Blog
Topics: All
Tools: All
16 posts
- Private HTTPS for My Homelab over TailscaleI want my homelab's web apps, Forgejo first, reachable from my laptop and phone wherever I am, over HTTPS with real certificates, and without opening anything to the internet…Oct 4, 2026
- Why I Paused Forgejo's Container Registry for My k3s ClusterForgejo already hosts my code and runs my CI, so I planned to push app images to its built-in container registry and have the cluster pull them from there. The plan grew into a…Oct 4, 2026
- Pointing a Public DNS Record at a Tailnet-Only AddressMy devices need forgejo.lab.example.com to resolve to the Tailscale proxy from the proxy post, at home or anywhere else. I do that with one public wildcard record that points at a…Oct 4, 2026
- Moving Forgejo to an HTTPS Hostname Without Breaking Actions CheckoutsMost apps move to their new name with a one-line Ingress change. Forgejo needs more care, because it puts its own URL into everything it generates: clone URLs, redirects, and the…Oct 4, 2026
- Wildcard Let's Encrypt Certificates for Private Services with cert-managerMy homelab services under lab.example.com are only reachable over Tailscale, but I still want certificates that every browser and tool trusts. Let's Encrypt can issue them for…Oct 4, 2026
- Giving Traefik a Fixed Tailnet Address with the Tailscale Kubernetes OperatorMy apps should be reachable from any of my devices over Tailscale, no matter which node Traefik happens to run on. The Tailscale Kubernetes operator does this by putting Traefik…Oct 4, 2026
- Putting Traefik on My Tailnet with One Unprivileged Tailscale ProxyMy homelab apps should be reachable from any of my devices over Tailscale. Traefik already routes every app by hostname, so the cluster needs only one way onto the tailnet: a…Oct 4, 2026
- Serving Every k3s Ingress over HTTPS with One Default CertificateWith a wildcard certificate in the cluster, I don't want TLS settings in every Ingress. Traefik can serve one certificate as its default, and the Traefik that ships with k3s…Oct 4, 2026
- Remote SSH over TailscaleThis is how I reach my homelab server from anywhere without opening a single port on my router. At home I still SSH in over the LAN. Away from home I go through Tailscale. Both…Sep 29, 2026
- Running the Forgejo Runner in Kubernetes with a Docker-in-Docker SidecarForgejo doesn't run CI jobs itself. A separate program, Forgejo Runner, asks the instance for jobs and runs each one in a container.Sep 24, 2026
- Setting up k3s on my homelabI had an old PC and a laptop collecting dust, so I turned them into a small Kubernetes cluster to host stuff like Forgejo and my portfolio site. This is how I set it up and, more…Sep 22, 2026
- Using kubectl on my homelab from my laptopOnce k3s was running I didn't want to SSH into the server every time I wanted to run kubectl. This is how I made the cluster reachable from my working machine. I already had…Sep 22, 2026
- Sealed Secrets: keeping secrets in a public GitOps repoMy homelab cluster is managed from a public GitHub repo (homelab33). Argo CD watches main and applies whatever is there, so every file I commit is both live in the cluster and…Sep 22, 2026
- Homelab server securityThis is how I secure my Ubuntu servers at home before they run anything important.Sep 21, 2026
- FirewallThis is the host firewall I run on my Ubuntu servers. It uses UFW, blocks everything coming in by default, and only opens what the server actually needs. It's written for k3s…Sep 21, 2026
- SSH hardeningThis is how I lock down SSH on my Ubuntu servers so the only way in is with my private key. No passwords, no root login, only my user.Sep 21, 2026