Longhorn replicates PVCs across k3s nodes. On a single physical host, all three replicas live on the same NVMe. When a node failed, Longhorn's Multi-Attach error locked out every pod that needed the volume. NFS was the fix.

A documented contract for what Renovate auto-merges, what gets a PR, what alerts in Discord, what self-heals, and what stays manual. The operating model that lets a homelab run untouched for weeks.

Der Standard-Acmebot-Deploy hat drei öffentliche Angriffsflächen. Für ISO 27001, KRITIS oder NIS2 reicht das nie. So baust du Let's-Encrypt-Automatisierung mit Private Link, VNet Integration und Private DNS - komplett mit Terraform.

Einen MikroTik als WireGuard-Server per Hand zu konfigurieren ist quick & dirty - bis der zehnte Peer dazukommt und du einen Tag mit /interface/wireguard/peers verbringst. Die Terraform-Lösung: Peers als Rollen-Module (Admin, App, IoT), Access per IP-Firewall durchgesetzt, alles in Git. Mit dem WireGuard-Wissen, das die RouterOS-Doku dir nicht sagt.

capabilities.drop: [ALL] und runAsNonRoot: true durch Schema-Validierung, lief durch. Innerhalb von Minuten waren neun Container down - inklusive beider Postgres-Instanzen hinter Paperless und Nextcloud. Die zwei falschen Annahmen, die Wiederherstellungs-Falle danach und die Lektion für jede pauschale securityContext-Passade.

Ein k3s-Cluster ohne Backup ist eine Zeitbombe - aber Velero mit einem machbaren S3-Storage braucht keinen Cloud-Vendor. So sieht die komplette Kette aus: Garage als S3-Backend im eigenen Cluster, Longhorn als Source, Velero via ArgoCD deployed, tägliche Backups per Schedule. Mit dem Praxis-Trick, der garantiert, dass dein Backup auch wirklich wiederherstellbar ist.

Die kaufrelevante Server-Frage ist nicht 'wie viele Kerne kriege ich fürs Geld', sondern: Wie viel RAM braucht dein eigener Betrieb wirklich, und wann lohnt ein Proxmox-Knoten statt Cloud. Mit Zahlen für 2026.

NIS2 betrifft lange nicht jeden, der einen Server daheim betreibt. Wann du als Selbstständiger, Dienstebetreiber oder Homelab-Betreiber wirklich in den Anwendungsbereich fällst — und was die drei konkreten Pflichten sind, die dann gelten.

When Ollama, Minecraft, and etcd compete for CPU on the same host, the scheduler doesn't know which one is critical. Proxmox cpu.units gives etcd 2x priority — and without it, leader-election timeouts cascade into cluster instability.

Three backup layers, two storage media, one offsite copy — the theory. In practice: Velero's defaultVolumesToFsBackup gap, PBS restore gotchas with IP conflicts, and Google Drive API throttled to 1.6 KiB/s. Here's what actually works.

Jellyfin runs in a GPU-passthrough LXC for hardware transcoding. SABnzbd, Sonarr, Radarr, and Bazarr run on a separate LXC with per-flow traffic isolation. A Python CronJob in k3s ties them together. Here's why the media stack left Kubernetes.

Garage S3's SQLite database corrupted because NFS file-locking semantics don't work with SQLite's WAL mode. The lesson: embedded databases and NFS are incompatible, and the fix is local-path for anything with a .db file.

A production AKS cluster with private_cluster_enabled, forced-tunneled node egress via a Route Table, and private-endpoint-only ACR/Key Vault — the workload cluster that sits behind a Hub & Spoke and an Azure Firewall.

All VMs and LXCs starting simultaneously spiked the Proxmox host load to 147. The fix was NFS first, k3s nodes 30 seconds apart, and LXCs last — a boot order strategy that costs nothing but prevents boot storms.

