Stop Backups Writing to an Unmounted Disk
Prevent Linux backup jobs from filling your root disk when a backup drive is missing. Add mount checks, systemd dependencies, and a safe failure-path test.
Read more
#security
45 articles
Verify SSH Host Keys Before You Trust Your VPS
Verify SSH host keys before trusting a new VPS, handle known_hosts warnings safely, and pin server identity for unattended backups without disabling checks.
Read more
Certbot vs acme.sh vs Caddy: Who Owns TLS Renewal?
Compare Certbot, acme.sh, and Caddy for self-hosted TLS certificates. Pick the right renewal owner, avoid broken reloads, and test what your server serves.
Read more
Systemd Sandboxing for Self-Hosted Services
Harden Linux services with systemd sandboxing. Limit filesystem writes, drop capabilities, and test restrictions without chasing a perfect security score.
Read more
Restrict SSH Tunnel Keys to One Private Admin Tool
Restrict SSH tunnel keys with OpenSSH so a private admin tool stays reachable without granting shell access. Includes setup, denial tests, and rollback steps.
Read more
Proxmox vs Incus vs Docker for Your Homelab
Compare Proxmox, Incus, and Docker for a homelab: isolation, storage, backups, hardware access, and the simplest architecture for your self-hosted applications.
Read more
Auditd: Track Who Changed Your Linux Server Files
Use auditd to trace changes to SSH settings and Docker Compose files on your Linux VPS, with persistent rules, a safe test, and practical investigation steps.
Read more
Protect Private Admin Tools With Caddy Basic Auth
Use Caddy basic auth to put a password wall in front of private Docker admin tools without accidentally exposing a dashboard to the internet.
Read more
Self-Host Docker Mailserver Without Becoming a Spam Relay
A practical Docker Mailserver setup for a personal domain, with DNS records, TLS, backups, and the hard limits of running your own email in 2026.
Read more
Traefik vs Caddy: Which Reverse Proxy Should You Use in 2026?
Traefik and Caddy both handle HTTPS well, but their workflows could not be more different. Pick the right reverse proxy for your Docker stack.
Read more
Cloudflare Access for a Private Homelab
Put Cloudflare Access in front of private self-hosted apps with a tunnel, Docker, and identity-based policies instead of exposed login pages.
Read more
Get Docker Image Update Alerts with Diun
Use Diun to get Docker image update alerts without giving a container permission to restart your self-hosted apps.
Read more
Scan Docker Images With Trivy Before They Reach Your Homelab
Use Trivy to scan Docker images and Compose stacks before deployment. A practical security workflow for catching known container vulnerabilities.
Read more
Docker Healthchecks: Stop Trusting ‘Up’
Add Docker healthchecks to Compose services so a running container is not mistaken for a working self-hosted app.
Read more
Docker Registry: Zot vs Harbor vs Distribution
Compare Zot, Harbor, and Docker Distribution for a self-hosted container registry. Pick the right registry for a homelab, team, or CI pipeline.
Read more
Docker Socket Proxy: Stop Giving Containers Root Access
Use a Docker socket proxy to give Traefik and monitoring tools the API access they need without handing every container control of your host.
Read more
Validate Docker Compose Before You Deploy
Use docker compose config to catch broken variables, invalid YAML, and unsafe overrides before your self-hosted stack goes down.
Read more
Authentik vs Authelia vs Keycloak: Self-Hosted SSO in 2026
Authentik, Authelia, and Keycloak solve different identity problems. Compare setup, protocols, access control, and pick the right self-hosted SSO.
Read more
Encrypt Docker Compose Secrets With SOPS and age
Keep Docker Compose secrets in Git without committing plaintext. Set up SOPS and age for a small, auditable self-hosted deployment workflow.
Read more
IPv4 vs IPv6-Only VPS for Self-Hosting
Should you save money with an IPv6-only VPS? Compare IPv4, IPv6-only, and dual-stack hosting before exposing your self-hosted apps.
Read more
Sign Docker Images With Cosign: A Homelab Guide
Stop trusting container tags blindly. Sign and verify Docker images with Cosign so your homelab deploys artifacts you can actually identify.
Read more
Docker Network Security for Self-Hosters: Isolation, Firewalls, and Real-World Setup
Most self-hosters run every container on the default bridge network. Here's why that's risky — and how to properly isolate your apps with Docker networks, internal zones, and firewall rules.
Read more
Self-Host Watchtower: Automatic Docker Container Updates on Autopilot
Stop manually checking for Docker updates. Set up Watchtower to auto-update your containers, with sane exclusions so only safe services update unattended.
