nftables Host Firewall for a Homelab — Add Rules Without Flushing Docker
Create and verify a separate nftables host-input policy, preserve service-owned tables, and understand why Docker published ports need forwarding rules.
Security
MikroTik RouterOS 7 — Hardening and Best Practices Guide
Practical RouterOS 7 best practices for homelab and small-business deployments — security hardening, firewall design, VLAN segmentation, FastTrack performance tuning, DoH configuration, and backup automation with real commands.
Docker Trivy Scanning — Automated Vulnerability Detection for Homelab Containers
A practical guide to running automated vulnerability scanning for Docker containers in your homelab — install Trivy, scan images for CVEs and secrets, set up systemd timers for weekly scans, and integrate with dashboards for actionable security reports.
WireGuard VPN on Proxmox — LXC Setup Guide for Homelab Remote Access
Deploy a lightweight WireGuard VPN server in a Proxmox LXC container — configure persistent tunnels, NAT routing, client generation, and firewall rules for secure remote access to your entire homelab network.
Linux systemd Service Hardening — Sandboxing, Capabilities, and Security Auditing
Harden Linux systemd services with built-in sandboxing directives — ProtectHome, ProtectSystem, CapabilityBoundingSet, NoNewPrivileges, PrivateTmp, and systemd-analyze security scoring. Includes real hardened service files for common homelab daemons.
Caddy Reverse Proxy Docker — Automatic HTTPS and Zero-Downtime Reloads
Set up Caddy as a Docker reverse proxy for your homelab — automatic Let’s Encrypt HTTPS with zero config, reusable Caddyfile snippets, zero-downtime reloads, Cloudflare DNS-01 wildcards, HTTP/3 support, and production security hardening.
MikroTik RouterOS 7 Firewall — Rules, FastTrack, and Connection Tracking
Configure a production-ready MikroTik RouterOS 7 firewall — understand filter, NAT, mangle, and raw tables, enable FastTrack for wire-speed forwarding, implement connection tracking state rules, and build brute force protection with dynamic address lists.
Proxmox Backup Strategies — Vzdump, PBS, and 3-2-1 for Homelabs
Plan backup copies around host and site failures, then prove recovery with an isolated restore exercise.
Step CA + ACME — Internal TLS Certificates for Your Homelab
Run your own internal Certificate Authority with step-ca in Docker, issue TLS certificates via ACME, integrate with Traefik for automatic renewal, and distribute the root CA to all your devices — no more self-signed certificate warnings.
NGINX Security Advisory Verification — Correction to the Poolslip Post
Correction of an unsupported nginx-poolslip advisory, with steps to verify official NGINX advisories, identify running versions, and validate an update.