Things I build, break, fix, and write about

28 April 2026
Testing Proxmox restores before production relies on them

A green job in a Proxmox backup guide means very little until the restore boots, logs in, and serves traffic. I have trusted the dashboard before, only to find the archive was fine and the recovery was not, which is a poor way to learn anything.

27 April 2026
Network segmentation for vehicle data in Home Assistant

Modern cars are noisy little computers, and vehicle telemetry isolation only works if you treat them that way from the start. I put the car on its own...

26 April 2026
Isolating Android on a VLAN with firewall rules and split

I would not migrate an Android phone into my homelab blind. A clean Android homelab firewall DNS split, with VLAN isolation and hard DNS rules, keeps...

26 April 2026
Security Advisory – 24 Apr 2026

Daily security advisory summary for 24 Apr 2026

Latest blog posts you might like

12 April 2026
Isolating n8n in Docker: network policies and backup

Running n8n in your homelab without proper isolation is a liability. CVE-2025-68613 lets authenticated users execute code with container privileges; if that container sits on your default Docker...

11 April 2026
Offline agentic AI coding without subscription limits or

Running a local model means no quota walls, no token metre ticking, and no surprise bills when the agent loops through ten reasoning steps. Cloud coding assistants collapse under agentic use; local...

10 April 2026
Blocking residential proxy traffic with stateful firewall

Most home routers allow everything outbound by default, which is exactly how AVRecon persisted undetected for six years. A stateful firewall with explicit outbound rules and network segmentation...

9 April 2026
Personal health data needs local storage, not cloud

Health data inside a corporate platform means health data inside a jurisdiction you do not control, encrypted or not. Self-hosting it locally—with proper backups and audit trails—trades convenience...

7 April 2026
Privilege boundaries as lateral movement stops

A compromised host on a flat network can reach every other node without crossing a single firewall rule. Network perimeter checks are useless if the interior is trusted by default; that is where...

6 April 2026
Air-gapped browsing in homelabs: containment without

A 48-hour gap between exploit discovery and patch deployment is normal, not exceptional. Browser isolation in your homelab is not about making the browser safe; it is about making sure a compromised...

6 April 2026
Amazon Fire TV Stick HD and 2 more Amazon tech bargains

Discover the Amazon Fire TV Stick HD and more tech deals this week.

5 April 2026
Process jails and kernel isolation for untrusted agent code

Running untrusted AI agents in standard Docker containers leaves you exposed to kernel exploits that bypass every namespace and policy you've layered on top. MicroVMs add a hardware boundary that...

3 April 2026
Using IP reputation data from Operation Synergia in your

Operation Synergia III sinkholed 45,000 botnet and malware IPs across 72 countries with law enforcement backing. That chain of custody makes the data worth blocking at your firewall; the catch is that...

1 April 2026
Zram and zswap: choosing compression for constrained systems

I've built systems that swap differently depending on what dies first: the CPU or the storage. Zram and zswap solve adjacent problems, and picking the wrong one costs you either write cycles or...