Read more
Authelia + LLDAP: Self-Hosted SSO That Doesn't Weigh a Ton
Authentik is great, but sometimes you want something lighter. Here's how to set up Authelia with LLDAP as your auth gateway — no bloated dependencies, no headache.
Read more
Self-Host Headscale: Run Your Own Tailscale Control Server
Tailscale is amazing, but it relies on their cloud coordination server. Headscale lets you own that piece too. Here's how I run my own mesh VPN.
Read more
Self-Host NetBird: A Mesh VPN That Feels Like Tailscale, But Yours
Self-host NetBird for private homelab access without port forwarding. A practical Docker guide with setup, ACLs, routing, and real gotchas.
Read more
Rootless Docker for Self-Hosting: Less Blast Radius, Same Apps
Run Docker without giving every container root-shaped teeth. A practical rootless Docker setup for self-hosters who want safer VPS and homelab apps.
Read more
Self-Host Renovate for Docker Compose Updates Without the YOLO Button
Watchtower is convenient until it updates the wrong thing at the wrong time. Here's how I use Renovate to get pull requests for Docker Compose updates instead.
Read more
SSH Certificates: The Login Upgrade I Wish I Used Before My Homelab Got Messy
Stop copying SSH public keys to every VPS and homelab box. SSH certificates give you short-lived access, cleaner revocation, and one sane trust model for your servers.
Read more
Self-Host SearXNG: Private Search Without Feeding the Ad Machine
I got tired of search pages full of ads, tracking, and AI boxes. Here's how I run SearXNG at home with Docker, sane settings, and a few security guardrails.
Read more
Caddy Client Certificates: The Cheap Private Gate I Put in Front of My Homelab
Password prompts are fine. VPNs are better. But for a few private web apps, Caddy mutual TLS is the tiny security layer I wish I had set up earlier.
Read more
CrowdSec: The Crowd-Powered IPS That Replaced Fail2ban on My Servers
Fail2ban was good. CrowdSec is better. Here's why I switched my entire homelab to this collaborative intrusion prevention system — and how to set it up in 15 minutes.
Read more
Self-Host Your Own Chat Server: Matrix vs Revolt vs Mattermost (2026)
I tested Synapse, Revolt, and Mattermost to replace Discord and Slack on my homelab. Here's what I learned about running your own chat infrastructure — and which one I actually use.
Read more
Tailscale for Self-Hosting: The Easiest Way to Access Your Homelab Remotely
Stop opening ports and messing with complex VPN configs. Tailscale gives you secure, zero-config access to every self-hosted service from anywhere. Here's how I set it up and why I won't go back.
Read more
Vaultwarden : Votre Coffre-Fort de Mots de Passe Auto-Hébergé
J'ai quitté LastPass après leur fuite de données. Voici pourquoi Vaultwarden (Bitwarden RS) est le meilleur gestionnaire de mots de passe self-hosté — et comment l'installer.
Read more
Manage Your Self-Hosted App Secrets With HashiCorp Vault
Stop scattering API keys in .env files. Set up HashiCorp Vault in Docker to centralize, rotate, and audit every secret your self-hosted apps need.
Read more
How to Self-Host WireGuard VPN: Access Your Homelab From Anywhere
Set up your own WireGuard VPN server in Docker. Connect to your homelab securely from your phone, laptop, or anywhere — no paid VPN needed.
Read more
How to Set Up Authentik: SSO for Your Entire Self-Hosted Stack
Stop managing 12 separate logins. Set up Authentik to get single sign-on across all your self-hosted apps — Nextcloud, Grafana, Gitea, and more.
Read more
How to Backup Your Self-Hosted Apps: Complete Guide to Data Protection
Learn how to properly backup your self-hosted applications with Docker volumes, databases, and off-site strategies. Protect your data from loss.
Read more
How to Set Up Traefik Reverse Proxy with Docker — Complete Guide
Learn how to configure Traefik reverse proxy for Docker containers with automatic SSL certificates, dashboard access, and production-ready security settings.
Read more
How to Self-Host Vaultwarden: The Ultimate Bitwarden Alternative
Complete guide to self-hosting Vaultwarden, a lightweight Bitwarden server. Set up your own password manager with Docker in under 30 minutes.
Read more
Secure Your VPS in 20 Minutes: The Hardening Checklist I Use on Every Server
SSH keys, UFW firewall, Fail2ban, auto-updates — the exact steps I run on every new VPS before deploying anything. Copy-paste ready.
Read more