Security

Diagram of passkey SSO: browser to identity provider, then OIDC apps or nginx forward-auth

Passkey Single Sign-On for My Home Lab with Authentik

One passkey, one sign-in, thirteen admin interfaces. How I built single sign-on for my home lab with Authentik, which apps I left out on purpose, and why every app still has a break-glass way in.

The Homelab Console dashboard in dark mode, showing Publish and Certificates actions and a recent jobs table

A LAN-Only Web Console for My Home Lab

The scripts I used to run by hand from my desktop now live behind a small LAN-only web console. It uses passkey sign-in and a fixed list of audited actions. Claude drafts pages, and a security gate checks them before I approve anything.

Diagram of the home lab suite: public site, LAN-only console, private Git server, knowledge base and the hypervisor cluster underneath

My Home Lab Suite: A Guided Tour

A start-here tour of my home lab as one connected suite, from the Proxmox cluster and mail server to publishing, media, electronics and brewing, with a link to every project write-up.

Diagram of the acme.sh DNS-01 certificate automation across Cloudflare, Lets Encrypt, a local cert cache, and SSH push to internal hosts

Let's Encrypt for Internal Hosts with DNS-01 and SSH Push

How I replaced a dozen ad hoc certbot setups with one central acme.sh instance. It uses DNS-01 validation through Cloudflare and pushes each certificate to its host over SSH.

Diagram of the self-hosted mail flow through postscreen, milters, Dovecot, direct delivery and webmail

Self-Hosted Email: Running My Own Mail Server Again

How I moved my domain’s email from a hosted provider to a self-hosted Postfix and Dovecot server in my home lab, the design choices behind it, and what I learned along the way.