https://hi.khuo.ng/series/homelab-from-scratch/ Recent content in Homelab From Scratch on khuo.ng Hugo en-us Thu, 11 Jun 2026 09:00:00 -0500 https://hi.khuo.ng/posts/2026-06-11-self-hosted-mail/ Thu, 11 Jun 2026 09:00:00 -0500 https://hi.khuo.ng/posts/2026-06-11-self-hosted-mail/ The boss fight, documented: inbound through the VPS, a mailstore the internet can’t reach, and outbound through a retry-ladder of relay providers, DMARC-aligned on the root domain no matter which rung delivers. https://hi.khuo.ng/posts/2026-06-07-split-horizon-dns/ Sun, 07 Jun 2026 09:00:00 -0500 https://hi.khuo.ng/posts/2026-06-07-split-horizon-dns/ Public hostnames that resolve to the local proxy when you’re at site A: same URLs everywhere, no hairpin through the VPS for local traffic, and the OAuth quirk the shortcut drags into the light. https://hi.khuo.ng/posts/2026-05-30-backups-restic/ Sat, 30 May 2026 09:00:00 -0500 https://hi.khuo.ng/posts/2026-05-30-backups-restic/ Nightly restic snapshots of appdata to a local disk AND cloud object storage, databases dumped properly, keys that live on paper, and the quarterly restore drill that finds what the green checkmarks hide. https://hi.khuo.ng/posts/2026-05-23-observability/ Sat, 23 May 2026 09:00:00 -0500 https://hi.khuo.ng/posts/2026-05-23-observability/ Four small tools instead of a monitoring distro: live metrics, every host’s logs in one tab, uptime checks that page the phone, and a dashboard tying it together. What you give up, and why it doesn’t hurt at this scale. https://hi.khuo.ng/posts/2026-05-16-arr-naming-quality/ Sat, 16 May 2026 09:00:00 -0500 https://hi.khuo.ng/posts/2026-05-16-arr-naming-quality/ The deep dive on library automation: exact naming templates that feed Plex cleanly, quality profiles that stop the upgrade churn, custom formats without the madness, and recyclarr so none of it lives only in a web UI. https://hi.khuo.ng/posts/2026-05-13-plex/ Wed, 13 May 2026 09:00:00 -0500 https://hi.khuo.ng/posts/2026-05-13-plex/ The whole Plex page: the honest Plex-vs-Jellyfin call, hardware transcoding that actually engages, the /data mount convention that makes hardlinks work, naming the scanner loves, and wiring the *arrs in cleanly. https://hi.khuo.ng/posts/2026-05-09-media-stack/ Sat, 09 May 2026 09:00:00 -0500 https://hi.khuo.ng/posts/2026-05-09-media-stack/ The plumbing half of bender’s media stack: download clients that live inside a VPN network namespace, the label trick namespace-sharing requires, and the restart gotcha that otherwise pages you at 3 a.m. https://hi.khuo.ng/posts/2026-04-25-komodo-deploys/ Sat, 25 Apr 2026 09:00:00 -0500 https://hi.khuo.ng/posts/2026-04-25-komodo-deploys/ Komodo Core watches the repo and redeploys app stacks on push. Secrets decrypt in a pre-deploy hook, the agent runs as systemd on purpose, and the webhook gets treated like the weather: usually fine, never trusted. https://hi.khuo.ng/posts/2026-04-11-authentik-sso/ Sat, 11 Apr 2026 09:00:00 -0500 https://hi.khuo.ng/posts/2026-04-11-authentik-sso/ A single Authentik core with a lightweight outpost on every host: forward-auth for apps that can’t do auth, OIDC for apps that can, config as code where the product allows, and four pitfalls ranked by how down production went. https://hi.khuo.ng/posts/2026-03-28-traefik-edge/ Sat, 28 Mar 2026 09:00:00 -0500 https://hi.khuo.ng/posts/2026-03-28-traefik-edge/ A cheap VPS fronts everything: TLS, auth at the door, Crowdsec bouncing the scanners, then proxying over the overlay to services whose disks it can’t even see. Plus the TLS error whose message will not help you. https://hi.khuo.ng/posts/2026-03-14-traefik-internal/ Sat, 14 Mar 2026 09:00:00 -0500 https://hi.khuo.ng/posts/2026-03-14-traefik-internal/ One Traefik per host, wildcard certs via DNS-01 with zero open ports, and routing declared as labels on the containers themselves. Plus three footguns, ranked by how many hours each took from me. https://hi.khuo.ng/posts/2026-02-28-zerotier-overlay/ Sat, 28 Feb 2026 09:00:00 -0500 https://hi.khuo.ng/posts/2026-02-28-zerotier-overlay/ One flat 10.99.0.0/24 spanning site A, site B, and the VPS. No port forwards, no router surgery, and the two-nodes-one-NAT collision that silently makes everything slow. https://hi.khuo.ng/posts/2026-02-14-secrets-in-git/ Sat, 14 Feb 2026 09:00:00 -0500 https://hi.khuo.ng/posts/2026-02-14-secrets-in-git/ Encrypted .env files committed beside the compose files that use them: per-machine keys, per-file recipient rules, the one backup that cannot live inside the lab, and the git-diff habit that catches every near-miss. https://hi.khuo.ng/posts/2026-02-01-the-gitops-repo/ Sun, 01 Feb 2026 09:00:00 -0500 https://hi.khuo.ng/posts/2026-02-01-the-gitops-repo/ A repo layout that scales past 60 services without becoming a junk drawer: the infra/app split, four reusable service-file patterns, and naming conventions that do the remembering for you. https://hi.khuo.ng/posts/2026-01-18-domains-and-dns/ Sun, 18 Jan 2026 09:00:00 -0500 https://hi.khuo.ng/posts/2026-01-18-domains-and-dns/ Domain-per-purpose, two wildcard records that mean you never touch DNS again, and scoped API tokens so no leaked credential can take the whole thing down. https://hi.khuo.ng/posts/2026-01-06-homelab-from-scratch/ Tue, 06 Jan 2026 09:00:00 -0500 https://hi.khuo.ng/posts/2026-01-06-homelab-from-scratch/ Years of accumulated server cruft, three boxes that each grew their own personality, and the decision to tear it down and rebuild as one git repo. The architecture, the rules, and why.