One wildcard certificate for a whole k3s cluster
Purpose The cluster serves its routes over HTTPS with one wildcard certificate. A single Traefik TLSStore named default holds it, and every IngressRoute says tls: {} to use it. The change started...
Homelab
Docs Drift Detector: Keeping Posts Honest About Versions
Purpose Posts go stale the moment Renovate bumps an image tag. A weekly job checks which versions each post documents against what is actually running, generates a rolling issue with the drift rep...
Config Compliance: Timezones, Logging, Provenance and a Repo Inventory
Purpose Four daily, report-only checks run against every Docker and k3s workload in the lab. Each answers a basic question: is the timezone set correctly, do logs actually reach Graylog, was this ...
The Compliance Fixer: From Finding to Reviewed Pull Request
Finding problems is the easy half. The compliance fixer turns findings into pull requests, and after a human merges, brings the Docker host to exactly the merged state without ever deleting data. I...
The Daily Ops Digest: Twelve Collectors, One Rolling Issue
The ops digest is a daily health check for the entire homelab. It runs without an LLM in the loop, uses twelve independent collectors, and posts results to one rolling issue that only changes when ...
Kubescape Scan and Triage: Security Posture Without the Noise
Purpose The daily Kubescape scan (Kubescape) already produces a full security audit of the k3s cluster, but a report with hundreds of controls is hard to read every day. This agent wraps the scan ...
Hermes Agents: How a Local AI Ops Crew Is Wired
This is the overview for a series on the agents that run automated operations inside this homelab. The first post covered the agent itself: its guardrails, identities, and how access works. This on...
SearXNG: Private Metasearch for the Homelab and Local AI Agents
Purpose SearXNG is a self-hosted metasearch engine. It does two jobs in the homelab: it’s a private web search for the household, which sends each query on to several upstream engines and merges t...
The Docs Pipeline: From a Three-Line Idea to a Reviewed Pull Request
Purpose New posts on this site come out of one pipeline: a three-line idea issue becomes a reviewed pull request. An LLM agent writes the brief and the draft; a person approves the brief and merge...
Jellyfin and HandBrake: Media Serving, GPU Encoding and a Permissions Puzzle
Purpose Jellyfin serves media to any device on the network without subscriptions or ads. HandBrake sits alongside it for automated format conversions, using an NVIDIA GPU for fast encoding. Post-p...