29posts
Amazon rebuilt its Kindle, Paperwhite and Colorsoft for 2026 while Kobo keeps its 2024 hardware. A comparison of the newest models, with pros, cons, and a verdict for readers who run Calibre-Web or Kavita on their own server.
FreeScout and LibreDesk are the two self-hosted helpdesks sysadmins keep comparing in 2026: a mature PHP/Laravel app whose saved replies, custom fields, API, and SAML SSO are paid one-time modules, and a single Go binary on PostgreSQL and Redis that includes all of it free. A high-level comparison of stacks, deployment, and what actually migrates when you switch.
Every alert config has "page me if CPU is above 90 percent" rules that fire during normal peaks and stay silent during real anomalies at quiet hours. This post makes the case for swapping them for forecast-based alerting, made practical by Mistral's new Timestral time-series foundation models, which forecast zero-shot on a CPU with quantile output and schedule-aware covariates.
Talos Linux, Flatcar, and Fedora CoreOS all promise an immutable, self-updating Linux for Kubernetes nodes, but they answer one question differently: how much of being a Kubernetes node does the OS decide for you? Talos is a shell-less appliance where Kubernetes is part of the OS, Flatcar is a minimal immutable host where you bring your own cluster, and Fedora CoreOS is the rpm-ostree Fedora underneath the Red Hat CoreOS world. A sysadmin comparison of lineage, governance, update mechanics, and which to pick for a fleet.
IncusOS and Talos Linux share one pitch: a locked down, immutable, API-managed operating system with no shell to log into. But they bet differently: Talos turns hardware into a Kubernetes appliance (now gaining a hypervisor in alpha), while IncusOS turns hardware into a virtualization host that runs everything else. A concept-level comparison for new users: how each philosophy works, what you give up, and which to pick and when.
celld from Deno Land runs a Cloudflare Workers application on your own machines: Durable Objects, KV, Queues, D1, Workflows, backed by your own S3 bucket and no control plane. A sysadmin tour of the use cases, the costs, and how the per-entity cell model differs from building on Postgres plus Redis.
In 2026 the cost of self-hosting email is not the server, it is the blacklist tax: inherited VPS IP reputation, broader sender mandates, and silent non-delivery you cannot see. My sysadmin verdict is that for most people it is no longer worth the pain, plus the narrow cases where it still is, and the relay-based middle ground I recommend instead.
The smallest automation in the smart home is also one of the most useful: a Wake-on-LAN packet that spins a sleeping server back to life. A sysadmin read on WoL use cases, Home Assistant automations, coexisting with Zigbee smart plugs, waking on demand, and how to shut down gracefully without cutting power under load.
Your smart bulb does not need access to the network your laptop sits on, but walling it off the wrong way breaks discovery, onboarding, and voice control. Smart home VLAN segmentation from a sysadmin perspective: mDNS, firewall zones per layer, hub placement, and device classes that should never be walled off entirely.
Most smart homes stop the moment the internet drops, because the command path leaves the house. A sysadmin guide to local-first control: Zigbee, Z-Wave, Matter and Thread devices paired to an on-premises hub, remote access added back with a tunnel or VPN, and the WAN-pull drill that proves it still works.
dbx, the 25 MB Tauri-based client from t8y2/dbx, and DBeaver, the Java veteran that has been the default database tool for years, keep showing up in the same threads. A plain-language comparison of their real advantages: dbx wins on size, startup, built-in AI, a free MCP server for coding agents, free NoSQL and message-queue consoles, and self-hosted deployment; DBeaver wins on universal JDBC compatibility, maturity, depth of SQL and admin tooling, and enterprise options.
Cloudflare Tunnel, Tailscale Funnel, and the classic reverse proxy with port forwarding all answer the same question, how does the internet reach a machine behind NAT, and they answer it differently: who dials whom. A sysadmin comparison of the three front doors, what each one actually is, what changes in the day-to-day, and where the honest choice lands.
Beszel and Dockhand keep showing up in the same conversation about lightweight self-hosted tools, so people assume they compete. They do not: Beszel is a monitoring hub with historical data and alerts, Dockhand is a Docker management UI. A sysadmin comparison of the two, the measured footprint of each, and how both stack up against the common alternatives: Netdata, Grafana plus Prometheus, Glances, Uptime Kuma, and Dozzle.
