver (Synapse + PostgreSQL) natively on Debian 13, with token-gated registration behind an nginx reverse proxy.
Read Article →
A field guide to mutual TLS — Root CAs, client certificates, revocation, and NGINX enforcement — plus CertWiz-mTLS, a toolkit that automates the whole certificate lifecycle.
Read Article →
Debugging a mixed-content HTTPS error between a Dockerized Nuxt frontend and FastAPI backend behind Nginx, fixed with relative API paths and proper proxy headers.
Read Article →
Running Harbor as a private Docker registry behind NGINX, with Keycloak SSO for the dashboard and a CLI secret for docker login/push.
Read Article →
Two real-world gotchas from putting PgAdmin behind the same NGINX reverse proxy as everything else: an SPA-sized rate limit, and the X-Frame-Options header that blocks its own embedded iframe.
Read Article →
Dropping Cloudflare Tunnel for a self-hosted NGINX reverse proxy with a Namecheap DDNS wildcard certificate, UFW firewall blocklists, and mutual TLS as an extra zero-trust layer.
Read Article →