Security

MagicMirror² Wall Dashboard, Now With Home Lab Pages

A MagicMirror² dashboard with weather, Home Assistant, Spotify, news, stocks and webcams, now rotating through two read-only Grafana pages for the home lab. Covers the hardware history, the kiosk setup and how Grafana is embedded safely.

The Homelab Console dashboard in dark mode, showing Publish and Certificates actions and a recent jobs table

A LAN-Only Web Console for My Home Lab

The scripts I used to run by hand from my desktop now live behind a small LAN-only web console. It uses passkey sign-in and a fixed list of audited actions. Claude drafts pages, and a security gate checks them before I approve anything.

Diagram of the acme.sh DNS-01 certificate automation across Cloudflare, Lets Encrypt, a local cert cache, and SSH push to internal hosts

Let's Encrypt for Internal Hosts with DNS-01 and SSH Push

How I replaced a dozen ad hoc certbot setups with one central acme.sh instance. It uses DNS-01 validation through Cloudflare and pushes each certificate to its host over SSH.

Diagram of the self-hosted mail flow through postscreen, milters, Dovecot, direct delivery and webmail

Self-Hosted Email: Running My Own Mail Server Again

How I moved my domain’s email from a hosted provider to a self-hosted Postfix and Dovecot server in my home lab, the design choices behind it, and what I learned along the way.

Diagram of passkey SSO: browser to identity provider, then OIDC apps or nginx forward-auth

Passkey Single Sign-On for My Home Lab with Authentik

One passkey, one sign-in, thirteen admin interfaces. How I built single sign-on for my home lab with Authentik, which apps I left out on purpose, and why every app still has a break-glass way in.