VM dedicated memory is a real reservation. LXC dedicated is a soft ceiling. Summing them together overstated pressure by 40GB — but the real risk was underestimating it. Here's the two-tier memory model that prevents a repeat of the ZFS ARC freeze.

Every firewall rule, VLAN, DHCP lease, and NAT port-forward on my MikroTik RB5009 is managed via Terraform and applied through Atlantis pull requests. Here's the full flow from PR to RouterOS apply, including the VLAN matrix, deterministic rule ordering, and LED night-mode scheduling.

paperless-gpt's VISION_LLM_MODEL pointed at a text-only model that fabricated German OCR content for real documents. Combined with an Ollama iGPU that crashed 451 times in one day from an unstable Vulkan/radv fallback, the AI pipeline was hallucinating on hallucinating hardware.

HashiCorp Vault OSS doesn't support auto-unseal without a KMS. The workaround: a polling sidecar that reads unseal keys from a Kubernetes Secret and runs vault operator unseal every 5 seconds. The trade-offs, the security boundary, and the seal window.

Running scheduled chaos experiments on a non-production k3s cluster. Weekly pod-kills and latency injection — what breaks, what it teaches, and why chaos testing matters even when nobody's paying for uptime.

Zero inbound firewall rules for external service access. How Cloudflare Tunnel works with split-DNS on AdGuard, the chunked_encoding fix for large Immich uploads, and why routing Atlantis through Traefik matters for Authelia protection.

A Logic App Standard booted into an HTTP 403 at every restart, and the portal designer only showed a generic error. Root cause: a private Storage Account needs four Private Endpoints - blob, file, queue, and table - not just the two that look obvious. Here's the postmortem and the Terraform that prevents it.

Velero's daily backup reported 'Completed' for weeks without ever capturing PVC data. The k8s manifests were there, but Postgres, Vaultwarden, and Paperless data was completely missing. Here's how defaultVolumesToFsBackup fixes it and why velero backup describe is the only real verification.

How a single Authelia instance protects Proxmox, PBS, Grafana, ArgoCD, Headscale, and 20+ web apps with OIDC — CNPG-managed Postgres, Redis sessions, hmac_secret in Vault, and a Traefik ForwardAuth middleware that gates every request.

Atlantis was running inside k3s, managing the same Proxmox VMs it ran on. When bpg/proxmox issued a qmshutdown for a non-live-update attribute, it killed the Atlantis pod that was executing the apply. Here's the structural hazard and the fix.

My Proxmox host froze under load three times in one week. The root cause wasn't software — it was a marginal PSU triggering TDP throttling, which exposed a ZFS ARC deadlock. Here's the full chain from symptom to fix.

The nfs-provisioner's root-mount volume was backing up the entire shared NFS export as one 33.4GB blob every night — redundant because every app's PVC was already backed up separately. The investigation almost went wrong when the first hypothesis pointed at the wrong disk.

A hands-on comparison of the 5 best mini PCs for homelab use in 2026 — covering Intel N100, Ryzen 5, and Ryzen 7 platforms for Proxmox, K3s, and always-on workloads.

A hands-on comparison of the 5 best NAS devices for home backup in 2026 — covering Synology, QNAP, Terramaster, and UGREEN for personal and homelab use.

MikroTik RB5009 vs Ubiquiti UniFi Dream Router — a detailed head-to-head comparison covering VLANs, VPN, security, Terraform automation, and real-world homelab use.

A daily offsite backup cron job had a 99% failure rate for over a month. It looked like a credential or network problem. It was neither - Google Drive's API throttles hard on exactly the storage format Proxmox Backup Server uses, and a 24-hour cron window was never going to be enough.

Vault is the trust root every ExternalSecret reads from. Its namespace had zero NetworkPolicies — any pod in the cluster could reach it. The investigation also uncovered a class of ArgoCD drift that silently ignores merged changes.

CloudNativePG's auto-generated PodMonitor was missing a single label — Prometheus never scraped it. The same I/O fragility that causes etcd timeouts was triggering leader-election failures, restarting the operator 310 times in 21 days. Here's how I traced both root causes.

