Network and Security

Firewalls, certificates, DMZ design and access control for a self-hosted home lab.

A LAN-Only Web Console for My Home Lab

The scripts I used to run by hand from my desktop now live behind a small LAN-only web console. It uses passkey sign-in and a fixed list of audited actions. Claude drafts pages, and a security gate checks them before I approve anything.

Let's Encrypt for Internal Hosts with DNS-01 and SSH Push

How I replaced a dozen ad hoc certbot setups with one central acme.sh instance. It uses DNS-01 validation through Cloudflare and pushes each certificate to its host over SSH.

Locking Down SSH in a DMZ for Hugo Deployments

Hardening SSH to a DMZ web server revealed that my Hugo deploys also needed outbound Git access. Later I removed the inbound deploy trigger entirely, and that turned out to be the best hardening step.