Posts

ZFS snapshots preserve dataset state, but they are only one part of a recovery plan. Pool failure, lost guest configuration, and inconsistent application data need separate protection. This guide uses a small filesystem lab on an existing test pool. It does not create pools, repartition disks, or roll back running guests. Verification status Area Evidence and limits Technical review Official OpenZFS and Sanoid references reviewed on October 31, 2026. Static checks Bash examples syntax checked. Runtime No ZFS pool, dataset, snapshot, clone, replication, or recovery operation executed for this revision. Scope Proposed filesystem lab, not a captured host layout or measured performance result. 1. Identify the storage objects Proxmox offers several installation and storage choices; ZFS is not a universal default. Inspect the actual host before changing properties: ...

Docker Hub rate-limits anonymous pulls to 100 per 6 hours (200 for authenticated users). In a homelab with frequent rebuilds, multiple hosts, or CI-style workflows, you’ll hit that limit fast. Even if you don’t, pulling the same nginx:alpine image ten times across ten containers wastes bandwidth and time. A local Docker registry mirror fixes both: it acts as a pull-through cache. First pull is from Docker Hub (or any upstream). Every subsequent pull from any host in your lab hits the local cache instead. ...

One PBS setup workflow: dedicated storage, authenticated PVE access, maintenance jobs, and an isolated restore test.

If you have fiber-to-the-home (FTTH), your ISP almost certainly gave you a combo ONT/router. It’s a locked-down all-in-one box that does GPON optical termination, routing, Wi-Fi, and often double NAT. For a homelab with VLAN segmentation and a proper router like MikroTik, that box is a bottleneck — and you can bypass it entirely. This post covers replacing the ISP ONT/router with a MikroTik router using an SFP GPON stick, covering the hardware, VLAN configurations, PPPoE quirks, and the gotchas that aren’t in the marketing material. This is specifically from my experience with Dominican Republic FTTH providers, but the patterns apply to most GPON deployments globally. ...

Cloudflare Tunnel gives you a secure outbound-only connection from your homelab to Cloudflare’s edge, proxying public traffic without opening any firewall ports. No pinholes, no DMZ, no exposing your home IP. The usual deployment is a Docker container or a systemd service on a Linux box. But if you have a MikroTik router running RouterOS 7.6+ with container support, you can run cloudflared directly on the router — zero extra hardware, zero extra VMs. ...

WireGuard on MikroTik RouterOS is production-ready as of RouterOS 7.x, and it’s dramatically simpler than IPsec or OpenVPN for homelab use. No certificate authorities, no confusing phase 1/phase 2 settings, no userspace daemon eating CPU — just a kernel module, a private key, and a peer config. This post covers two WireGuard topologies running on the same MikroTik router (R1 from the previous deployment post): Road Warrior — remote devices (phone, laptop) connect to the homelab Site-to-Site — two MikroTik routers connected across the internet Both share the same base config and coexist on the same router. ...

A Proxmox bridge connects guest interfaces to a network. VLAN filtering determines which VLANs traverse its ports. Routing and firewall policy determine which subnets may communicate. Start by documenting what the physical switch sends to the host. A correct guest VLAN tag cannot fix a mismatch on the uplink. Verification status Area Evidence and limits Technical review Reviewed against the official references below on October 31, 2026. Shell examples Bash syntax checked; no host networking commands executed. Configuration Illustrative single-uplink IPv4 lab, not a captured production configuration. Runtime Application, rollback, DHCP, guest traffic, and firewall behavior remain untested for this revision. 1. Identify the management path These two designs are different: ...

Every homelab needs a solid network foundation. This guide walks through the full configuration of R1 — a MikroTik edge router with segmented VLANs, inter-VLAN firewalling, WireGuard VPN, and a Cloudflare Tunnel running directly on the router. The config below is based on RouterOS 7.22.1. Commands are split by section so you can follow along step-by-step. Replace anything in <> with your own values. Hardware Model: MikroTik E62iUGS-2axD5axT OS: RouterOS 7.22.1 WAN: GPON FTTH (PPPoE on VLAN 100) Port Layout Port Role Access VLAN Notes SFP1 WAN — GPON ONT, native vlan 1 for ONT access Ether1 CCTV 50 Untagged, camera network Ether2 MGMT 99 Untagged, management Ether3 MGMT 99 Untagged, secondary management Ether4 HOME 10 Untagged, main home LAN Ether5 Trunk Tagged Inter-switch link carrying all VLANs Step 1 — Bridge Setup Create the main bridge with VLAN filtering enabled, and a separate bridge for container veth interfaces: ...

Historical setup: This article records the original lab deployment. Frigate configuration changes between releases; validate the configuration against the documentation for the exact image version you deploy. The example exposes several service ports and is intended for an isolated lab network. Restrict access at the host and router, and use the authenticated interface supported by your chosen release. Frigate is an open-source NVR built for real-time object detection with local processing. No cloud subscriptions, no vendor lock-in — just cameras, a GPU, and decent detection models. ...

Welcome to the blog. This is where I’ll be writing about homelab stuff — Proxmox, MikroTik, Docker, networking, automation, and whatever else I’m tinkering with. Stay tuned.