Things I build, break, fix, and write about

30 August 2026
Self-hosted analytics without cross-site tracking

Plausible Analytics keeps the tracking honest enough for a homelab. It counts site use without the usual baggage, and the trade-offs are plain to see, which is more than I can say for most analytics stacks I’ve had to unpick.

30 August 2026
Home Assistant screen automation with Android hooks

Android interoperability is only interesting when it stops being a slogan and starts changing what third-party assistants can actually do. I have...

29 August 2026
Trusted proxies and interface binding in Home Assistant

Home Assistant OS web server settings matter more than they used to, because the port, bind and trusted proxy choices now decide how the box is...

29 August 2026
controller-runtime cache: stale reads and conflicts

controller-runtime cache makes reads look easy until you trust them too much. I have chased stale objects and pointless conflicts through more than...

Latest blog posts you might like

30 August 2026
Self-hosted analytics without cross-site tracking

Plausible Analytics keeps the tracking honest enough for a homelab. It counts site use without the usual baggage, and the trade-offs are plain to see, which is more than I can say for most analytics...

30 August 2026
Home Assistant screen automation with Android hooks

Android interoperability is only interesting when it stops being a slogan and starts changing what third-party assistants can actually do. I have spent long enough working around Android’s polite...

29 August 2026
Trusted proxies and interface binding in Home Assistant

Home Assistant OS web server settings matter more than they used to, because the port, bind and trusted proxy choices now decide how the box is reached. Get them wrong and I have seen proxy setups...

29 August 2026
controller-runtime cache: stale reads and conflicts

controller-runtime cache makes reads look easy until you trust them too much. I have chased stale objects and pointless conflicts through more than one controller, and the fix was never magic, just...

28 August 2026
Static Pod config breaks without API access

Kubernetes static pods are unforgiving when kubelet cannot satisfy a reference locally. I have seen a tidy manifest fail because it quietly leaned on the API server, and the fix was not clever, just...

28 August 2026
Gateway API TCPRoute for raw L4 routing

Gateway API TCPRoute finally gives raw L4 routing a proper shape, without the usual controller-specific nonsense. I like it because it stays plain, listener attachment is explicit, and you are not...

27 August 2026
Clipboard hijacking in cryptocurrency transfers

clipboard hijacking works because the address still looks right, until it does not. I prefer to treat the clipboard as hostile, especially with cryptocurrency transfers, where one careless paste is...

27 August 2026
Device encryption limits corporate data theft

Device encryption is useful, but it will not save you from corporate endpoint data theft once a session is live. I have seen the mess that comes from cached files, browser stores, and synced folders;...

26 August 2026
Retaining access logs for healthcare breach notifications

Healthcare breach notifications are only as solid as the logs behind them. I have seen enough broken audits to know that dashboards are no substitute for raw access records, especially when the notice...

26 August 2026
Self-hosted Metabase exposure from unauthenticated SQL

I’ve seen enough self-hosted tools turn into soft centres, and Metabase SQL injection is another reminder. If your analytics box holds credentials, exports and admin access in one place, one bad...