Posts

Build an unbooted cloud-image template and verify a disposable clone before extending provisioning.

Hardening systemd service units in your homelab isn’t just for production servers — it’s how you prevent one compromised service from taking down your entire host. This guide covers sandboxing, capability drops, filesystem isolation, and resource limits with real unit files you can use today.

A complete guide to configuring MikroTik CAPsMAN with VLANs in RouterOS 7 — local forwarding mode, bridge VLAN filtering, provisioning rules for multiple SSIDs, DHCP per VLAN, and real troubleshooting for the common mistakes that break CAPsMAN VLAN setups.

Learn how Docker Compose networking really works — bridge networks, DNS-based service discovery, cross-stack communication, and real-world network isolation patterns for homelab deployments.

Hardening Docker containers in your homelab isn’t optional — it’s how you prevent container escapes and privilege escalation. This guide covers non-root users, capability drops, read-only filesystems, and seccomp profiles with real Compose configs.

Verify one Docker log stream end to end before expanding collection or replacing Promtail.

Run Cloudflare Tunnel in Docker to expose homelab services through Cloudflare’s edge. No open firewall ports, automatic HTTPS, and per-service ingress rules via a single cloudflared container.

Deploy Windows Hello for Business in hybrid key trust mode: enterprise PKI setup, DC certificates, GPO policy, user enrollment, PIN configuration, and verification.

Configure Microsoft Entra hybrid join for on-premises domain-joined devices: SCP via GPO or Entra Connect, automatic registration startup via Scheduled Task, verification with dsregcmd, and troubleshooting registration failures.

Enable password writeback (SSPR), device writeback (supported AD FS scenarios), and group writeback (Microsoft 365 groups) from cloud to on-premises Active Directory using Entra Connect.