TUTORIALS.
step-by-step guides from the homelab and other projects — networking, self-hosting, builds.
planning and building a VLAN-segmented homelab network — tiers, a build order that avoids any outage, a real VPN kill switch, and the mistakes worth skipping.
Radarr, Sonarr, Lidarr, Prowlarr, Bazarr, and qBittorrent on Proxmox, one container per service, with gluetun standing in as a container-level gateway for the VLAN kill switch I don't have hardware for yet.
putting a real login in front of a self-hosted app that has weak or no auth of its own — Cloudflare Access as the gate, Google as the identity provider, and deciding which apps actually need it.
your ISP put you behind CGNAT, so a port-forward will never work. an outbound-only cloudflared connector gets a self-hosted service on the public internet anyway — one connector, many services, no inbound port.
a private certificate authority so your LAN-only services get real, trusted HTTPS instead of a browser 'Not Secure' — ACME for the ones that support it, a renewal daemon for the ones that don't, and the silent failure mode that broke mine for two weeks.
ISC dhcpd is end-of-life upstream. moving to Kea, field by field, on a flat network — no VLANs required first.
forcing specific traffic through a VPN at the router level, with a rule that fails closed instead of quietly leaking your real IP.
giving one container its own tailnet address, without a public port-forward and without exposing the whole LAN with a subnet router.