When I spin up a new Hetzner Cloud VM, I paste a cloud-init file into the “Cloud config” box and let the server set itself up. Hetzner’s community tutorial has a nice baseline: a sudo user, SSH moved to port 2222, root and password logins disabled, fail2ban and ufw. What it doesn’t have is Docker. This post is the version I actually use, plus a few things I corrected after checking it against current documentation.
Isolating a guest VLAN on OPNsense with a Ruckus AP: no sneaking through to the main network
My Ruckus access point broadcasts a dedicated guest SSID and tags that traffic with a separate VLAN before handing it to OPNsense. The AP side is easy – Ruckus does the tagging reliably. The router side is where things go wrong if the firewall rules are in the wrong order or a step gets skipped. Here is the full setup I use to make sure a guest really cannot reach anything on the internal network.
Deploying LXC containers at scale on Proxmox: cloud-init alternatives
Every time I spin up a new LXC on Proxmox, I ask myself the same question: why can’t I just hand it a cloud-init file like I do with VMs? The short answer is that cloud-init is a VM-only feature in Proxmox. LXC containers don’t support it natively. But there are several approaches that get you to the same place — or better.
This post covers the options, the trade-offs, and what I actually use for a fleet of Ubuntu + Docker + Docker Compose + Dockge containers.
Setting up Grafana Alloy on Windows – Metrics and Event Logs for the Homelab
My homelab observability stack has been running for a while – Loki for logs, Mimir for metrics – but my gaming PC HEYDIELES wasn’t wired into it yet. That changes now. With Grafana Alloy, setting up Windows monitoring turns out to be surprisingly clean.
Country-based geoblocking in NPMplus: allow only Germany and Switzerland (or block a single country)
I run several self-hosted apps behind NPMplus (the ZoeyVid fork of Nginx Proxy Manager). They are reachable over my domain without any open ports other than the reverse proxy, but “reachable from the whole internet” is more exposure than most of them need. None of mine have to be accessible from outside the DACH region, so one cheap extra layer is country-level geoblocking: anything from outside the countries I care about simply gets dropped.
NPMplus has GeoIP2 built in, and the important part is that you can apply it per proxy host (or even per location), not just globally. So one host can be locked to Germany and Switzerland while the rest stay open. Here are the two recipes I use.
Split-Horizon DNS with Technitium and OPNsense: Resolving Internal Hosts Locally (plus Let’s Encrypt via DNS-01)
My home network uses Technitium DNS as the primary DNS server and OPNsense as the router. I own a public domain (in this post I’ll use domain.com as a placeholder), and I wanted truenascale.domain.com to point to my TrueNAS SCALE box on the LAN instead of being resolved somewhere on the internet. On top of that, I wanted a proper TLS certificate for it without exposing the NAS to the outside world.
Homelab logs and metrics with Grafana Alloy: journald to Loki, metrics to Prometheus
My homelab has grown to a good dozen Linux hosts: Proxmox nodes, Docker VMs, a few VPSs. For a while every host had something different collecting logs and metrics: an old OpenTelemetry Collector here, a Docker Loki logging driver there, nothing at all somewhere else. Now every host runs Grafana Alloy with almost the same config:
- Logs: journald → Loki
- Host metrics: built-in node exporter → Prometheus
- Container metrics (Docker hosts only): built-in cAdvisor → Prometheus
Everything is pushed. Prometheus doesn’t need a scrape job per host and the hosts don’t need any open ports. And no, you don’t need Mimir for that: Prometheus can receive remote writes itself.
UPS shutdown with NUT over SNMP – Part 2: TrueNAS SCALE
This is the second half of a two-host setup on one shared UPS (APC Smart-UPS SMT1500RMI2U with an AP9630 network card). Part 1 explains the design and the Proxmox side. In short:
- Every host polls the UPS card directly over SNMP and shuts itself down. No NUT master that everyone depends on.
- Proxmox goes down at 50%, TrueNAS at 40%. The VMs that write to the NAS are stopped before the NAS itself shuts down.
- A read-only SNMP community means no host can cut power to the shared UPS.
Tested on TrueNAS SCALE 24.10 (Electric Eel), NUT 2.8.0. Everything here is done in the web UI, no shell editing needed.
UPS shutdown with NUT over SNMP – Part 1: Proxmox VE
My Proxmox host and my TrueNAS share one UPS: an APC Smart-UPS SMT1500RMI2U with an AP9630 (NMC2) network management card. No USB cable, just Ethernet/SNMP.
Until now NUT ran as a container on the Proxmox host and served everything else. That’s a classic single point of failure: if Proxmox goes down first, the NUT server goes with it and nobody else gets told anything.
The design
- No master/slave. Each host polls the UPS card itself over SNMP and shuts itself down.
- Staggered thresholds: Proxmox shuts down at 50% battery, TrueNAS only at 40%. That way every VM/container writing to NAS shares is already stopped cleanly before the NAS goes down (consumer before provider).
- Read-only SNMP community. No host can accidentally cut power to the shared UPS, even though NUT runs locally as
primary.
Part 2 covers the TrueNAS side. This part is about Proxmox VE 8 (Debian 12, NUT 2.8.0).
Running SeAT 5 in Docker: every problem I hit and how I fixed it
I run SeAT, the EVE Online corporation management tool, for our corp in Docker on a Proxmox LXC, managed with Dockge. Getting it from SeAT 4 to SeAT 5 and then keeping it healthy turned into a long series of problems. This post collects all of them in one place, with the fixes that actually worked, so the next person (or future me) doesn’t have to dig through logs again.
The stack is a split compose setup, so every command needs the full -f chain:
|
1 2 |
cd /opt/stacks/seat-exop docker compose -f docker-compose.yml -f docker-compose.mariadb.yml -f docker-compose.proxy.yml up -d |
Services are front, worker, scheduler, cache (Redis) and mariadb.