A hands-on, sysadmin comparison of Argo CD and Flux after operating both: bootstrap flows, Helm models, SOPS and age secret handling, multi-cluster architecture, drift detection defaults, image automation, disaster recovery, UI and API surface, and the repo structures that make each one click. With real commands and the honest limits.
A practical walkthrough that turns a bare Debian install into a secure, maintainable server with Ansible: SSH hardening and a deploy user, unattended-upgrades with the reboot policy you actually want, restic-based backups on a systemd timer, and a pinned Docker Engine install plus Compose deploys, with the reasoning and trade-offs behind every step.
A sysadmin guide to running OpenTelemetry traces on a small stack: one Collector, OTLP from your applications, sampling that keeps errors and drops the boring traffic, Tempo or Jaeger v2 as the backend, and the limits that bite when the whole pipeline runs on one box.
A sysadmin guide to the Linux watchdog timer: what the kernel watchdog device actually does, why a hardware watchdog and the softdog module are not the same thing, and five steps to arm it safely, from systemd RuntimeWatchdogSec and per-service WatchdogSec to the userspace watchdog daemon, with the tests that prove it fires before you need it.
Supabase and Appwrite are the default names for a self-hosted backend, and both are heavier than most light projects need. A repo-level review of the alternatives that actually fit: PocketBase, Fluxbase, Spin, and Orva, plus TrailBase and Nhost, with the BaaS versus FaaS distinction, the real use case each one wins, and the limits their own READMEs admit.
Docker and Incus both run containers on the same Linux primitives, but they wrap the kernel mechanism in different abstractions: Docker packages an application, Incus launches a whole operating system. A theoretical comparison of application containers and system containers, the lifecycles each one assumes, and when each unit of management is the right one, with links to our Proxmox vs IncusOS coverage.
Why the 3-2-1 backup rule fails when ransomware and compromised root credentials are the threat: immutable and offline copies, quarterly restore drills, recovery key management, and backing up the configuration that defines your stack. A hands-on sysadmin guide.
After 90 days with self-hosted Immich, the remaining question was what else exists: Ente Photos, the end-to-end encrypted Google Photos alternative that is both a polished cloud service and a fully self-hostable server. A hands-on comparison of Immich, Ente cloud, and Ente self-hosted, with costs, family plans, referral terms, migration, and an honest decision rule.
Dependabot is built into GitHub and zero-config; Renovate is the configurable bot that runs on Gitea, Forgejo, GitLab, and GitHub alike. A hands-on sysadmin comparison: real config for both, the best use cases for each, and the Renovate difficulties that only show up after the onboarding pull request.
Durable execution is the difference between automation that mostly works and workflows you can trust with money, mail, and user data. A practical architect guide to what durable workflows are, the use cases that need them, and an honest comparison of Temporal, Hatchet, Conductor OSS, Apache Airflow, and BullMQ, including the self-hosting footprint of each.
mTLS authenticates both sides of an internal connection, which closes a real hole on a LAN full of devices, and it does not fix application bugs, stop a compromised service, or survive root on the host. A hands-on look at the threat model, client certificates with Caddy and Nginx, service mesh identity, and the mobile apps that cannot present a certificate.
A hands-on sysadmin comparison of Caddy, Traefik, and Nginx Proxy Manager for self-hosting: how each one models configuration, how automatic TLS works in practice, Docker discovery through labels and plugins, the security boundaries including the docker.sock question, the debugging commands that matter, and the honest answer to when GUI convenience stops scaling.
A practical, sysadmin-grade comparison of Proxmox VE and IncusOS: the argument that matters (you own Proxmox's mutable Debian base, IncusOS owns itself), atomic A/B updates, Secure Boot and TPM, storage and networking, real commands for both, the honest limits of the young IncusOS, and when each earns its keep.
A sysadmin's hands-on walkthrough of a scratch-based, rootless Docker image for the SimpleX Chat CLI. Since the chat server binds 127.0.0.1 only (issue #6449 is still open), a small socat bridge exposes it on 0.0.0.0. Full multi-stage Dockerfile, build and run commands, and the honest trade-offs.
A practical, sysadmin-grade comparison of Fail2ban and CrowdSec: how each detects and blocks malicious traffic, the architecture that separates them (local log analysis vs community-shared intelligence), real configuration and commands, honest pros and cons, and when to run Fail2ban, CrowdSec, or both.
After 90 days running self-hosted Immich instead of Google One for our family photos: what worked, what it actually costs, why your data finally stays on hardware you own, and the honest gaps that are still missing for families, straight from the project's own roadmap and issue tracker.