18posts
Cloudflare Tunnel, Tailscale Funnel, and the classic reverse proxy with port forwarding all answer the same question, how does the internet reach a machine behind NAT, and they answer it differently: who dials whom. A sysadmin comparison of the three front doors, what each one actually is, what changes in the day-to-day, and where the honest choice lands.
Beszel and Dockhand keep showing up in the same conversation about lightweight self-hosted tools, so people assume they compete. They do not: Beszel is a monitoring hub with historical data and alerts, Dockhand is a Docker management UI. A sysadmin comparison of the two, the measured footprint of each, and how both stack up against the common alternatives: Netdata, Grafana plus Prometheus, Glances, Uptime Kuma, and Dozzle.
A hands-on, sysadmin comparison of Argo CD and Flux after operating both: bootstrap flows, Helm models, SOPS and age secret handling, multi-cluster architecture, drift detection defaults, image automation, disaster recovery, UI and API surface, and the repo structures that make each one click. With real commands and the honest limits.
A practical walkthrough that turns a bare Debian install into a secure, maintainable server with Ansible: SSH hardening and a deploy user, unattended-upgrades with the reboot policy you actually want, restic-based backups on a systemd timer, and a pinned Docker Engine install plus Compose deploys, with the reasoning and trade-offs behind every step.
A sysadmin guide to running OpenTelemetry traces on a small stack: one Collector, OTLP from your applications, sampling that keeps errors and drops the boring traffic, Tempo or Jaeger v2 as the backend, and the limits that bite when the whole pipeline runs on one box.
A sysadmin guide to the Linux watchdog timer: what the kernel watchdog device actually does, why a hardware watchdog and the softdog module are not the same thing, and five steps to arm it safely, from systemd RuntimeWatchdogSec and per-service WatchdogSec to the userspace watchdog daemon, with the tests that prove it fires before you need it.
Supabase and Appwrite are the default names for a self-hosted backend, and both are heavier than most light projects need. A repo-level review of the alternatives that actually fit: PocketBase, Fluxbase, Spin, and Orva, plus TrailBase and Nhost, with the BaaS versus FaaS distinction, the real use case each one wins, and the limits their own READMEs admit.
Docker and Incus both run containers on the same Linux primitives, but they wrap the kernel mechanism in different abstractions: Docker packages an application, Incus launches a whole operating system. A theoretical comparison of application containers and system containers, the lifecycles each one assumes, and when each unit of management is the right one, with links to our Proxmox vs IncusOS coverage.
Why the 3-2-1 backup rule fails when ransomware and compromised root credentials are the threat: immutable and offline copies, quarterly restore drills, recovery key management, and backing up the configuration that defines your stack. A hands-on sysadmin guide.
After 90 days with self-hosted Immich, the remaining question was what else exists: Ente Photos, the end-to-end encrypted Google Photos alternative that is both a polished cloud service and a fully self-hostable server. A hands-on comparison of Immich, Ente cloud, and Ente self-hosted, with costs, family plans, referral terms, migration, and an honest decision rule.
Dependabot is built into GitHub and zero-config; Renovate is the configurable bot that runs on Gitea, Forgejo, GitLab, and GitHub alike. A hands-on sysadmin comparison: real config for both, the best use cases for each, and the Renovate difficulties that only show up after the onboarding pull request.
Durable execution is the difference between automation that mostly works and workflows you can trust with money, mail, and user data. A practical architect guide to what durable workflows are, the use cases that need them, and an honest comparison of Temporal, Hatchet, Conductor OSS, Apache Airflow, and BullMQ, including the self-hosting footprint of each.
mTLS authenticates both sides of an internal connection, which closes a real hole on a LAN full of devices, and it does not fix application bugs, stop a compromised service, or survive root on the host. A hands-on look at the threat model, client certificates with Caddy and Nginx, service mesh identity, and the mobile apps that cannot present a certificate.
A hands-on sysadmin comparison of Caddy, Traefik, and Nginx Proxy Manager for self-hosting: how each one models configuration, how automatic TLS works in practice, Docker discovery through labels and plugins, the security boundaries including the docker.sock question, the debugging commands that matter, and the honest answer to when GUI convenience stops scaling.
A practical, sysadmin-grade comparison of Proxmox VE and IncusOS: the argument that matters (you own Proxmox's mutable Debian base, IncusOS owns itself), atomic A/B updates, Secure Boot and TPM, storage and networking, real commands for both, the honest limits of the young IncusOS, and when each earns its keep.
A sysadmin's hands-on walkthrough of a scratch-based, rootless Docker image for the SimpleX Chat CLI. Since the chat server binds 127.0.0.1 only (issue #6449 is still open), a small socat bridge exposes it on 0.0.0.0. Full multi-stage Dockerfile, build and run commands, and the honest trade-offs.
A practical, sysadmin-grade comparison of Fail2ban and CrowdSec: how each detects and blocks malicious traffic, the architecture that separates them (local log analysis vs community-shared intelligence), real configuration and commands, honest pros and cons, and when to run Fail2ban, CrowdSec, or both.
After 90 days running self-hosted Immich instead of Google One for our family photos: what worked, what it actually costs, why your data finally stays on hardware you own, and the honest gaps that are still missing for families, straight from the project's own roadmap and issue tracker.