🏠 Self-Hosting & Homelab¶
Guides for running your own services at home, including Docker, reverse proxies, DNS, storage, monitoring, and security.
Cloud¶
- AWS S3 Cost Management
- DigitalOcean Droplet Vertical Resize (doctl)
- VPS Migration Baseline Checklist
DNS & Networking¶
- Can't Reach the ASUS Router UI Under Pi-hole (asusrouter.com Refused)
- Pi-hole DoH / DoT Bypass Defense
- Pi-hole v6 Adlist Management via SQL
- Pi-hole v6 Group Management: Per-Client DNS Rules
- Pi-hole: When Every Client Looks Like the Router
- Running Unbound and Pi-hole Together (Unbound as Pi-hole's Upstream Recursive Resolver)
- Self-Hosted Recursive DNS with unbound (and why mail servers need it)
- Tailscale for Homelab Remote Access
- Wake-on-LAN via Router SSH
Docker & Containers¶
- Debugging Broken Docker Containers
- Docker Healthchecks
- Docker vs VMs in the Homelab: Why Not Both?
- Self-Hosting Starter Guide
- Watchtower SMTP via Localhost Postfix Relay
Monitoring¶
- Deploying Netdata to a New Server
- Fleet Log Aggregation — Loki + Grafana + Alloy Setup and Runbook
- LAN Latency Ping Mesh with ping -D -O and systemd
- LogQL Returns Almost Nothing: Anchored Regex, Not a Broken Pipeline
- Logwatch Fleet Setup — Surviving Package Upgrades
- Netdata n8n Enriched Alert Emails
- Netdata SELinux AVC Denial Monitoring
- Tuning Netdata Docker Health Alarms to Prevent Update Flapping
- Tuning Netdata Web Log Alerts
Reverse Proxies¶
Security¶
- Apache: A Site-Wide Location Grant Silently Overrides Files Rules (Locking xmlrpc.php to Jetpack)
- ClamAV Fleet Deployment with Ansible
- Fail2ban Custom Jail: Apache 404 Scanner Detection
- Fail2ban Custom Jail: Apache Bad Request Detection
- Fail2ban Custom Jail: Apache PHP Webshell Probe Detection
- Fail2ban Custom Jail: WordPress Login Brute Force
- Fail2Ban Digest Mode — Fleet-Wide Quiet Alerts
- Fail2ban: Enable the nginx-bad-request Jail
- Firewall Hardening with firewalld on Fedora Fleet
- Linux Server Hardening Checklist
- Migrating Flat Ansible Playbooks to Roles (Safely)
- mod_evasive Can't Whitelist Dynamic Hostnames — Bridge It to Fail2ban Instead
- Postfix Inbound Hardening: OpenDMARC (Self-Validating SPF) + a DNSBL Check
- Rotating a Shared Secret: Prove Every Consumer, Not Just the Push
- SELinux: Dovecot IMAPSieve Spam Training Blocked (sa-learn execmem + labels)
- SELinux: Fixing Fail2ban grep execmem Denial on Fedora
- SELinux: passwd Denied on /dev/ptmx When Run Over SSH Without a TTY
- SSH Hardening Fleet-Wide with Ansible
- Standardizing unattended-upgrades Across Ubuntu Fleet with Ansible
- UFW Firewall Management
- wp-fail2ban Plugin Logpath on Debian/Ubuntu (auth.log, not syslog)
Services¶
- Castopod Has No XML Sitemap — Feed-Driven Generator + GSC Submission
- Claude Code Remote Control — Mobile Access to a Persistent Host Session
- Disabling n8n Telemetry and Phone-Home Traffic
- Ghost Email Configuration with Mailgun
- Inbound Spam Filtering: spamass-milter + SpamAssassin Bayes on Postfix/Dovecot (Fedora)
- Kiwix — Self-Hosted Offline Wikipedia
- Mastodon 4.6.0 Upgrade — MajorToot
- Mastodon DB Maintenance — Statuses, Accounts, and VACUUM
- Mastodon Federation — Domain Blocks, Silencing, and FediSeer
- Mastodon Instance Tuning
- Mastodon on S3 — Silent Upload Failures When the Bucket Disables ACLs
- Mastodon Post-Install Hardening (Permissions + Account)
- Mastodon — The
--prune-profilesTrap and How to Recover - Mastodon — Triaging Crowdfunding / Mention-Spam Accounts
- Moving Claude Code from npm to the Native Installer on macOS — What Else Needs Repointing
- obsidian-skills — Teaching Claude Code Obsidian's Syntax
- Postfix SASL Relay Auth Can Silently Share Your IMAP Mailbox Password
- Reading Full HTML Email Locally via Thunderbird's mbox Files
- Red-DiscordBot Stream Alerts — Querying, Auditing & Pruning
- Self-Hosting a Podcast with Castopod
- Updating n8n Running in Docker