Recipes
19 sheets
- RecipesTask-oriented, end-to-end walkthroughs that stitch several cheat sheets together. Each recipe has a goal, prerequisites, numbered steps, a verification step…
- Automate Container Updates SafelyKeep Docker Compose stacks current without surprises: pin image tags and digests in git, let Renovate propose each update as a pull request, let Diun tell you…
- DNS TroubleshootingTrace a failing or wrong DNS answer from the application down through the local resolver, the upstream resolver and the authoritative servers, including…
- Docker Service DeployDeploy a Docker Compose application behind Traefik with automatic Let's Encrypt TLS, with secrets kept out of the Compose file, healthchecks, and a routine for…
- Expose a Service with Cloudflare TunnelPublish a self-hosted web app on https://app.example.com without opening any inbound port, using cloudflared in Docker Compose and a tunnel token, then put an…
- K3s Cluster from ScratchBuild a K3s cluster starting with one node, then grow it to three servers (HA with embedded etcd) plus agents, reach it with kubectl, and add ingress with TLS…
- Migrate a Docker Service Between HostsMove a Compose stack, its volumes and its database from one Docker host to another with a short, planned outage, a DNS cut-over and a way back.
- Monitor a Homelab with Prometheus and GrafanaRun Prometheus, Alertmanager, node_exporter, cAdvisor and Grafana from one Compose file, scrape the host and its containers, alert on the things that actually…
- Network Hardening RecipeA layered checklist for hardening a homelab network: segment it, lock down the edge and the hosts, then add detection and regular scanning. Each step points at…
- Network TroubleshootingA layered approach for "A cannot reach B": check the link, the address and route, name resolution, the path, the port, and finally the application, and stop at…
- New Server ChecklistTake a fresh Ubuntu 24.04 server from first login to a patched, key-only, firewalled host with Docker installed.
- Off-Site Docker Host Backup with resticBack up the volumes, Compose files and databases of a Docker host to an encrypted restic repository on Backblaze B2 (or a Hetzner Storage Box), on a nightly…
- Proxmox VM Template and CloneBuild an Ubuntu cloud-init template once, clone it into new VMs in seconds, resize the disk, and configure each VM with Ansible.
- Restore-Test a BackupProve that a restic backup of a Docker host can be restored from a clean machine: list it, restore a file, restore a database dump into a scratch Postgres…
- Single Sign-On with authentikPut authentik behind Traefik at https://auth.example.com, give Grafana real OIDC single sign-on, and protect an app that has no SSO of its own with Traefik…
- SSH Bastion Host in an LXCRun one small, hardened host as the only SSH entry point to your lab, so servers do not each face your network or VPN. This recipe builds it in a minimal…
- TLS TroubleshootingA decision tree for "the certificate is broken" problems. Work top to bottom: each step either finds the fault or rules a layer out.
- WireGuard Remote AccessSet up a WireGuard server on a Linux host at home, add laptop and phone clients, choose between full and split tunnel, route and NAT the traffic, and…
- Zsh with antidote, Oh My Zsh and Powerlevel10kGoal: a fast, reproducible Zsh set-up: antidote loads Oh My Zsh plugins, completions, autosuggestions and syntax highlighting, Powerlevel10k draws the prompt…