// /writing
Field notes
Walkthroughs of things I built and why. Mostly self-hosted infrastructure. the kind of writeups I wish existed when I was hunting for the answer at 2am.
Splunk got a VM, not a container
How the homelab SIEM was stood up. Proxmox Ubuntu VM, Splunk Enterprise install, listeners, indexes, and the five live sources that feed it.
When Tailscale breaks your LAN host's gateway
The host was up on the tailnet and dead to its own LAN. Accept-routes on a box that sits on the subnet someone else is advertising sends local traffic into a tunnel that cannot deliver it.
pfSense REST API v2 on Netgate | install, tradeoffs, and what it's good for
The community REST API package isn't in Netgate's Package Manager. Here's why I installed it anyway, how the one-liner install works, and what automation it unlocks on a homelab firewall.
Making pfSense the front door to my LAN over Tailscale
I moved remote network access off a DNS box and onto the firewall where it belongs, hit a pfSense package bug that silently failed to apply a setting, and tightened access down to exactly who needs what.
SecureCRT Button Command Suite - Full NOC Automation Pack
200+ commands across 13 sections, platform-tagged for IOS/IOS-XE, IOS-XR, NX-OS, ASA, and FTD/FMC. wired into SecureCRT's button bar to cut the time spent typing the same commands during every troubleshooting call.
Why TLS made my homelab actually usable
Running eight internal services without HTTPS is a friction tax you pay every day. Here's how I fixed it with nginx, acme.sh, and a single wildcard cert. no manual renewals, no browser warnings.
When the firewall isn't the edge
Half the lab was misbehaving in unrelated ways. The common cause was one NAT I didn't own.
Putting the platform under Ansible
A host crash exposed config drift across 8 machines. Ansible closed the gap in an afternoon.
Dual-repo pattern for self-hosted platforms. public portfolio, private source of truth
Real configs and portfolio screenshots don't belong in the same git history. Here's the pattern I use, why it matters, and the gh commands to set it up.
Wildcard TLS for a self-hosted homelab | Cloudflare DNS-01, end to end
How I gave eight internal services real Let's Encrypt certificates with one wildcard, no port forwards, and automated renewal. Walks through the Cloudflare token, acme.sh setup, nginx wiring, and the gotchas that bit me.
The NIC that wouldn't bridge | Intel I350-T4V2 as the foundation for a segmented lab
The onboard NIC that couldn't pull DHCP through VMware bridged networking, the diagnosis that pointed at consumer hardware limits, and why I picked a server-grade Intel quad-port over cheaper alternatives.