Why I replaced a heavyweight monitoring stack for host-level metrics with a single container, how Kyverno caught my first deploy before it hit production, and why internal-only dashboards don't need a public DNS record.

A full tour of the physical rack, compute, and networking gear powering my K3s cluster, Proxmox hosts, and everything I write about here — what I run, why I picked it, and what I'd change.

Adding health probes to 20+ workloads taught me that kubelet sends the Pod IP as the Host header — and apps with host-validation reject it. Here's the full sweep, the gotcha that caught me, and the probe patterns that actually work.

Moving Atlantis from Kubernetes to a dedicated LXC involved repointing the Cloudflare Tunnel. The new tunnel pointed straight at the LXC's IP, bypassing Traefik and Authelia entirely. Atlantis has no auth of its own. For roughly 18 hours, anyone with the URL had full plan/apply access to the infrastructure repo.

Two GiB wasn't enough, so I bumped to 3 GiB. Still OOMKilled. Bumped to 4 GiB. Still OOMKilled. The real fix wasn't memory at all — it was Terraform hash concurrency. Here's how I isolated the actual spike.

The database namespace holding Authelia's session storage had no network restrictions. Any pod in the cluster could reach it. Here's the audit that found it, the traffic pattern that shaped the fix, and the namespace I deliberately left unrestricted.

Discord voice was robotic for people hearing me. Confirmed clean over mobile data — home network path. Zero QoS on the WAN interface meant a 50 Mbit upload ceiling was easy to saturate. Here's the investigation, the fix, and why PCQ per-flow fairness matters.

DISASTER-RECOVERY.md documented the Proxmox Backup Server restore procedure in detail. It had never been executed end-to-end. Running it for the first time - against a scratch VM, alongside the still-running original - found a network conflict the documentation never mentioned.

A gitleaks baseline file is supposed to suppress known-false-positive findings. It turned out to be suppressing the live rpc_secret and admin_token for a production Garage S3 cluster - unrotated since the commit that introduced them to a public repo months earlier.

Deploy a production-grade monitoring stack on bare-metal k3s: Prometheus, Loki with Garage S3 storage, Promtail on edge nodes via Ansible, SNMP monitoring for MikroTik, and Grafana SSO via Authelia OIDC - all GitOps-managed.

Redis running without a PVC still has persistence enabled by default. When it can't write RDB snapshots to a read-only rootfs, it doesn't crash - it silently refuses all writes. Here's how that turned into a full Nextcloud outage and why the logs pointed at the wrong thing first.

A two-node recursive DNS stack with ad filtering, automatic config sync, and transparent failover - fully managed with Ansible.

capabilities.drop: [ALL] and runAsNonRoot: true passed schema validation cleanly. Within minutes of merge, nine containers - including both Postgres instances backing Paperless and Nextcloud - were down. Here's the failure analysis, why a manual kubectl fix got silently undone, and the lesson for any blanket securityContext change.

Migrating Jellyfin off k3s onto a GPU-passthrough LXC meant pointing a Service at an external IP. The EndpointSlice looked completely correct via kubectl - Service existed, endpoint listed right - but Traefik 404'd every request. A second, unrelated gotcha surfaced in the same migration: a PVC silently shared by reference across two unrelated files.

kubectl apply succeeds, the field reverts within seconds, and there's no error anywhere. Two ArgoCD debugging patterns that hit the same homelab three times in one day: repo-server cache staleness reverting live edits, and two Applications silently fighting over the same resource.

A full-history gitleaks scan of a homelab repo that had been running for months turned up 12 distinct plaintext secrets - including an OIDC signing key. Here's the scanning setup, the baseline strategy that doesn't block on pre-existing leaks, and the remediation plan.

Multiple rounds of 'reconstruct the firewall' work each added a fresh generation of rules without removing the old one. Because RouterOS evaluates rules in order and stops at the first match, the oldest, broadest generation was silently winning over the newest, narrower one - undoing a security tightening that looked complete in Terraform.

