Automating wildcard Let's Encrypt renewals on a registrar with no DNS API, using acme.sh, acme-dns, and one permanent CNAME record — no static IP, no paid API tier, no human in the loop.
Read Article →
Replacing the increasingly freemium Rambox with Ferdium, a fully-free messenger aggregator, self-hosting its optional sync server on a Raspberry Pi behind nginx so no chat metadata ever touches a third party.
Read Article →
Taking Pi-hole and DNSCrypt-Proxy on the road with dnsdist, nginx-terminated DoH/DoT, and EDNS Client Subnet — so remote devices get encrypted, filtered, per-client DNS anywhere in the world.
Read Article →
Dropping Cloudflare Tunnel for a self-hosted NGINX reverse proxy with a Namecheap DDNS wildcard certificate, UFW firewall blocklists, and mutual TLS as an extra zero-trust layer.
Read Article →
Adding cAdvisor to watch per-container CPU, memory, and disk usage on the Pi, plus why Graylog is a heavier lift than the monitoring itself.
Read Article →
Self-hosting a federated Matrix homeserver with Keycloak SSO, a Cloudflare Worker for the well-known federation lookup, and the DNS and memory gotchas that came with running it long-term.
Read Article →
Self-hosting Outline as a private Notion alternative, backed by Postgres and a shared Redis instance, with Keycloak SSO and an NGINX config tuned for a React SPA's burst of parallel requests.
Read Article →
Setting up Keycloak for unified single sign-on across the stack, then wiring Grafana and Portainer to it via OpenID Connect, with an NGINX config for rate-limited remote access.
Read Article →
Automating Docker image updates with Watchtower, wired to Gotify for notifications, plus the IP-pinning gotcha that leaves Watchtower stuck mid self-update.
Read Article →
Building a Grafana + Prometheus + Node Exporter + Smartctl Exporter monitoring stack, gated behind Cloudflare Zero Trust, with an alert rule wired through to Gotify.
Read Article →
Self-hosting Gotify as a push-notification server, exposed via Cloudflare Tunnel, with a curl and Python example for sending alerts to it.
Read Article →
Running Home Assistant on the Pi with a Zigbee USB stick, exposing it via Cloudflare Tunnel or NGINX, and turning a touchscreen into a motion-aware kiosk dashboard.
Read Article →
Running Transmission behind an always-on OpenVPN tunnel in Docker, exposing it remotely via Cloudflare Tunnel or NGINX, and sharing the download directory back to the LAN over NFS.
Read Article →
Self-hosting Nextcloud on a Raspberry Pi with MariaDB and Redis, exposed via Cloudflare Tunnel or NGINX, plus the occ commands and cron job that keep it healthy long-term.
Read Article →
Self-hosting Vaultwarden as a Bitwarden-compatible password vault, exposed remotely via Cloudflare Tunnel, with a hardened NGINX config as the alternative reverse-proxy path.
Read Article →
Setting up remote access with Cloudflare Tunnel via Docker Compose and Portainer — dealing with CG-NAT, and enabling SSH access to the Pi through the tunnel.
Read Article →
Combining Pi-hole and dnscrypt-proxy in Docker for network-wide, encrypted DNS — plus the NULL-blocking-mode default that quietly breaks your own reverse proxy.
Read Article →
Installing Docker on a Raspberry Pi, enabling cgroup memory accounting, moving container storage onto the encrypted SSD, and managing everything through a self-hosted Portainer instance.
Read Article →
Kicking off a self-hosting series by building the hardware foundation for a Raspberry Pi 5 home server — NVMe SSD HAT, cooling, full-disk LUKS encryption with USB-key auto-decryption, and moving swap off the SD card.
Read Article →