The boss fight, documented: inbound through the VPS, a mailstore the internet can’t reach, and outbound through a retry-ladder of relay providers, DMARC-aligned on the root domain no matter which rung delivers.
Public hostnames that resolve to the local proxy when you’re at site A: same URLs everywhere, no hairpin through the VPS for local traffic, and the OAuth quirk the shortcut drags into the light.
Nightly restic snapshots of appdata to a local disk AND cloud object storage, databases dumped properly, keys that live on paper, and the quarterly restore drill that finds what the green checkmarks hide.
Four small tools instead of a monitoring distro: live metrics, every host’s logs in one tab, uptime checks that page the phone, and a dashboard tying it together. What you give up, and why it doesn’t hurt at this scale.
The deep dive on library automation: exact naming templates that feed Plex cleanly, quality profiles that stop the upgrade churn, custom formats without the madness, and recyclarr so none of it lives only in a web UI.
The whole Plex page: the honest Plex-vs-Jellyfin call, hardware transcoding that actually engages, the /data mount convention that makes hardlinks work, naming the scanner loves, and wiring the *arrs in cleanly.
The plumbing half of bender’s media stack: download clients that live inside a VPN network namespace, the label trick namespace-sharing requires, and the restart gotcha that otherwise pages you at 3 a.m.
Komodo Core watches the repo and redeploys app stacks on push. Secrets decrypt in a pre-deploy hook, the agent runs as systemd on purpose, and the webhook gets treated like the weather: usually fine, never trusted.
A single Authentik core with a lightweight outpost on every host: forward-auth for apps that can’t do auth, OIDC for apps that can, config as code where the product allows, and four pitfalls ranked by how down production went.
A cheap VPS fronts everything: TLS, auth at the door, Crowdsec bouncing the scanners, then proxying over the overlay to services whose disks it can’t even see. Plus the TLS error whose message will not help you.
One Traefik per host, wildcard certs via DNS-01 with zero open ports, and routing declared as labels on the containers themselves. Plus three footguns, ranked by how many hours each took from me.
One flat 10.99.0.0/24 spanning site A, site B, and the VPS. No port forwards, no router surgery, and the two-nodes-one-NAT collision that silently makes everything slow.