Two Raspberry Pis run DNS for an entire network with no one watching them most of the time. A hardware watchdog, fail2ban, an additive nftables host firewall that doesn't conflict with Docker, log size caps, and an alerting path that works even when the rest of the monitoring stack is down.

Replace MinIO with Garage - a single 50MB binary - as the Velero backup target. Full daily cluster backups with Longhorn volume snapshots, deployed via ArgoCD.

Kubernetes Secrets are base64-encoded, not encrypted. Moving secrets out of the cluster into Vault - and syncing them back via External Secrets Operator - gives you rotation, audit logging, and compliance without changing how applications consume secrets.

A single misconfigured resource limit triggered a cascade: OOMKill on the control-plane, load average of 90, 1.2M DNS queries per day, and kubelet reporting the wrong allocatable memory. Here's the full post-mortem.

Most Kubernetes clusters accept any container image, any privilege level, and any resource configuration by default. Kyverno lets you enforce policies at admission time - before anything runs. Here's how to build a supply chain security baseline with Audit-first rollout.

Set up IPv6 on MikroTik behind a FritzBox with CGN: ULA prefix, NAT66 masquerade - plus the RouterOS 7 bug that broke WiFi clients. Full setup and fix.

Most teams alert when availability drops below a threshold. Burn-rate alerting tells you how fast you're spending your error budget - so you page on trajectory, not just current state. Here's how to implement the Google SRE Workbook approach on a bare-metal k3s cluster.

Deploy Headscale on a bare-metal k3s cluster with Longhorn persistence, Traefik ingress, and Authelia OIDC authentication - fully GitOps-managed via ArgoCD.

HTTP-01 challenges fail behind a default-deny firewall. Switching cert-manager to Cloudflare DNS01 wildcard validation gives every Traefik IngressRoute a *.yourdomain.com certificate without opening port 80 to the internet.

How to manage an entire Kubernetes homelab - MetalLB, Traefik, Longhorn, Authelia, and more - as a Git repository using ArgoCD's App-of-Apps pattern.

How to get a real external IP on a bare-metal Kubernetes cluster using MetalLB L2 mode, and wire it up with Traefik for automatic HTTPS - fully GitOps-managed with ArgoCD.

A technical deep-dive into the network security requirements of NIS2 Article 21 and how to implement them in Azure using Terraform - with concrete code, not legal theory.

How to programmatically approve Azure AI Search Shared Private Links using AzAPI, and why your AI architecture will fail an audit without proper Identity Chaining.

How to build a production-grade Kubernetes homelab with K3s, Authelia SSO, Longhorn storage, and ArgoCD - and the five painful mistakes that will cost you hours if you don't know about them.

How to implement Azure Firewall Forced Tunneling in Terraform without triggering cycle errors, and why a simple 0.0.0.0/0 route will instantly break your Windows VMs.

Take a tour of a fully automated, segmented, and highly available homelab architecture orchestrated entirely via Ansible and GitOps.

Deploy a WireGuard VPN on MikroTik using Terraform. Learn how to implement role-based network access, isolating mobile devices from full admin laptops.

Master MikroTik's notoriously complex Bridge VLAN Filtering. Learn how to automate dynamic VLAN matrices, Proxmox trunk ports, and edge devices using Terraform.

How to build an enterprise-grade Azure network architecture that blocks internet traffic by default and survives aggressive DeployIfNotExists (DINE) policies - without breaking your CI/CD pipeline.

Learn how to enforce strict VLAN isolation, fast-track traffic, and build a default-deny firewall for MikroTik RouterOS using Infrastructure as Code.

A complete guide to automating a local AI stack on Proxmox LXC using Terraform and Ansible, including Open-WebUI and AMD Radeon Vega iGPU workarounds.

A deep dive into architecting a Zero-Trust Let's Encrypt automation using Terraform, Azure Private Link, and VNet Integration.